Privacy Policy

This Privacy Policy explains how Picvant (“we”, “us”) collects, uses and protects your information when you use https://picvant.com and its AI image tools. By creating an account or using the service, you agree to the practices described here.

The data controller is Yang Lingtao, an independent operator based in China, trading under the product name Picvant. Privacy questions and rights requests can be sent to privacy@picvant.com.

Account information. Your email address, display name and authentication identifiers when you sign up with email, Google or GitHub. We never store your password directly — authentication is handled by our identity provider.

Content you provide. Prompts, reference images and generated results, together with generation metadata such as timestamps and credits consumed. Browser-only utilities continue to process selected files locally and do not upload them to Picvant.

Usage information. Basic analytics about pages visited and features used, collected only when analytics is enabled for the site.

Billing information. Payments are processed by our payment provider. We receive only subscription status and entitlement data — never your full card details.

We use the information above to:

• authenticate you and keep your workspace private and attached to your account
• run the image generation and browser-based utility workflows you request
• maintain your credit balance and subscription entitlements
• send transactional email such as confirmation and password recovery messages
• prevent abuse and keep the service secure

Where data-protection law requires a legal basis, we process account, workspace and billing data to perform our contract with you; security and limited operational data for our legitimate interests in preventing abuse and maintaining the service; optional analytics with your consent; and records where necessary to comply with legal, tax or payment obligations. You may withdraw analytics consent through Cookie settings in the site footer.

Before generation, user-supplied prompts are sent to Creem's Moderation API for content safety screening. Allowed prompts and any selected reference images are then sent through a server-side request to the provider selected for the generation mode. Image generation and reference-image workflows currently use selected models through Replicate. Every generation consumes credits, including generations funded by welcome credits.

We do not use your prompts or images to train models ourselves. Provider processing and retention practices are governed by their terms and privacy notices, so avoid including confidential or unnecessary personal information in prompts.

Account data is stored in a managed Postgres database with row-level security, so your rows are only accessible through your own authenticated session. Generated images are stored in private object storage and served through protected URLs. Pending reference uploads expire after 24 hours if they are not used; used references remain attached to the private generation until it is deleted. Providers receive only short-lived signed source URLs. Data is encrypted in transit; access to production systems is limited to the operators of the service.

We rely on a small set of processors to operate the service:

• identity and database hosting (authentication and account storage)
• object storage for generated images
• Replicate and its routed model providers for image generation
• Creem for payments, subscriptions and pre-generation prompt moderation
• an email delivery provider for transactional messages

We do not sell your personal information, and we share it only to operate the service or where required by law.

Picvant serves users internationally and uses providers in multiple countries. Depending on the workflow you choose, account, prompt, image, support or billing data may be processed in the United States, China and other countries where our providers operate. Those countries may have different privacy laws. Where required, we rely on the lawful transfer mechanisms and contractual safeguards available for the relevant provider. Contact us for information about a specific workflow before submitting sensitive data.

Generation history and completed results are retained while your account is active so you can access them. After a verified deletion request, we remove or de-identify the account and associated workspace data from active systems within 30 days, except where records must be retained for legal, tax, fraud-prevention, dispute or security purposes. Residual encrypted backups may remain until their ordinary rotation period ends.

Depending on where you live, you may have the right to access, correct, export or delete your personal information, and to object to or restrict certain processing. You can exercise these rights by emailing privacy@picvant.com from the account address. We may request information needed to verify your identity and locate your data.

If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority.

The service is not directed at children under 13 (or under 16 in the EEA), and we do not knowingly collect their personal information. Users under 18 may not purchase plans or credits and may use eligible non-purchase features only with parent or guardian consent.

We may update this policy as the service evolves. Material changes will be announced on this page with a new “Last updated” date. Questions? Email privacy@picvant.com. See also our Terms of Service and Cookie Policy.