Privacy policy

Effective date: November 3, 2026

In short: We collect what we need to run your account, take payments and run your tasks. Stripe handles card payments, and we never see or store your card number. Your prompts and files go to the third-party model provider that runs your task. Result files are deleted after 7 days, and you can delete them sooner. We only count page visits if you accept analytics, and you can withdraw that and erase the data at any time. We do not sell your data or use advertising trackers.

This policy explains how Oakrelay Labs LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA (“VizoAPI”, “we”, “us”) handles personal data when you use vizoapi.com, the console and the API. We are the controller of this data. For questions, write to support@vizoapi.com.

What we collect

Account data. Your email address, whether it is verified, a salted hash of your password if you set one, and your Google account ID if you sign in with Google. We also keep your projects, team role, language and notification settings.

Sign-in and security data. Session records (when a session started and was last used), one-time email codes and links until they are used or expire, and the result of the Cloudflare Turnstile check on sign-in and sign-up pages.

API keys. The key name, its project, limits and settings, and a fingerprint of the key. We show the full key only once and do not store it in readable form.

Billing data. Your top-up orders: pack, currency, amount, tax, payment status and the payment method type. Stripe processes your payment details. We receive payment references and status from Stripe, never your full card number. We also keep your Credits ledger: top-ups, holds, charges, releases, redeem codes and refunds.

Task data. For each task: the model, the prompt and parameters you sent, your input files, the result files, status times, price and charge, and any metadata or client_reference you attach. If you use webhooks, we keep the endpoint URL and a delivery log.

Saved card for auto top-up. If you save a card for auto top-up, we keep the card’s brand, last 4 digits and expiry date, plus a Stripe reference to the card. The full card number stays with Stripe.

API key source IPs. For each API key, we record the IP addresses that call the API with it, with when each address was first and last seen and how many requests it made, so you can review where a key is used.

Technical data. Our hosting and network providers process IP addresses and request details to deliver the service and protect it from abuse. If you set an IP limit on a key, we store the addresses you enter.

Analytics data, only with your consent. See “Analytics” below.

Messages. What you send us when you contact support, and records of the emails we send you.

How we use it

To create and secure your account, sign you in and stop abuse (based on our contract with you and our legitimate interest in security).
To run your tasks: we send your prompt, parameters and input files to the model provider that carries out the task, store the result and deliver it to you (contract).
To take payments, keep accurate billing records, handle refunds and meet tax and accounting rules (contract and legal obligation).
To send service emails: email verification, sign-in codes, password and email changes, security notices, delayed payments, low balance, task results and daily summaries, webhook failures, service incidents and content cases. You can turn off optional notices in the console settings.
To send product news and offers to registered users (our legitimate interest in telling you about the service). Every such email has a one-click unsubscribe link. Unsubscribing does not stop service emails such as sign-in codes, receipts, task and security notices, which we always send. If you are in the EU or the UK, we only send you marketing about services similar to those you have used, unless you have agreed to more, and you can opt out at any time.
To investigate reports and enforce our terms of service.
To understand which pages help, only if you accept analytics (consent).

We do not sell personal data, and we do not use it for targeted advertising.

Analytics

When you first visit, a bar at the bottom of the page asks whether we may count page visits. Nothing is sent until you choose “Accept”.
If you accept, we record events such as which page you viewed, together with a random browser ID. We do not use third-party analytics or advertising scripts. When you are signed in, we may link these events to your account to understand how people start using the service.
Raw events are deleted after 30 days, and links between a browser and an account after 90 days. We keep daily totals that do not identify you for up to 13 months.
You can change your choice any time from “Analytics settings” in the footer. If you withdraw consent, we delete the browser ID and the events recorded with it.

Cookies and local storage

We use only first-party cookies and browser storage:

__Host-media_session: keeps you signed in. Required. A session ends after 12 hours without use or 7 days at most, or when you sign out.
__Host-media_google: protects the Google sign-in step. Required, and only used during that step.
vizo-consent: remembers your analytics choice for 180 days.
relay_analytics: a random browser ID for analytics. Set only after you accept, for up to 30 days.
vizo-locale: remembers your language for one year.
vizo-theme: remembers light or dark mode for one year (also kept in local storage).
Local and session storage keys starting with vizo-analytics-: a per-tab visit ID and markers that make sure an erase request is completed. Used only for analytics.

Cloudflare Turnstile runs on sign-in and sign-up pages to check that you are not a bot. Cloudflare processes data for that check under its own privacy policy.

We share data only with service providers that help us run VizoAPI, and only what each one needs:

Model providers: third parties that run the AI models. They receive your prompts, parameters and input files for your task, and return the results.
Payments: Stripe, for checkout, payments and refunds.
Hosting, storage and network: cloud and network providers that host the service, store files and protect it, including Cloudflare.
Email delivery: a provider that sends our emails.
Sign-in: Google, if you choose Google sign-in.

We may also share data if the law requires it, to protect people from harm, to protect our rights, or as part of a merger or sale of the business, in which case this policy continues to apply.

International transfers

We may process your data in the United States and in the countries where our model providers are located. Where the law requires, we use safeguards such as standard contractual clauses for these transfers.

How long we keep it

Result files: 7 days after they are created, then deleted. You can delete them sooner from the task page or through the API.
Uploaded input files: 24 hours after upload.
Task records (prompt, parameters, status, price): while your account is open, so you can see your history. They are erased when the account is closed, except what is needed for billing records.
Files under a content review: up to 30 days while the case is open.
Feedback and support reports sent from the console, including attached screenshots: 90 days, then deleted.
Team invitations: the invited email address is kept with the invitation record, including after the invitation is accepted, revoked or expired, and is erased when the inviting account is closed.
Saved card for auto top-up: until you remove the card or the account is closed. Then we delete the card details and ask Stripe to remove the card.
API key source IPs: 30 days after the address was last seen, then deleted. They are also deleted when the account is closed.
Billing records: for as long as tax, accounting and other laws require, also after the account is closed.
Analytics: see “Analytics” above.
Account data: until you close your account.

Backups may keep copies for a short time before they are overwritten.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict some uses, and to withdraw consent. What you can do today:

See and correct: your account, keys, tasks and bills are shown in the console. You can change your email and settings there.
Export: download your billing history as CSV from the console. For other data, write to us.
Delete files: delete any result file from the console or the API.
Withdraw analytics consent: use “Analytics settings” in the footer. This erases analytics data linked to that browser.
Close your account: the account owner can close it in the console settings. We revoke your keys, cancel tasks still waiting, delete your files, erase task inputs and webhook settings, and remove your sign-in details. Before the account closes, you can request a refund of refundable Credits; any Credits left are forfeited. Billing records are kept as the law requires.

For any other request, write to support@vizoapi.com. We may need to confirm your identity. You can also complain to your local data protection authority.

Security

We use encrypted connections, store passwords and keys only as hashes, and sign webhook messages. No system is perfectly secure; tell us at support@vizoapi.com if you find a problem.

Children

VizoAPI is for developers and businesses. It is not meant for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.

Changes

We may update this policy. We post the new version here with a new effective date, and tell account owners about important changes by email or in the console.

Contact

Oakrelay Labs LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA. Privacy questions: support@vizoapi.com.