Privacy Policy

Last updated: 15 July 2026

This Privacy Policy explains how Vellux collects, uses, discloses and protects personal data when you use the Vellux service at vellux.ai (the "Service"). It applies alongside our Terms of Service, Content Policy, Refund Policy, Complaints, Reports & Takedowns and Imprint. Defined terms (Service, User, Content, Outputs, Gallery, Character/LoRA, Credits, Generator) have the meanings given in the Terms of Service.

The Service is strictly for adults (18+). It is not directed to, and we do not knowingly collect personal data from, anyone under 18.

1. Controller and contacts

Vellux is operated by Dennis Müller, c/o Anibarro, Unit #152, Route de Saint-Cergue 24Bis, 1260 Nyon, Switzerland ("Vellux", "we", "us", "the operator"). The operator is the controller responsible for the processing of personal data described here.

You can reach us on data-protection matters at:

• Data protection: [email protected]
• General support: [email protected]
• Legal notices & complaints: [email protected]

We have not appointed a Data Protection Officer, as we are not legally required to do so. If that changes, we will name the DPO here.

2. Scope and legal frameworks

Because Vellux offers a paid service to, and processes the data of, users in Switzerland and the European Economic Area, two data-protection laws apply to us in parallel:

• the Swiss Federal Act on Data Protection (revised FADP / nDSG); and
• the EU General Data Protection Regulation (GDPR).

Where these frameworks use different terms for the same idea, this Policy is written to satisfy both.

The Service is offered in the United Kingdom only to Fanvue creators (all other UK access is blocked — see the Terms of Service). To the extent the UK GDPR applies to our processing of those users' data, we honour the rights described in this Policy under that law as well; otherwise the United Kingdom appears in this Policy mainly as a location, because our application server — and the Fanvue sign-in provider — are located there (see the processor list and the international-transfers section below). Where the data-protection law of another jurisdiction also applies to you personally, we honour the rights described in this Policy to the extent that law requires.

3. Data we collect

We collect only the data needed to run the Service. There are no third-party analytics, advertising or tracking systems (see Section 9).

(a) Account data. Your display name, email address, a securely hashed password (hashed with scrypt; we never store or see your plaintext password), your email-verification status, your profile image (if you set one), the record of your acceptance of these policies (the time and version you agreed to), and your account/moderation status (active or suspended). If you sign in with Fanvue ("Sign in with Fanvue"), we also store the link between your Vellux account and your Fanvue account, the profile details Fanvue provides at sign-in — your Fanvue account identifier, email address, handle, display name, avatar, and whether your Fanvue account is a creator account (creator status determines availability in certain jurisdictions — see the Terms of Service) — and the OAuth tokens needed to operate the sign-in.

(b) Session and technical data. A first-party session cookie (see Section 9) and, per active session, the IP address and browser user-agent from which you signed in, plus session creation and expiry timestamps. The application maintains no separate access log, request log or device-fingerprint store beyond this session record. Our infrastructure providers — Cloudflare (our reverse proxy) and the Caddy/OVHcloud web server — do generate standard server and CDN request/access logs (for example IP addresses and requested URLs); these are kept only briefly and are used for security, abuse-prevention and to keep the Service running.

(c) Product data. For every generation you run: the job record (your prompt text and generation settings/parameters, the chosen Generator, status and timestamps, and whether the job came from you, the AI agent or an automation). For every image or video produced or uploaded: the media record — the private storage keys of the file and its thumbnail, a copy of the prompt, the generation parameters, the resolved workflow graph that produced it, and a numeric CLIP embedding vector used for your Gallery's semantic search. We also hold your Credits balance and a complete Credits ledger (each debit/credit, its reason and any linked job).

(d) Agent and automation data. If you use the AI agent or automations: your chat transcripts (message text and the structured "parts" that record tool calls, tool results and image cards), any durable "memory" facts the agent has stored about your preferences, daily usage counters (used to enforce abuse limits), and the message history and per-run state of your automations and the agent's background runs.

(e) Characters, LoRA training and datasets. If you create a Character or train a likeness model: the reference images and training photos you upload, any LoRA file you upload, the character's description/prompt, the trigger word, a snapshot of the owner display name (baked into the produced file names), the training hyperparameters, and a versioned consent attestation (the time and policy version at which you attested whether the dataset depicts a synthetic persona, yourself, or a consented third party). Where you explicitly opt in to dataset retention, we also keep the training dataset (under a dedicated storage prefix) so the Character can be reused later.

Is providing this data required? Providing your account data — in particular a valid email address — is a contractual requirement: it is necessary to create and operate an account, and without it we cannot provide the Service. Providing face/biometric data, reference images and training photos is entirely optional: you supply it only if you choose to create a Character or train a likeness model, and declining has no consequence other than that you cannot use that particular feature.

4. Sensitive data — face and biometric data

The character features are designed for synthetic personas: training images are expected to be AI-generated pictures of an invented person. Images of a person who does not exist are not personal data, because there is no identifiable natural person behind them.

If, however, a training image depicts a real, identifiable person — which the Content Policy permits only for your own likeness or for a person whose documented written consent you hold — that image allows a specific person to be uniquely identified, and we treat it as biometric data: sensitive personal data under FADP Art 5(c) and special-category data under GDPR Art 9.

We process real-person face data only on the basis of explicit consent (GDPR Art 9(2)(a)). For your own face, we capture that consent through the distinct, non-bundled attestation at the point you start a training run or character build, in which you state whether the dataset depicts a wholly synthetic persona, yourself, or a consented third party — not through your general acceptance of the Terms, and not merely by uploading an image. For a third party's face, the required explicit consent is that of the depicted person: you must obtain and document it before uploading, the attestation records your confirmation that you hold it, and we may demand the underlying proof at any time (see the Content Policy). The attestation and the policy version in force are logged in every case.

Two hard limits apply, and by attesting you confirm them:

• you may consent only for your own face; and
• to upload or train on another identifiable person's face, you must hold that person's documented, express written consent. Uploading a third party's, a celebrity's or any other public figure's face without verifiable consent is prohibited (see the Content Policy).

You may withdraw consent for real-person face data at any time (Section 11); withdrawal stops future processing and, on request, leads to deletion of the associated images, dataset and model.

5. Purposes and legal bases

We rely on the following legal bases (GDPR Art 6, and the equivalent justifications under the FADP):

Where we rely on legitimate interests, we have weighed those interests against your rights and use the minimum data needed; you may object as described in Section 11.

6. Data we receive about other people (Art 14)

When you upload a reference image or training photo that depicts another person, we receive that person's image (and, for face training, their biometric data) from you, the uploading User — not from them directly. The categories are facial/photographic imagery and, where used for training, biometric data.

You are responsible for having the legal right and documented consent to provide that data. Any person who believes their likeness has been used without consent can request removal and exercise their rights via [email protected] or through our Complaints, Reports & Takedowns process.

7. Recipients and processors

Your Content and Outputs are stored in a private bucket and are never made public. To run the Service we share data with the following processors and providers only, each for the stated purpose:

The image-captioning vision model is configured independently of the chat model. Today it runs on DeepInfra, the same provider that hosts the chat model; we will update this list if we move it to a different host.

Generation may also run on hardware the operator controls directly. In addition to the serverless GPU providers above, a job may be routed to a self-hosted GPU operated by us and reached over a secure, operator-initiated tunnel. This is first-party processing on our own equipment, not disclosure to a third party; the payload processed there is the same job data (your prompt, settings and any reference/mask media).

Local, no third party: the CLIP model used for Gallery search runs on the operator's own servers — your images are embedded locally and no third party is involved in that step.

We do not use third-party analytics, advertising, tracking or data-broker services, and we do not sell personal data. We may disclose data to authorities or advisers where legally required (Section 5).

8. International data transfers

Because several processors are in the United States (one, WaveSpeed AI, in Singapore) and our hosting is in the United Kingdom, using the Service involves transfers of personal data outside Switzerland and the EEA.

We rely on the safeguards required by FADP Art 16(2) and GDPR Chapter V:

• for the United Kingdom, the relevant adequacy recognition;
• for the United States, we rely on a recipient's Data Privacy Framework certification where it holds one (EU–US DPF and the Swiss–US DPF), and otherwise on the Standard Contractual Clauses incorporated into the recipient's data-processing terms (with supplementary measures where needed);
• for other third countries without an adequacy decision (currently Singapore), we rely on the Standard Contractual Clauses incorporated into the recipient's data-processing terms (with supplementary measures where needed); and
• transfers to model APIs occur only when you actively choose a Generator that runs on that provider.

You can request a copy of the relevant transfer safeguards by emailing [email protected].

9. Cookies and similar technologies

Vellux sets two strictly-necessary, first-party cookies:

• the authentication session cookie (__Secure-better-auth.session_token on HTTPS; better-auth.session_token on plain-HTTP local development) — httpOnly, SameSite=Lax, scoped to our site, lasting about 7 days. Its sole purpose is to keep you signed in and to secure your session; and
• the age-acknowledgement cookie (vx_age_ok) — set when you confirm on the entry gate that you are 18 or older, so you are not asked again on every visit. It lasts up to one year and contains no personal data.

Our reverse proxy, Cloudflare, may additionally set its own strictly-necessary operational cookies (for example for security and bot mitigation) as part of delivering the site.

We do not set any analytics, advertising, profiling or third-party tracking cookies. Because every cookie used is strictly necessary, no cookie-consent banner is required under the ePrivacy rules. Your light/dark theme preference is stored in your browser's localStorage, not in a cookie, and never reaches our servers.

If we ever introduce a non-essential cookie or similar tracking technology, we will first obtain your consent through a compliant consent banner and update this Policy.

10. Retention

We keep personal data only as long as needed for the purposes above:

• Account and product data — for the life of your account.
• On account deletion — you can delete your account yourself at any time in Settings → Delete account; we verify the request via a confirmation link sent to your email address, then delete your account data and remove the associated media from storage without undue delay (and in any case within 30 days), except data we must retain (see below). You can also request deletion by email (see Section 11). Note that suspension for abuse or illegal content is not deletion: a suspended account is blocked from access and its media access revoked, but the underlying data is preserved (see the Terms of Service) — self-service deletion is not available while an account is suspended; contact [email protected] instead.
• Chats, agent memory and automation history — deleted with your account, like the rest of your account and product data.
• Session records and IP/user-agent data — retained only while the session is valid and for a short period afterward for security. Infrastructure server/CDN logs (Section 3(b)) are kept only briefly.
• Credits ledger and financial records — records that applicable accounting and tax law requires us to keep are retained for those legally required periods even after account closure; ledger entries not subject to such an obligation are deleted with your account.
• Training datasets — kept only where you opted in, and only for as long as the associated Character exists; they are purged when the Character is deleted.
• Illegal-content evidence — where we remove content that is or is reported as illegal (for example suspected CSAM), we preserve the minimum evidence for as long as legally required and to cooperate with authorities.

11. Your rights

Subject to the applicable framework, you have the right to: access your data; obtain rectification of inaccurate data; request erasure; request restriction of processing; data portability; object to processing based on legitimate interests; and withdraw consent at any time (including biometric consent), without affecting processing carried out before withdrawal.

How to exercise these rights. The fastest way to delete your account is self-service: Settings → Delete account (we verify the request via an emailed confirmation link, then delete your account, its associated data and the associated media from storage, subject to the legal-retention exceptions in Section 10). For any other request — or if you can no longer sign in — email [email protected] and we will handle it as a verified request without undue delay. You can change your name and password, and view your usage, in your account settings at any time.

You also have the right to lodge a complaint with a supervisory authority:

• Switzerland: the Federal Data Protection and Information Commissioner (FDPIC); and
• EEA: your national Data Protection Authority.

We ask that you contact us first so we can try to resolve the matter directly.

12. Security

We protect your data with encryption in transit (HTTPS/TLS), a private object-storage bucket accessed only through short-lived presigned URLs (read links expire in about 1 hour, upload links in about 10 minutes), securely hashed passwords, session-based authentication, and access controls that limit each user's data to that user. No online service can be guaranteed perfectly secure, but we work to protect your data against unauthorised access, loss or misuse.

13. Automated decision-making

We do not carry out automated decision-making that produces legal or similarly significant effects on you within the meaning of GDPR Art 22. Operational automated processes — such as deducting Credits per generation, auto-refunding a failed generation, training run or character build, and rate-limiting to prevent abuse — are routine service mechanics and do not determine your legal rights.

14. Children

The Service is for adults only (18+). It is not directed to children, and we do not knowingly collect personal data from anyone under 18. If you believe a minor has provided data to us, contact [email protected] and we will delete it.

15. Changes to this Policy and contact

We may update this Policy from time to time. Material changes will be notified by email or in-app; the "Last updated" date above always reflects the current version. Continued use of the Service after an update means you have read the revised Policy.

Questions or requests: [email protected] (data protection) · [email protected] (general) · [email protected] (legal notices & complaints).

See also: Terms of Service · Content Policy · Refund Policy · Complaints, Reports & Takedowns · Imprint.