Privacy Policy

Velyune is an AI photo editing service operated by Hiep Vu, an independent developer based in Vietnam. This Privacy Policy explains how Velyune (“we,” “us,” or “our”) collects, uses, shares, retains, and protects information when you use the Velyune website, the Velyune: AI Makeup Artist iOS app, and related support services.

1. Information we process

Website and support information

We do not use advertising pixels, marketing cookies, or behavioral analytics on this website. Our hosting provider may process ordinary request information needed to deliver and protect the site, including an IP address, request headers, requested URL, timestamp, and security signals.

If you contact support, we and the email providers involved process the email address, message, attachments, and related correspondence you choose to send. An attachment sent for support may be reviewed only to resolve your request.

App information

• Photos and results. We process the source photo you select and the generated result created for your requested edit.
• Accountless identifiers. The app creates an installation identifier and authentication credential for device-specific edit and notification records. To prevent repeated free-credit allocation without requiring an app login, the App Store provides a signed app-transaction identifier associated with the Apple Account that downloaded the app. Velyune verifies this signed data and stores a derived pseudonymous identifier for quota and subscription records. The app does not receive the Apple Account email, name, or password.
• Edit and usage records. We process the selected style and intensity, job status, timestamps, request identifiers, allowance use, retries, viewing state, and deletion state needed to provide the service.
• Notifications. If you enable notifications, we process an Apple Push Notification service device token, environment, and authorization state to deliver completion notifications.
• Subscriptions. We process product, purchase, subscription, entitlement, renewal, transfer, and allowance state supplied through Apple and RevenueCat. Velyune does not receive your full payment-card details.
• Operational information. We process limited request, reliability, error, rate-limit, and security information needed to prevent abuse, diagnose failures, and operate the service.

2. How and why we use information

We use information to create and deliver requested AI edits; save, synchronize, retry, display, and delete projects; authenticate an installation; enforce plan allowances; manage subscriptions and restore eligible purchases; deliver optional notifications; prevent abuse; maintain reliability and security; respond to support and privacy requests; comply with legal obligations; and establish or defend legal claims.

Where applicable law requires a legal basis, we rely on performance of our agreement with you, your consent for third-party AI photo processing, our legitimate interests in securing and reliably operating Velyune, and compliance with legal obligations. You may withdraw consent for future photo processing at any time by declining the processing disclosure and not submitting another photo. Withdrawal does not affect processing that was lawful before withdrawal.

3. Automated AI photo processing

When you choose to continue, your selected photo and requested style are sent through Cloudflare to OpenAI’s image model only to create the edit you requested. Photo processing is automated. Velyune does not manually review submitted photos during normal operation, and the app does not use facial data to identify or authenticate you.

We do not use your photos or generated results to train AI models, advertise or market to you, or build advertising profiles. The OpenAI model route used for generation is provided with zero data retention for inference. Storage that Velyune separately uses to deliver and recover your result follows the retention periods in Section 6.

4. Service providers and data recipients

We use carefully selected providers only as needed to operate Velyune:

• Cloudflare provides cloud hosting, storage, security, and delivery of AI requests.
• OpenAI provides the model used for the AI image processing you request.
• Apple provides app distribution, App Store transactions, and optional push notifications.
• RevenueCat manages subscription entitlements and purchase state.
• Email providers process correspondence that you or Velyune send for support or privacy requests.

Providers process information only to deliver their contracted services and must protect it consistently with applicable law and our commitments. We may also disclose information when required by law, when reasonably necessary to protect safety or legal rights, or as part of a business transfer subject to appropriate safeguards.

5. No sale or behavioral advertising

We do not sell your personal data, share it for cross-context behavioral advertising, or use it for third-party advertising or marketing. We do not use your photos, generated results, or other personal data to train AI models.

6. Retention and deletion

• A source photo for a successful job is deleted from server storage promptly after processing. If a deletion attempt fails, cleanup is retried.
• A source photo retained for a failed or abandoned job expires within 24 hours after the job reaches a terminal failure state so that retry can remain available during that period.
• A generated result remains available on the server for no more than 30 days after completion unless you delete the project sooner. Scheduled cleanup removes an expired result, and failed cleanup attempts are retried.
• Deleting a project requests deletion of its server photos and job record and removes the app’s local project copy.
• Local content remains on your device until you delete it, delete the app, or iOS otherwise removes the app’s data.
• Installation and associated operational records remain while needed to provide the accountless service and until deletion is requested, subject to fraud-prevention, dispute, and legal-retention requirements.
• Apple and RevenueCat may retain transaction and entitlement records under their own policies and legal obligations.
• Support and privacy correspondence remains only while needed to resolve the request, keep necessary business records, or comply with law.

7. Your choices and privacy rights

You choose which photo to submit and may decline AI processing. You can delete projects in the app, disable notifications in iOS Settings, and manage or cancel subscriptions through Apple.

Depending on where you live, you may request access, correction, deletion, restriction, objection, or portability of your personal data, withdraw consent for future processing, and complain to an applicable data-protection authority. You may submit a request from the app’s Privacy & Data screen or email us. We may verify a request using information reasonably available to us and may retain information when applicable law permits or requires it.

8. Security

We use reasonable technical and organizational measures designed to protect information, including protections for data in transit, access controls, and service monitoring. No storage or transmission method is completely secure, so we cannot guarantee absolute security.

9. International processing

Velyune is operated from Vietnam. Our providers may process information in other countries whose data-protection laws differ from those where you live. We use applicable contractual and legal safeguards for those transfers and processing activities.

10. Children’s privacy

You must be at least 13 years old to use Velyune. If you are below the age of majority or the age at which you may independently consent to data processing where you live, a parent or legal guardian must permit and supervise your use. If you believe a child submitted information without required permission, contact us so we can investigate and delete it where appropriate.

11. Changes to this policy

We may update this policy when the service, providers, or legal requirements change. We will post the revised policy here and update its effective date. We may also provide an in-app notice for material changes. We will obtain any consent required before using existing personal data for a materially new purpose.

12. Contact