Privacy policy

Viceo Studio ("Viceo", "we", "us") is an AI creator studio for open-world game creators. It is operated by GVG Holding, based in Germany, which is the controller responsible for your personal data under the EU General Data Protection Regulation (GDPR).

For anything privacy-related, write to support@viceo.ai. We answer every request.

We only collect what we need to run the studio:

• Account data. Your email address and sign-in details, handled through Supabase Auth. We never see or store a password in plain text.
• Uploads and generated media. Images, video and audio you upload, the prompts and settings you use, and the outputs we generate for you. These are stored in Supabase Storage and linked to your account.
• Payment data. Payments are processed by Stripe. Card numbers go straight to Stripe — we never see or store them. We receive your plan, payment status, invoices and a Stripe customer ID.
• Usage and credit ledger. Which tools you used, when, how many credits were charged or refunded, and your Deck progress. This keeps your balance correct and lets us fix billing questions.
• Messages to us. If you contact support, we keep your name, email and message so we can reply.
• Technical data. Our hosting provider processes IP addresses and basic request logs to deliver the site and keep it secure.

We use a small number of service providers (processors) who handle data only on our instructions:

• Supabase — database, authentication and file storage.
• Vercel — website hosting and delivery.
• Stripe — subscriptions, top-ups and invoices.
• Higgsfield, Runware and ElevenLabs — AI providers that receive your uploads and prompts to generate images, video and voice outputs, and return the results to us.
• Email delivery — if we reply to you by email, an email provider transmits the message.

We do not sell your data and we do not share it with advertisers.

• Providing the service — your account, generating and storing your media, credits and plans. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
• Billing and accounting — payments, invoices and tax records. Legal basis: contract and legal obligations (Art. 6(1)(b) and (c)).
• Safety and abuse prevention — moderation of prompts and uploads, preventing fraud and enforcing our content rules. Legal basis: our legitimate interest in a safe, lawful service (Art. 6(1)(f)).
• Support — answering your messages. Legal basis: contract or legitimate interest.
• Improving the studio — aggregated usage statistics, for example which tools are used most. Legal basis: legitimate interest.
• Optional cookies — only with your consent (Art. 6(1)(a)), which you can withdraw at any time.

• Account data: for as long as your account exists.
• Uploads and outputs: until you delete them or your account. Deleted files are removed from storage.
• Credit ledger and payment records: as long as required by German commercial and tax law (generally up to 10 years for accounting records).
• Support messages: up to 2 years after the conversation ends, unless needed longer to resolve a dispute.
• Hosting logs: short-term only, as set by our hosting provider.

We keep cookies to a minimum:

• Essential cookies keep you signed in (Supabase Auth session) and remember settings. The studio does not work without them.
• Your cookie choice is stored in a cookie and in your browser's local storage so we don't ask again.

We do not use advertising trackers or cross-site tracking. To change your choice, clear the site data in your browser and you will be asked again.

Under the GDPR you have the right to:

• Access the personal data we hold about you.
• Correct data that is wrong.
• Delete your account and data ("right to be forgotten"), except records we must keep by law.
• Export your data in a portable format, and download your outputs at any time.
• Object to processing based on legitimate interest, or restrict processing.
• Withdraw consent at any time, without affecting earlier processing.
• Complain to a data protection supervisory authority, for example the one in your EU country of residence or the authority responsible for us in Germany.

To use any of these rights, email support@viceo.ai from the address on your account. We reply within one month.

Some of our providers are based in, or use infrastructure in, countries outside the EU/EEA, such as the United States. Where that happens, transfers are protected by an adequacy decision (for example the EU–US Data Privacy Framework) or by the European Commission's Standard Contractual Clauses, plus additional safeguards where needed.

Data is encrypted in transit, access to production systems is restricted, and payment data stays with Stripe. No system is perfectly secure, but we take reasonable technical and organisational measures and will inform you and the authorities of a breach where the law requires it.

Viceo Studio is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has an account, contact us and we will delete it.

We may update this policy when the studio or the law changes. The date at the top shows the latest version. For significant changes we will notify you by email or in the app before they take effect.

GVG Holding — Viceo Studio, Germany. Email: support@viceo.ai. You can also use our contact form.