--- title: "Privacy Policy | Vectorize" description: "How Vectorize processes personal data and uploaded images." canonical: "https://vectorize-logo.com/privacy/" last_updated: "2026-10-14" markdown_url: "https://vectorize-logo.com/privacy.md" --- # Privacy Policy HTML version: https://vectorize-logo.com/privacy/ · Markdown: https://vectorize-logo.com/privacy.md · Site index for agents: https://vectorize-logo.com/llms.txt > How Vectorize processes personal data and uploaded images. Last updated: September 14, 2026 ## 1\. Who controls your data The data controller for Vectorize is Stefano Monteduro, also known as Stemonte, Via P. De Lorentis 96, 73020 Scorrano (LE), Italy, VAT number IT04404290753. For privacy questions or to exercise your rights, email [me@stefanomonteduro.it](mailto:me@stefanomonteduro.it) or contact the controller through [@stemonte on X](https://x.com/stemonteduro). ## 2\. Data we process - **Files and content you submit:** uploaded PNG, JPEG or WebP images, the generated assets, processing settings and any brand name entered for a brand kit. - **Usage and analytics data:** pages and events, referral source, campaign parameters, browser and device information, country, and a short-lived pseudonymous identifier derived by DataFast from technical signals including IP address, user agent, this domain and a salt that rotates approximately every 24 hours. - **Technical data:** IP address, date and time, requested resource and other information normally contained in server and security logs. - **Operational events:** MCP tool name, success or error status, processing duration, general source type, download and editor events, an error identifier and a one-way hash of temporary revision identifiers. These records do not contain prompts, original filenames, source URLs, image contents or raw revision identifiers. - **Sponsor purchases:** business and billing details collected through Stripe, payment and Checkout identifiers, and the logo, brand name, description, destination URL and colors submitted for a sponsor card, including an unpaid temporary draft created before Checkout. Vectorize does not receive complete card details. Vectorize does not require an account and does not intentionally collect complete payment-card data or special categories of personal data. Please do not upload confidential material or images containing unnecessary personal data. ## 3\. Why we process data and our legal bases - To vectorize your image and create the files you request: performance of a service requested by you (Article 6(1)(b) GDPR). - To operate, secure and troubleshoot the service: our legitimate interest in providing a reliable and safe website (Article 6(1)(f) GDPR). - During the beta, to retain an upload only when vectorization fails so that the specific failure can be reproduced and diagnosed: our legitimate interest in maintaining and improving the reliability of the service (Article 6(1)(f) GDPR). - To understand aggregate usage and improve the product through privacy-oriented analytics: our legitimate interest in measuring and improving the service (Article 6(1)(f) GDPR). - To comply with binding legal obligations where applicable (Article 6(1)(c) GDPR). - To sell, publish and administer a sponsor placement: performance of the business purchase contract and compliance with accounting and tax obligations (Articles 6(1)(b) and 6(1)(c) GDPR). ## 4\. Analytics and cookies Vectorize uses DataFast in cookieless mode. The analytics script starts when a page is loaded and records page views and limited product events, such as a completed vectorization, download, opening of the sponsor purchase dialog or outbound sponsor click. Sponsor click properties may include the public sponsor identifier, public brand name, card position and destination host. Analytics events never include the uploaded image, complete destination URL, payment details or sponsor contact details. This mode does not use cookies for visitor identification. It may use storage limited to the current browser session and creates a server-side pseudonymous identifier that rotates approximately every 24 hours. See the [Cookie Policy](https://vectorize-logo.com/cookie-policy/) for details. ## 5\. Recipients and international transfers Data is available only to the controller and service providers that need it to host, secure, process payments or measure the service. Stripe processes Checkout, payment and billing information. DataFast (JustShipIt Pte. Ltd.) acts as an analytics processor. Its infrastructure and subprocessors may process data outside the European Economic Area, including in the United States. DataFast states that applicable safeguards include Standard Contractual Clauses where relevant. Data may also be disclosed when required by law or a competent authority. ## 6\. Retention - Uploaded images and generated job files are temporary, expire after a maximum of two hours, and are removed by the service cleanup process. - During the beta, an uploaded image is retained for diagnostics only if its vectorization fails. It is stored with the processing settings and an error identifier, without the original filename, for a maximum of 14 days before automatic deletion. It is used solely to reproduce and diagnose that failure and is not used for advertising, profiling or training a general-purpose AI model. - Browser-only previews created from your local file last only for the current page session. - Technical logs are kept only for the period reasonably necessary for operation, security and incident investigation. - Operational MCP, editor, export and error events are retained for a maximum of 30 days and are available only through an authenticated administrative dashboard. - Analytics data is retained according to the active DataFast plan and is deleted or anonymised when no longer needed for the purposes above; deletion can also be requested from the controller. - Sponsor materials and public card details are retained while featured and in the Previously featured section. Payment and billing records are retained for the periods required by accounting, tax, fraud prevention and legal obligations. - An unpaid sponsor draft is deleted when its Checkout is cancelled or expires. A short delay may occur if the service is temporarily unavailable when the expiry is due. ## 7\. Your rights Where the GDPR applies, you may request access, correction, deletion, restriction or portability of your personal data and object to processing based on legitimate interests. You may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or the supervisory authority in your country. These rights may be limited where the data cannot reasonably be linked back to you, as can happen with short-lived pseudonymous analytics. ## 8\. Security, automated decisions and changes Vectorize uses proportionate technical and organisational safeguards, including encrypted transport over HTTPS in production and short-lived, isolated processing jobs. The service does not make decisions producing legal or similarly significant effects about you. This notice may be updated when the service or its providers change; the revision date above identifies the current version. DataFast documentation: [GDPR and cookieless tracking](https://datafa.st/docs/gdpr-cookieless-tracking) and [Data Processing Agreement](https://datafa.st/dpa). - [Terms of Service](https://vectorize-logo.com/terms/) - [Privacy Policy](https://vectorize-logo.com/privacy/) - [Cookie Policy](https://vectorize-logo.com/cookie-policy/) - [Customer Support](https://vectorize-logo.com/support/) - [Sponsor Terms](https://vectorize-logo.com/sponsor-terms/)