Legal · Updated November 12, 2026

Privacy Policy

This policy explains what we collect, why, and who helps us process it. We collect what we need to run the Service and take payment, and a little analytics to see what people use.

01What we collect

Account: your email address, your plan, your Create credit balance, and your API key for the MCP server.
What you make in Create: your briefs, the reference images you upload, the components and templates you @-mention, the sites Create builds for you, and the build logs.
Usage: which templates, prompts and components you open or copy, used to run the Service, enforce plan limits and improve the library.
Payments: handled by Stripe. We receive a confirmation of your purchase and a Stripe customer reference. We never see or store your card.
Technical: standard server and request logs (IP address, browser, pages requested).

02How we use it

To sign you in, run Create and your builds, meter credits and plan limits, take and confirm payments, prevent abuse, and send sign-in links, receipts and account email.

Now and then we email account holders about new templates or an offer on a plan. Each of those emails has a one-click unsubscribe, and unsubscribing never stops sign-in links or receipts.

We do not sell your personal data, and we do not use your briefs, uploads or builds to train AI models.

03Processors we use

These providers process data for us, only to provide their part of the Service. Most are based in the United States, so your data may be processed there.

Processor	What for	What it sees
Anthropic	The AI models that plan, write and check Create builds	Your brief, reference images, the components you mention, and the code of your build
fal	Image generation for Create and the builder	Image prompts written from your brief, and reference images
Supabase	Sign-in, database and file storage	Your email, plan, credits, saved builds and uploads
Stripe	Payments, subscriptions and invoices	Your email, billing details and card (we never see the card)
Vercel	Hosting the website and its API	Request logs: IP address, browser, pages visited
Resend	Sign-in links, receipts and account email	Your email address and the message
Railway or Fly.io	Hosting the Create build worker	Your brief, reference images and your build while it runs
PostHog	Optional product analytics and masked public-page session replay, when enabled with your permission	Pseudonymous usage events; masked public-page interactions. Not your prompts, generated sites or payment details
Google	Analytics (GA4); Gemini images for the /build builder	Pseudonymous usage events and cookies; builder image prompts

04Cookies and local storage

We keep it to a short list:

Sign-in: a session token that keeps you signed in.
Preferences: your theme, and a draft of your Create brief so it survives signing in or checkout.
Analytics: Google Analytics 4 cookies, and a first-party visitor id (uip_aid), to count visits and see which pages lead to sign-ups and purchases.
Campaign: if you first arrive from a link with campaign tags (utm_…), we keep those tags in a cookie (vs_ft) for 180 days and attach them to your checkout, so we know which campaign brought you. It holds no personal details.

05Optional PostHog analytics

Where enabled, we ask permission before loading PostHog. You can decline, or withdraw using Usage privacy on public browsing pages. This control applies to PostHog, not our existing essential service logs or other analytics described above.

We use anonymous browser-session identifiers to understand visits to public pages, template previews, pricing interest and checkout steps. A purchase event is sent only after our server confirms payment. PostHog does not receive your account email, prompts, generated content, Stripe identifiers or payment details from this integration.

When session replay is enabled, it reconstructs interactions on selected public browsing pages. Text and inputs are masked, and forms, media, embedded previews and private product pages are excluded. We do not record network bodies or console logs. Browser Do Not Track and Global Privacy Control disable this optional integration.

06Retention and deletion

We keep your account data and your Create builds while your account is open, so you can come back to them. Payment records are kept as long as the law requires. Email support@vividsites.app to ask for a copy of your data, or to delete your account and everything in it.

07Your rights

Depending on where you live, you may have the right to access, correct, export or delete your data, or to object to how we use it. Contact us and we’ll help.

08Children

The Service isn’t intended for anyone under 16.

09Changes

We’ll update this policy as the Service changes; the “updated” date shows the latest version, and we will email account holders about material changes.

10Contact

Privacy questions: support@vividsites.app.

Questions: support@vividsites.app