Privacy policy

Boetiek House S.L. (CIF B75865022, Calle Fernando Fuentes 2, 38300 Santa Cruz de Tenerife, Spain), trading as VergeLabs, runs vergelabsmedia.com and the AI service for VergeLabs Media Library. For your account, your licences and your payments, we are the controller of your personal data. For the pictures your site sends to be described, you are the controller and we process them for you under the Data Processing Agreement.

Questions about your data: support@vergelabsmedia.com.

What we keep, and why

What	Why	Kept for
Your email address and a hashed password	Your account	While the account exists; removed within 30 days after you delete it
Licence keys (stored hashed) and the site addresses they are connected to	Your licences, and counting your sites	While the account exists
Name, email, billing address and country	Payments and invoices (the card details stay with Stripe)	Invoices and accounting records six years, as Spanish law requires
One row per credit spent or added: licence, amount, reason, time	Your balance, and the rate limits	While the licence exists, plus the invoicing period
Your sign-in sessions: IP address, browser, last seen	Keeping you signed in, and letting you see your own sessions	Until you sign out; at most 30 days, 14 if unused
What you send us for support: your message, your email address, the last four characters of your licence key, and the system report you approve before sending	Answering you	Two years after the last message in the ticket, then deleted. An answer we wrote may be kept after that to answer the same question next time, without your words, name or address

The legal bases are the contract with you (account, licences, service, support), a legal obligation (invoices and accounting records), and our legitimate interest in keeping the service secure and preventing abuse (sessions, rate limits, request logs). Website analytics run only on your consent.

Your pictures

We do not keep them. When your site asks for a description, a downsized copy of the picture (or the original, if it is already small), with its file name and the text around it, passes through the service to the model provider and is gone when the request ends. It is never written to disk, to a database or to a log. The description is returned to your site and stored in your own WordPress database; we keep no copy. The model provider is reached with zero-retention routing on every request.

What your site sends, when, and what you can switch off is listed in the plugin's readme, under External services.

Only if you switch it on

Library counts. Off by default. If you switch it on in the plugin, your site sends us once a day how many files and folders it has, how deep the folders go, how many files of each broad type, files added in the last thirty days, and the plugin, WordPress and PHP versions with the site language, alongside your licence key and site address. Never a file name, a title, a folder name or a picture. You can switch it off again at any time.

On our website

• We work out your country from the header our hosting network adds to each request, to show prices in your currency and with the VAT you would pay. There is no IP lookup service. At checkout, Stripe uses your IP address to work out the VAT.
• Our hosting provider keeps request logs, including IP addresses, for the period its platform sets.
• The cookie that keeps you signed in to your account is the only one we need. On the checkout and billing pages, Stripe sets its own cookies to prevent fraud. There are no advertising cookies.
• If you allow it, we use Google Analytics (Google Ireland Ltd.) to count visits and see which pages people read. It then sets its own cookies (names starting with _ga, kept up to two years) and receives your IP address, browser and the pages you open, and may process them in the United States under the EU-US Data Privacy Framework. Until you press Allow, the analytics code is not loaded at all. We do not use it for advertising. You can change your choice at any time under Cookie settings; declining removes the cookies. Your choice itself is kept in your own browser.
• The cart remembers the email address you typed, in your own browser, so the checkout and your account can fill it in.

Who else handles your data

The companies that help us run the service, what each one reaches and where it is, are listed on the Sub-processors page. Some are in the United States; those transfers rely on the European Commission's Standard Contractual Clauses.

How long we keep things

In detail, per category, on What is kept, and for how long.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable form. Write to support@vergelabsmedia.com. Invoices and accounting records are the exception to deletion: Spanish law requires us to keep them.

If you think we have handled your data wrongly, you can complain to the Spanish data protection authority (Agencia Española de Protección de Datos, aepd.es) or to the authority in your own country.

Changes

If we change this policy in a way that affects you, we will say so on this page and, where it matters, by email.