Privacy policy

Data we process

We limit collection to what is needed for accounts, generations, safety and financial records.

• Account: email, protected password hash, language, role, age confirmation and versions of accepted documents.
• Content: prompts, settings, source images, results, technical job identifiers and review status.
• Technical: IP address, request time, session and device data, security events, and errors without prompt or media content.
• Requests: subject, messages, attachments, response history and removal-request information.
• Records: credit entries, promo codes, referral attribution, referred purchases, commission and payout requests.

Purposes and legal bases

The applicable basis depends on the feature and your jurisdiction.

• Contract: registration, authentication, generation processing, history, support and credit accounting.
• Legitimate interests: protecting the service and users, preventing abuse, diagnostics and audit while balancing your rights.
• Consent: separate optional features where required; consent may be withdrawn for future processing.
• Legal obligation and claims: responding to competent authorities, tax and accounting duties, and resolving disputes.

Cookies and local storage

Pikalt uses only its own technically necessary storage to select a language, maintain a secure authenticated session and prevent affiliate-programme abuse.

• veloura_locale remembers the selected interface language.
• veloura_session is a secure HttpOnly authentication cookie; sign-in and the member workspace cannot operate without it.
• pikalt_affiliate_device is an HttpOnly anti-fraud identifier created only when affiliate features are used.
• Pikalt does not use advertising cookies, third-party trackers or behavioural profiling.
• You may delete or block technical cookies in your browser, but the language may reset, your session will end and some features may stop working. Dismissing the notice is stored only in browser localStorage.

Recipients and disclosures

We send only the data needed by a particular recipient and use contractual and technical safeguards.

• AI providers receive the prompt, settings and, where needed, a source file to perform the selected generation.
• Hosting, S3-compatible storage, email, monitoring and backup providers process limited data on our behalf.
• Data may be disclosed where required by law, to protect rights or to prevent imminent harm.
• Pikalt does not sell personal information or share it for cross-context behavioural advertising.

Retention and deletion

Retention depends on purpose and is extended only for an investigation, dispute, safety need or legal requirement.

• Source files and generated media are deleted by default 10 days after creation, or sooner on request unless a valid hold applies.
• Technical security logs are retained for up to 12 months and must not contain passwords, tokens, prompts or media.
• Credit, affiliate, payment and administrator audit records remain as long as needed for ledger integrity and legal obligations.
• After deletion, an object may remain briefly in a protected backup without ordinary access until scheduled overwrite.

Security and international transfers

Controls include access restrictions, short-lived file links, encryption in transit, protected secret storage, administrator audit and log minimisation. No system can guarantee absolute security.

AI providers and infrastructure may be located outside your country. Where required, contractual transfer mechanisms and an assessment of recipient safeguards are used.

Your rights

Depending on where you live, you may submit a request through support. We may verify identity and authority before releasing data.

• Know about processing, receive a copy of data and correct inaccuracies.
• Request deletion or receive applicable data in a portable format.
• Restrict or object to processing, or withdraw consent without retroactive effect.
• Appeal a refusal, avoid discrimination for exercising rights and complain to a competent data-protection authority.

Age and policy changes

Pikalt is not intended for anyone under 18. If we learn that a minor's data is present, the account and data will be restricted and deleted through the applicable process.

An updated policy is published with a new effective date. Registered users receive in-product or email notice of material changes where required.