Privacy Policy

1. Information we collect

Account data: email, display name, password hashes, and settings you choose. If you sign in with Google, we receive your email address, its verified status, and your name from Google and link that Google identity to your account.

Cookies: a session cookie that keeps you signed in and a security (CSRF) cookie. If you arrive from a campaign link or another website, we also set a first-party cookie for up to 30 days that records the campaign tags (UTM), the referring site and your landing page, so we can tell which channels lead to sign-ups. It is not shared with third parties. We do not use advertising or third-party tracking cookies.

Usage and product data: threads, nodes, prompts, uploads, generation metadata, credit ledger events, storage usage, and device/browser technical logs needed to run and secure the Service.

Payment data: handled by Stripe. We receive limited billing metadata (e.g. customer id, plan, invoice status), not full card numbers.

Communications: messages you send to support.

2. How we use information

To provide and improve the Service, process generations, bill credits, prevent abuse and fraud, comply with law, and communicate about the account or Service.

Prompts and media may be sent to third-party model providers (for example xAI or fal) to fulfill generation requests. Those providers process data under their own terms and policies.

Every file you upload is checked automatically against the Project Arachnid Shield database, operated by the Canadian Centre for Child Protection, before it is stored. This matches uploads against known child sexual abuse material and is not human review. If Shield cannot be reached, the upload is rejected rather than stored unchecked.

3. Sharing

We share data with service providers that help us operate (hosting, email, payments, model inference, logging and monitoring), under contractual or operational necessity.

Uploads are sent to the Canadian Centre for Child Protection’s Project Arachnid Shield service for automated matching against known child sexual abuse material. Where a match is found, we preserve the file and the related account records in a locked evidence store for one year and report it to the Royal Canadian Mounted Police, as required by law.

We may disclose information if required by law or to protect rights, safety, and security.

We do not sell your personal information.

4. Retention

We retain account and generation data while your account is active and as needed for backups, legal obligations, dispute resolution, and security. Free-tier storage may be subject to shorter retention windows disclosed in product UI.

Material matched as child sexual abuse material, and the related account records, are preserved for one year as required by law, even if you delete your account.

5. Security and international transfers

We use reasonable technical and organizational measures to protect data. No method of transmission or storage is fully secure.

Data may be processed in the United States, Canada, and other countries where we or our providers operate.

6. Your choices

You can update your settings or delete your account from Account settings. Deleting your account removes your threads, uploads, references, folders, credentials, and email addresses. An anonymised account record, the credit ledger, and a keyed hash of your email address are kept for bookkeeping and to prevent abuse. Accounts that have been locked, or that have a child sexual abuse material detection on record, cannot be deleted by self-service; their data is preserved as described in section 3.

For access requests or anything else, contact support@framevine.com. Some data may be retained as required by law or legitimate operational needs.

7. Children

The Service is not directed to children under 18. We do not knowingly collect personal information from children.

8. Changes

We may update this Policy by posting a new version with an updated date.