Privacy Policy
Effective: May 24, 2026 · Vektra, Inc.
Vektra, Inc. (“Vektra,” “we,” “us,” “our”) is a Delaware corporation that operates the Vektra fashion flat generation platform (the “Service”). Vektra is the data controller for the personal data described in this Privacy Policy.
Contact: hello@vektraflats.com · Vektra, Inc. · 54 Dukes Ln, Lincolnshire IL
This policy applies to all users of the Service, including users in the United States, the European Union (including Italy), and the United Kingdom.
We collect the following categories of personal data:
| Category | Examples | Source |
|---|---|---|
| Account Data | Email address, display name, account creation date | Provided by you at registration |
| Design Content | Reference images you upload, garment descriptions, AI-generated flat drawings, project names | Provided by you; generated by the Service |
| Billing Data | Full name, billing address, country, payment method details (tokenized by Stripe — we never store card numbers), subscription status, usage history and credit balance | Provided by you at checkout; generated by the Service |
| Usage & API Logs | AI model used, operation type (generate/adjust), token counts, estimated cost per action, timestamps | Automatically generated when you use the Service; used internally for billing and fraud prevention |
| Authentication Cookies | Session tokens set by Supabase (our database/auth provider) | Automatically set; strictly necessary for login — cannot be disabled without losing access |
We do not collect: IP addresses or device identifiers (beyond what is inherent in network requests), location data, advertising identifiers, or data from analytics SDKs. We have no third-party tracking, advertising pixels, or analytics services integrated into the Service.
We process your personal data for the purposes below. For users in the EU and UK, we identify the applicable lawful basis under the GDPR / UK GDPR for each purpose.
| Purpose | Data used | Lawful basis (EU/UK) |
|---|---|---|
| Create and manage your account | Account data | Contract performance |
| Authenticate you and maintain your session | Account data, authentication cookies | Contract performance |
| Provide the AI flat generation and adjustment service | Design content, account data | Contract performance |
| Process payments and maintain billing records | Billing data, usage logs | Contract performance; legal obligation (tax records) |
| Fraud prevention and security monitoring | Billing data, usage logs | Legitimate interests (protecting users and the platform) |
| Internal cost modeling and service improvement (aggregated) | Usage logs (de-identified) | Legitimate interests (operating and improving the Service) |
| Communicate service-related updates (e.g., billing changes, policy updates) | Account data (email) | Contract performance; legal obligation |
We do not use your data for advertising, sell your data to third parties, or profile you for marketing purposes.
We share personal data only with the following service providers (“sub-processors”) solely to provide the Service:
| Provider | Purpose | Data shared | Location |
|---|---|---|---|
| Supabase, Inc. | Database, user authentication, and file storage | All categories | United States |
| Stripe, Inc. | Payment processing, subscription management, metered billing | Billing data (name, address, tokenized payment method, usage events) | United States |
| OpenAI, LLC | AI analysis of uploaded garment images; generation of flat drawings | Uploaded reference images, garment descriptions | United States |
| Google LLC | Optional “Sign in with Google” authentication | Account data (email address, name, Google account identifier) | United States |
| Resend (Plus Five Five, Inc.) | Transactional email delivery (e.g., account and collaboration invites) | Recipient email address, sender display name | United States |
We do not share your data with any other third parties unless required to do so by law or valid legal process (e.g., court order, regulatory request), in which case we will notify you to the extent permitted by law.
Note on AI providers and training data: OpenAI’s API by default does not use customer inputs to train its models. We do not exercise control over its internal data practices beyond what is contractually agreed.
Vektra is based in the United States. If you access the Service from the European Economic Area (EEA), the United Kingdom, or any other jurisdiction outside the United States, your personal data will be transferred to and processed in the United States, which may not provide the same level of data protection as your home jurisdiction.
We rely on the following transfer mechanisms for lawful cross-border transfers:
You may request a copy of the relevant transfer safeguards by contacting us at hello@vektraflats.com.
| Data category | Retention period |
|---|---|
| Account and design data | Retained while your account is active. Deleted within 30 days of account deletion, except where retention is required by law. |
| Billing records | 7 years from the date of transaction, as required for tax compliance. Cannot be deleted on request during this period. |
| API usage logs | Retained for 24 months, then permanently deleted. Used internally for billing reconciliation and fraud prevention. |
| AI session context | Retained for the lifetime of the associated design project. Deleted when the project (piece) is deleted. |
| Authentication cookies | Session cookies expire at logout; persistent tokens expire per Supabase default session settings. |
If you are a resident of the European Economic Area or the United Kingdom, you have the following rights regarding your personal data:
If you are a California resident, you have the right to:
To exercise any of these rights, please contact us at hello@vektraflats.com with your request. We will respond within 30 days (EU/UK) or 45 days (CCPA). We may need to verify your identity before fulfilling a request.
We use only strictly necessary authentication cookies issued by our infrastructure provider (Supabase). These cookies are essential for you to log in and use the Service; disabling them will prevent access. They do not track you across other websites, and they are not used for advertising.
We do not use analytics cookies, advertising cookies, tracking pixels, fingerprinting technologies, or any third-party SDKs that collect behavioral data. No cookie consent banner is required for the current use of cookies; if we add any non-essential cookies in the future, we will update this policy and obtain your consent beforehand.
We implement reasonable technical and organizational measures to protect your personal data, including encryption at rest and in transit (TLS), row-level security policies restricting access to your own data, and separation of user-facing and service-role database access. Payment data is tokenized by Stripe and never stored on our servers.
No method of transmission over the internet or electronic storage is 100% secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and relevant supervisory authorities as required by applicable law.
The Service uses AI systems to generate visual content from your uploaded images and design descriptions. In accordance with the EU AI Act (Regulation 2024/1689) and applicable transparency obligations:
The Service is not directed to individuals under 16 years of age. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe we have inadvertently collected information from a child under 16, please contact us at hello@vektraflats.com and we will delete it promptly.
We may update this Privacy Policy from time to time. We will notify you of material changes by email and/or prominent notice within the Service at least 30 days before changes take effect. The “Effective” date at the top of this page indicates when this version was last revised.
Your continued use of the Service after the effective date of any revision constitutes your acceptance of the updated Privacy Policy.
For questions, complaints, or to exercise your rights under this Privacy Policy, please contact our data protection contact:
Vektra, Inc.
54 Dukes Ln, Lincolnshire IL
EU and UK residents who are not satisfied with our response may lodge a complaint with their local supervisory authority (see Section 7 above for contact details).
Also see our Terms of Service.