Legal

Privacy Policy

This policy explains the information used for accounts, creation, billing and cookieless product analytics, who processes it, and how to contact us about it.

Last updated October 17, 2026 · Effective October 17, 2026

We process the information needed to run your account and create the work you request. PostHog counts page visits and selected actions by default without a persistent analytics visitor ID. You can turn it off below; browser DNT and GPC signals also block it.

Main categories of information handled by the site.
Data	Why we handle it	How long it stays
Anonymous session cookie (vv_anon)	Ties a generation to the browser that started it, so only that browser can follow it. Not an account.	12 months, or until you clear cookies
Language cookie (vgent-locale)	Remembers the language you picked in the switcher.	12 months
Prompt and generation settings	Used by the relevant model provider and, for signed-in projects, in your creation history.	For as long as needed by the task or account project; anonymous request fingerprints expire after 24 hours.
Request logs	Request id, anonymous session id, event, model, task status, error code, estimated cost and prompt length — never the prompt text.	Our hosting platform’s log retention; no separate archive
Hashed IP counters	Free rate limits and the shared daily budget, counted against a hash instead of the address.	10 minutes to 48 hours
Trial anti-abuse signals	When you claim the new-account trial credits (or bind a card for its bonus): your network address, a random device id this browser keeps (vv.device in local storage and the vv_device cookie), a fingerprint hash of stable browser traits (screen, time zone, language, graphics card, a canvas drawing) and Stripe's card fingerprint. We store only keyed hashes of them, used solely to stop the same device, network or card claiming twice.	Network, device and fingerprint hashes: 30 days. Card hashes: kept while the bonus exists, so a card earns it once.
Content safety region signals	The vv_timezone first-party cookie reports your browser timezone for content safety rules. Our server checks IP ranges locally; it does not send your address to a geolocation service. For signed-in generation requests we retain only two coarse flags: whether the IP and timezone match mainland China, plus any administrator exemption. These signals are never sent to analytics. For Wan 3 requests in strict mode, prompts and reference media are sent to Google Gemini for our content review before generation. Review copies in Google Files are deleted after the check (or expire automatically if deletion fails); this review is paid by us.	Timezone cookie: 1 day, refreshed on a visit. Coarse account flags: until replaced by known signals or the account is deleted.
Sign-up source	If you arrive from another website or through a link with campaign tags, we keep the tags (utm_source, utm_medium, utm_campaign) and the other site's host name — never its page address — in the vv_src cookie. When you create an account they are saved with it, along with the invite link you used and the dates of your first generation and first result. We use them only to count, in our admin console, how many sign-ups and payments each channel brings. Nothing is recorded when your browser sends DNT or GPC, and none of it is shared with advertisers.	Cookie: 30 days. With your account: until the account is deleted.
Task records	Task id, model, resolution and a request fingerprint, so a retry is never charged twice.	Anonymous task records: 24 hours. Account-owned work follows its project or asset lifecycle.
Browser storage	Local drafts, queues and preferences stay in this browser; account projects and assets are also stored on our servers.	Local items until you clear browser data; account-owned projects and assets follow their server-side lifecycle.
Attached media	Files you choose to upload are checked and stored for your library or Agent projects, then sent to model providers when needed for your request.	Unbound uploads expire after 48 hours; library files remain until deleted.
Account and billing data	Your Google account profile and subscription or payment status are used to provide sign-in and paid features. Payment details are handled by Stripe.	According to the account, billing and legal retention requirements that apply.
Cookieless product analytics	By default, PostHog receives page paths, selected actions and fixed choices. Network requests expose your IP address and browser User-Agent. Its cookieless processing hashes those values with a salt that changes daily to estimate same-day unique visitors, then removes the IP before event processing. No persistent analytics visitor ID is stored. We exclude prompts, form contents, email addresses and URL queries from event properties. Our server also sends PostHog anonymous counts of a few outcomes — sign-ups, first generations and results, finished films, trial credits claimed and completed payments — with fixed values only (the kind of work, the sign-up channel, the product bought) and no account id, email, prompt, IP address or location. They cannot be tied to you, so the analytics switch below does not stop them.	According to our PostHog project retention setting; contact privacy@vgent.com for the current period or a deletion request.

1.Who we are

Vgent.ai is an AI video generation site operated by Vgent Labs Pte. Ltd.. This policy covers the website as it works today, including accounts, uploads, billing, creation tools and cookieless product analytics.

Anything on this page can be questioned, and the mailbox below is the right place to do it.

Operator: Vgent Labs Pte. Ltd.
Registered address: 68 Circular Road, #02-01, Singapore 049422. These registration details are provisional and are updated here once the entity’s filing is complete.
Privacy contact: privacy@vgent.com

2.What this policy covers

It covers the vgent.ai website, the prompt composer on the home page, the workbench and the same-origin endpoints this site calls to submit and follow a generation. The public API is not open yet, so there is no developer key or webhook to describe here.

It does not cover what happens once a result leaves us: the model provider’s own notices, the platforms you publish to, or any external site you reach from a link.

Covered: this website, the composer, the workbench and the generation endpoints they call.
Not covered: the model providers' own products, the social platforms you upload results to, and external sites we link to.
Public API keys are not issued through the website yet.

3.What we collect

We handle account information and the material you submit to provide the features you use. Cookieless usage analytics runs by default unless you turn it off below or your browser sends a Do Not Track (DNT) or Global Privacy Control (GPC) signal.

An anonymous session id. A random identifier in the vv_anon cookie, created the first time you submit a generation. It is http-only, unreadable by scripts, and tells us only that two requests came from the same browser.
A language preference. The vgent-locale cookie, written only when you pick a language yourself. It holds a two-letter code.
Sign-up source. The campaign tags (utm_source, utm_medium, utm_campaign) or the referring site's host of the visit that led to your account, kept in the vv_src cookie until you sign up and then saved with the account.
Your prompts, settings and source references are passed to the relevant model provider. Signed-in projects can retain conversation and creation history; anonymous request fingerprints expire after 24 hours.
Request logs. Every request carries a correlation id; the log line records that id, the anonymous session id from the cookie, the event, model, task status, error code, estimated credit cost and the length of the prompt — never its content, and never media or keys.
Abuse counters. Your IP address is hashed with SHA-256 into a counter key so the free limits hold across servers. Our own code never writes the address itself down, although access logs kept by our hosting platform may record it, as they do for any website.
Trial anti-abuse signals. Claiming the new-account trial sends a random device id this browser keeps and a fingerprint hash of stable browser traits; with your network address (and, for the card bonus, Stripe's card fingerprint) they are stored only as keyed hashes and used only to stop repeat claims.
By default, PostHog receives page paths, selected interaction names and fixed choice values. The network connection exposes your IP address and browser User-Agent. PostHog hashes them with a salt that changes daily to estimate unique visitors for that day and removes the IP before event processing; it does not store a persistent analytics visitor ID in your browser.
When you sign in, we process your account profile and store account-owned projects, assets, credits and plan status to provide those features.
The vv_timezone first-party cookie reports your browser timezone for content safety rules. Our server checks IP ranges locally; it does not send your address to a geolocation service. For signed-in generation requests we retain only two coarse flags: whether the IP and timezone match mainland China, plus any administrator exemption. These signals are never sent to analytics. For Wan 3 requests in strict mode, prompts and reference media are sent to Google Gemini for our content review before generation. Review copies in Google Files are deleted after the check (or expire automatically if deletion fails); this review is paid by us.

4.What we do not collect

These are choices we make in the current product. The list below describes what we exclude or restrict.

We do not receive your Google password; sign-in is handled through Google.
No advertising tracker or screen replay: automatic click, form and replay collection in PostHog are disabled.
No prompt or uploaded media content is sent to PostHog; product analytics uses limited event properties.
Account-owned projects and assets are stored on our servers and are not public unless you choose to share a result.
No persistent cross-day analytics visitor ID, no data brokers, and no sale or sharing of personal information for advertising.

5.Cookies and browser storage

The anonymous session and language cookies support core site functions. PostHog runs in cookieless mode without a persistent analytics visitor ID in cookies or local storage. We do not show an analytics consent banner. You can turn analytics off below at any time; earlier refusal choices remain effective.

Some drafts, queues and interface preferences stay in browser storage under vv.. Signed-in projects and uploaded assets are also stored on our servers so they can be used across sessions.

vv_anon — anonymous session id, http-only, 12 months. Without it a submitted generation cannot be followed back to you.
vgent-locale — the language you chose, 12 months, written only when you switch language.
vv_device and vv.device in local storage — a random device id, written only when you claim the trial credits and kept 12 months; the server stores a keyed hash of it.
vv_src — the campaign tags and referring site of a visit from another site or a tagged link, http-only, 30 days; read once, when you create an account, and not written when your browser sends DNT or GPC.
Local storage under vv. — drafts, queues and interface preferences on this browser.
Clearing browser data removes local drafts and identifiers, but does not delete account-owned projects, assets or billing records.
Analytics preference under vv.analytics-consent — turning analytics off saves your choice; previous refusals still apply. PostHog does not store a persistent analytics visitor ID in this browser.
vv_timezone — first-party browser timezone for content safety rules; 1 day.

6.How we use it

We use information to provide generation, accounts and billing, keep the service secure, and measure page visits and selected product actions by default when analytics has not been turned off or blocked by DNT/GPC.

Depending on applicable law, additional rights or safeguards may apply. You can turn product analytics off below, and browser DNT/GPC signals block it. Other processing supports providing the service and applicable security or legal obligations.

Rendering: sending your prompt and settings to the provider and returning the result to your browser.
Anonymous limits: enforcing the 300 provider-credit cap on a single clip, 5 submissions per 10 minutes from one network address, and the daily provider budget shared by all anonymous traffic. No per-visitor credit balance is counted on our servers; signing up does not automatically grant credits.
Duplicate protection: matching a retry to the request it repeats, so one submission is never billed twice.
Debugging: following a single request id through the logs when a generation fails.
Security: detecting automated abuse and protecting the service and its provider budget.
Product analytics: by default, counting page visits and selected actions to understand which features are used, unless you turn it off or DNT/GPC blocks it.

7.Model providers and transfers

Your prompts, settings and source media may be sent to the provider needed for the model or editing workflow you choose. Each provider processes these inputs under its own terms and privacy notice.

Output files may be held by providers and, for account-owned assets and shared films, in our storage. The available retention and deletion controls depend on the type of work.

aivideoapi.ai, APIMart and MuleRouter — model generation and output handling for the models that use them.
The model vendor behind the model you chose — receives the job through the provider.
Our hosting, database and file storage providers, and Stripe for paid features.
Service providers may operate outside your country, so the data needed for a request may be processed abroad.
PostHog — cookieless product analytics sent to our United States project by default unless turned off or blocked by DNT/GPC.

8.How long we keep it

Retention depends on the type of data. Anonymous task records expire quickly; account projects, assets and billing records have different lifetimes.

Anonymous request fingerprints and task records: 24 hours. Account-owned projects and assets remain available until deleted or otherwise expired under the service rules.
Rate-limit windows: 10 minutes. Daily budget counters: 48 hours.
Trial anti-abuse hashes: network, device and fingerprint hashes are cleared 30 days after the claim; card hashes are kept so a card earns the bonus once.
Functional cookies: up to 12 months. PostHog does not store a persistent analytics visitor ID; turning analytics off saves a refusal preference under vv.analytics-consent.
Application logs: retained by our hosting platform under its own policy; we do not export them into a separate archive.
Outputs: held by the relevant model or storage provider according to the workflow and its retention controls.
PostHog analytics events: held according to our project retention setting; contact privacy@vgent.com for the current period or deletion.

9.Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing, receive a copy of your personal data, and complain to a supervisory authority. Clearing browser data removes local identifiers, but account-owned data requires a separate request or in-product deletion.

For an access or deletion request, write to privacy@vgent.com. Include your account email or the relevant request or task ID so we can locate the records. You can turn product analytics off below at any time.

Access or deletion: write to privacy@vgent.com with your account email or relevant request or task ID.
Turn off product analytics: use the control on this page to stop new events. Previous refusals remain effective; DNT/GPC signals also block analytics.
Output hosted by the provider: ask us and we will pass the request on; the provider’s own retention still applies.
Complaint: your local data protection authority, whether or not you write to us first.

10.Children

The service is for people aged 18 and over, as the Terms of Service require, and it is not directed to children. If the law where you live sets a higher age for using generative AI tools, that age applies to you.

We do not knowingly collect data from children. If you believe a child has used the site and left data with us, write to privacy@vgent.com and we will delete whatever we can identify. Sexualised or exploitative content involving minors is prohibited outright by the content policy, whoever submits it.

11.How we protect it

We limit access to the data we retain, keep provider keys on the server, and use signed task references. Account projects and uploaded assets are protected by account checks.

No system is perfectly safe, and we would rather hear about a weakness than not. The security page describes the controls in place and how to report a vulnerability.

The provider API key stays in the server environment; generation is proxied, never called from your browser.
The anonymous session cookie is http-only and same-site, so scripts cannot read it.
IP addresses are hashed before they become rate-limit counters.
Continuation sources travel as signed, expiring tokens rather than raw provider ids.
Log lines are assembled from a fixed set of fields that excludes prompts, media and secrets.

12.Changes to this policy

We update this page when the product or its data practices change. Accounts, uploads, paid features and cookieless product analytics are described here as current features.

We revise the dates at the top with every change and describe anything material on the page itself. Continuing to use the site after a change means you accept the updated policy.

13.Contact

Privacy questions, access requests and deletion requests all reach the same mailbox, and postal mail reaches the registered address below.

Privacy and data requests: privacy@vgent.com
Legal notices: legal@vgent.com
Post: Vgent Labs Pte. Ltd., 68 Circular Road, #02-01, Singapore 049422