PerfectVector API Privacy Notice

1. How this notice applies

This notice supplements the PerfectVector Privacy Policy for data we receive through the PerfectVector API (the "API"), and controls for that data if the two conflict. Everything else in the Privacy Policy applies, including your account, international transfers, your rights, children's privacy and changes. Rastrix Inc. is responsible for the processing in this notice.

2. What we receive

Data	Details
Account	Your PerfectVector account, as on the website.
API keys	Each key's name, whether it is live or test, its first and last characters, a one-way hash of the key, its permissions, when it was created and last used, and when and why it was revoked. We never store the full key.
Agreements	When you accepted the API Terms and which version, and, each time you start a checkout, when you ticked the withdrawal acknowledgement and which wording you saw.
Account status and change log	Whether your API access is suspended, since when and why, and any limits we changed for your account. A log of changes to your API account (for example keys created, revoked and re-hashed, limit changes, suspensions, API credits bought or removed, and low-balance alerts), with when each happened and whether you, our staff or our systems made it.
Images you send	The image, its file name, pixel dimensions and size, and a SHA-256 fingerprint of it, which we use to recognize a repeated request. For test-key requests we check the image and then discard it: we keep only its file name, size, dimensions and fingerprint, and store no files.
Results	The SVG result of each live request. We keep no previews or thumbnails of API files.
Request records	For each request: its request ID, the key used, live or test, the method and endpoint called, the conversion it concerns, the response status and error code, the credits charged, whether it repeated an earlier request, how long it took, and when it was made. Request records contain no images and no IP address.
Credits and purchases	Your API credit balance, the credits granted and used, and for each purchase the order number, pack, quantity, amounts, currency, refunds and status. Lemon Squeezy collects your payment details directly; we never receive your card data. We keep a copy of each payment notification from Lemon Squeezy without your name, your email address or any payment link; only your email address's domain stays.
Settings	Whether the low-balance banner is on, and its level.
Technical data	Request and error logs, as described in §2.2 and §7 of the Privacy Policy.

3. Why we use it

To run your requests, charge API credits, show your usage and balance, support you, find and fix failed requests (from error and usage data), keep the API secure and prevent abuse, and comply with the law.

To improve PerfectVector, we use usage data, never your images: things like request counts, file sizes, image dimensions, processing times and error rates.

We use the images you send and the results we produce to run your requests. To keep PerfectVector safe, a small number of authorized staff review recent conversions in our internal, read-only dashboard to spot misuse, like illegal or abusive content. Your images are never used to train AI models and never sold. Any review happens only while the files are still retained, and we never keep copies for this purpose.

Our legal bases are the ones in §3.5 of the Privacy Policy: providing the API you asked for (contract); security, abuse prevention and improving the Service from usage data (legitimate interests); and keeping purchase and tax records (legal obligation).

4. Who receives it

Our service providers for the API, which process data for us:

• Google Cloud (Cloud Run, Cloud SQL, Cloud Storage, Cloud Tasks): hosting, databases, our job queue and file storage;
• a cloud GPU provider based in the United States: image processing; per its documentation, it does not keep the inputs of synchronous calls after returning the result;
• Lemon Squeezy: payments, as the Merchant of Record;
• Sentry: error reports from the API, with API keys removed (also listed in §4.1 of the Privacy Policy).

API requests are not sent to any other image processing provider.

You can ask us for the names of our service providers.

No other customer can read your requests or results. Our authorized staff can see request records for support and abuse handling, and your images and results as §3 describes. We may also look at your images and results, or share them, when the law requires it.

5. Where we keep it

In Google Cloud databases and in a private Google Cloud storage bucket used only for the API, which only our backend service and our internal staff dashboard (read-only) can access. File names in that bucket contain no account ID and no name from your files. §5 of the Privacy Policy describes international transfers.

6. How long we keep it

Data	How long
Images and results	Available for 24 hours after the request completes. Deleted from storage within 48 hours, or at once when you delete the request through the API.
File names of your images	Cleared together with the files, within 48 hours.
Test-key requests	Their file names are cleared after 24 hours, and the records are deleted after 7 days.
Conversion records (status, times, sizes, dimensions, credits)	Kept with your account history, like website download records.
Request records	90 days.
API keys	Kept with your account history after revocation. Revoked keys stay visible in your dashboard for 30 days.
Agreements, account change log and purchase records	Kept with your account history, for billing, tax, security and dispute purposes. Lemon Squeezy keeps its own billing records (§7 of the Privacy Policy).
Logs	About 30 days (§7 of the Privacy Policy).

If you delete your account, we revoke your keys, clear the names of your keys and the file names of your images, and keep the other records only in anonymized form (§7 and §8 of the Privacy Policy).

7. Your choices

• Delete a request's files early with DELETE /v1/vectorizations/{id}.
• Revoke keys at any time in the Developers area of your account.
• Delete your account from your account settings. This revokes all of your keys; unspent API credits are lost.
• Use your rights under §8.3 of the Privacy Policy.

8. Images of other people and your users

If your images come from your own users or show other people, you must have the rights and any permission the law requires to send them to us, and you are responsible for telling your users how their data is used. You are responsible for your users (§9 of the API Terms).

9. Security

We store API keys only as keyed one-way hashes and accept them only in the Authorization header. Results are served only to the account that made the request, with that account's key. Our error reports and logs remove API keys.

10. Children

The API has the same age requirement as the rest of the Service (§1 of the Terms), and §10 (Children's Privacy) of the Privacy Policy applies.

11. Contact

Privacy questions: contact@perfectvector.com. To report a security problem, email contact@perfectvector.com with "Security" in the subject line. Rastrix Inc., Republic of Korea.