Visnea

Privacy Policy

Last updated: November 5, 2026

What personal data Visnea processes, why and on what grounds, who receives it, how long it is kept, how it is protected and how to exercise your rights.

1. General

1.1. This Policy sets out how the personal data of users and visitors of the Visnea service (the “Service”) is processed and protected. It follows Federal Law No. 152-FZ of 27.07.2006 “On Personal Data” (the “Law”) and is published under Article 18.1(2) of the Law.

1.2. The personal data operator is the administration of the Visnea service (the “Operator”, “we”). Questions about personal data: e-mail support@visnea-labs.com, Telegram https://t.me/visnea_labs?direct.

1.3. The Policy covers all data the Operator receives through visnea-labs.com and app.visnea-labs.com, the Telegram bot @visnea_labs_bot, the API and the plugins. Terms have the meanings given in the Law.

2. Data we process

2.1. Users of the Service:

  • account data: e-mail address; when you sign in with Google — the Google account ID and its e-mail address; when you sign in with Telegram — the Telegram ID and username; the profile name, address and avatar if you set them;
  • payment data: amount, currency, date, status and number of the payment, payment method, the e-mail for the receipt. We do not receive card or account details — the payment providers process them;
  • requests and results: the texts, images, video, audio and files you upload or create, conversations with the chat and the agent, the history of operations and the balance;
  • technical data: IP address, browser and device information, cookies and local storage records, time and parameters of requests, security events (sign-ins, API keys issued and revoked, plugin devices);
  • the traffic source (UTM tags) and referral code — only with your consent to marketing cookies;
  • correspondence with support and what you tell us in your requests.

2.2. Visitors who are not signed in: technical data and cookies (under the Cookie Policy) and the data you enter in contact forms.

2.3. We do not process special categories of personal data and do not use images of people to identify them (biometric data). Do not upload health information, identity documents or other data your task does not need. If a request contains other people's personal data, you are responsible for having a lawful basis to share it.

2.4. The Service is not intended for persons under 18. We do not knowingly collect their data; when we find such an account, we delete it.

3.1. Signing up, signing in and keeping the account; providing the Service (operations, history, library, gallery, API, plugins, Telegram bot). Data: account data, requests and results, technical data. Grounds: performance of a contract to which you are a party (Article 6(1)(5) of the Law) and consent (Article 6(1)(1)). Retention: until the account is deleted.

3.2. Accepting payments, keeping the balance, refunds, receipts. Data: account and payment data. Grounds: performance of the contract and duties set by law — accounting, tax and cash register rules (Article 6(1)(2) and (5)). Retention: while the contract is in force and 5 years after the year of the transaction.

3.3. Service messages: sign-in codes, e-mails about sign-up, operations and payments, low-balance and unfinished-payment notices, changes to the documents, support replies. Data: e-mail, Telegram ID. Grounds: performance of the contract. Retention: until the account is deleted. Service messages are not marketing.

3.4. Security: preventing fraud and abuse (including multiple accounts for bonuses), bot protection, moderation of requests, incident investigation. Data: technical data, account data, requests. Grounds: legitimate interests of the Operator and users (Article 6(1)(7)). Retention: technical logs are kept only as long as these purposes need, then deleted or anonymised.

3.5. Support and replies to requests. Data: correspondence and the details of the request. Grounds: performance of the contract, consent. Retention: until the account is deleted, and data on disputed matters until the limitation period (3 years) expires.

3.6. Marketing and newsletters (news, offers) — only with separate consent (Article 18(1) of the Federal Law “On Advertising”), given with a checkbox at sign-up or in the account settings. Data: e-mail. Retention: until consent is withdrawn — with the “Unsubscribe” link in any such e-mail or in the account settings.

3.7. Tracking traffic sources and the referral programme. Data: UTM tags, referral code. Grounds: consent to marketing cookies. Retention: 30 days in the browser; where a registered user came from — until the account is deleted.

3.8. Publishing works in the gallery and the public profile — at your choice. Data: the published work and its details, the profile name, address and avatar. Grounds: your act of publishing and consent. Retention: until you unpublish.

3.9. Improving the Service: statistics on the use of features and models in aggregate form. Grounds: legitimate interests of the Operator (Article 6(1)(7)). Statistics use aggregated or anonymised data.

4. How we process data

4.1. Processing includes collection, recording, systematisation, accumulation, storage, clarification (updating, changing), retrieval, use, transfer (provision, access), anonymisation, blocking, deletion and destruction — with and without automation.

4.2. We do not take decisions with legal effects for you based solely on automated processing. Automatic moderation may decline an individual request; a decision to restrict access to an account is taken by a person.

5. Who receives the data

5.1. We do not sell personal data and do not share it with others for their own marketing.

5.2. To provide the Service we pass data to, or entrust its processing to (Article 6(3) of the Law), the following — only as much as the purpose needs:

  • AI model providers — model access services (kie.ai, fal.ai, poyo.ai and others) and model developers (for example, Google, OpenAI, Anthropic, Black Forest Labs, ByteDance, Kuaishou): requests and settings to perform the operation. Your e-mail and payment data are not passed to them;
  • payment providers (lava.top, Platega) and banks: the amount, the e-mail for the receipt, the payment number; you enter card details on the provider's page;
  • Google: Google sign-in and form protection with reCAPTCHA (IP address, browser information, Google cookies);
  • Telegram: the Telegram bot and Telegram sign-in;
  • the hosting provider whose servers run the Service: data storage;
  • public authorities — on a lawful request.

5.3. Those entrusted with processing must keep the data confidential and protect it as the Law requires. Works you publish and your public profile are visible to any visitor of the Service.

6. Cross-border transfer

6.1. AI model providers, Google, Telegram and some payment providers are located outside the Russian Federation, including in countries that do not ensure adequate protection of data subjects' rights (for example, the USA). When you use the related features, your data is transferred abroad. The Operator carries out such transfers in accordance with Article 12 of the Law and passes only the data the feature needs.

6.2. The Service's core features cannot work without passing requests to model providers. If you do not agree to cross-border transfer, do not use generation or sign-in with Google and Telegram.

7. Retention and destruction

7.1. Data is kept no longer than the purposes require (periods in section 3) unless the law sets a longer period.

7.2. Deleting a result from the history hides it from your history and from the gallery. The file itself and the record of the operation are kept for payment records and handling requests, and are destroyed together with the account.

7.3. To delete your account, write to support@visnea-labs.com from the account's e-mail address or from the linked Telegram. We delete the account and destroy its data within 30 days, except data we must keep by law (such as payment records): we block it and destroy it when the required period ends.

7.4. When the purposes are achieved or consent is withdrawn, the data is destroyed within 30 days (Article 21(4) and (5) of the Law) unless the law or the contract provides otherwise.

8. Data protection

8.1. We take legal, organisational and technical measures (Articles 18.1 and 19 of the Law): data travels only over encrypted connections (HTTPS), API keys are stored as hashes, sign-in sessions are short-lived and renewed with a separate protected key, forms are protected from bots, only authorised persons have access to the data, and backups are made regularly.

8.2. In the event of unlawful disclosure of personal data, we notify Roskomnadzor within the periods set by Article 21(3.1) of the Law (24 and 72 hours) and inform the affected users where this helps them protect their rights.

9. Your rights

9.1. You may: get information about the processing of your data (Article 14(7) of the Law); ask us to correct, block or destroy data that is incomplete, outdated, inaccurate, unlawfully obtained or not needed for the stated purpose; withdraw consent; object to decisions based solely on automated processing; opt out of marketing; complain about the Operator to Roskomnadzor or to a court.

9.2. Send your request to support@visnea-labs.com from the account's e-mail address or from the linked Telegram; it must allow us to see that the data is yours (for example, the account's e-mail). We reply within 10 working days of receiving the request; this period may be extended by up to 5 working days with the reasons given (Article 20(1) of the Law).

9.3. Withdrawing consent does not affect processing before the withdrawal. After it we may continue processing where there is another lawful ground, such as performing the contract or a legal duty. If the Service cannot work without the data concerned, the account will be deleted.

10. Cookies

10.1. The cookies and browser records the Service uses are listed in the Cookie Policy. The marketing cookie is set only with your consent; there are no third-party analytics or advertising trackers on the website.

11. Changes and contacts

11.1. We may update this Policy. A new version takes effect when published on this page; we announce material changes in advance by e-mail or in the Service. This English translation is provided for convenience; the Russian version prevails.

11.2. The Operator:

Privacy Policy — Visnea