Effective Date: [DATE] — Last Updated: [DATE]
This Privacy Policy explains how XoonBox LLC ("XoonBox," "we," "us," or "our") collects, uses, and shares information when you use Asset Studio ("the Service"). We believe in being transparent about what data flows where — especially when third-party services are involved.
When you sign in through Cloudflare Access, we receive and store:
We do not collect or store passwords. Authentication is handled entirely by Cloudflare Access and your chosen identity provider (e.g., Google, GitHub, Apple).
We do not sell your personal information. We do not use your content for advertising.
The Service relies on several third-party providers. When you use certain features, your data is transmitted to these providers. Below is a transparent accounting of each.
| Provider | What Data Is Sent | Purpose | Retention |
|---|---|---|---|
| Google (Gemini API) | Text prompts, reference images | AI image generation | Up to 55 days for abuse monitoring. Not used for model training (paid tier). |
| Vectorizer.ai | Raster images submitted for production vectorization | Image-to-SVG conversion | Vectorizer.ai retains a broad license over submitted images and may use them for model training and service improvement. There is no opt-out. See Section 4 below. |
| Cloudflare | IP address, authentication tokens, all stored data (D1 database, R2 object storage) | Hosting, authentication, database, file storage, security, analytics | Per Cloudflare's data processing terms. Analytics data is aggregated and not personally identifiable. |
| Stripe | Email address, payment information (entered directly on Stripe's platform) | Payment processing, subscription management | Per Stripe's privacy policy. We do not store card numbers. |
| Oracle Cloud (OCI) | Email address, email content | Transactional email delivery (invitations, notifications) | Per Oracle's data processing terms. |
| Serper API | Search queries (when using image search) | Reference image search | Per Serper's privacy policy. |
We want to be especially transparent about how the production vectorization feature works:
If you have images that are confidential, proprietary, or sensitive, use the client-side vectorization option instead. Client-side vectorization processes images entirely in your browser using WebAssembly and does not transmit any data to external servers.
All data is stored and processed in the United States and on Cloudflare's global network. By using the Service, you consent to the transfer of data to the United States.
You have the right to:
To exercise any of these rights, contact us at Questions@xoonbox.com.
We take reasonable measures to protect your data, including:
No system is perfectly secure. We cannot guarantee absolute security of your data.
You may request deletion of your account and all associated data by emailing Questions@xoonbox.com. Upon request:
The Service is not intended for anyone under the age of 18. We do not knowingly collect personal information from individuals under 18. If we learn that we have collected such information, we will delete it promptly.
Asset Studio does not use tracking cookies or advertising cookies. Cloudflare Access uses a session token (stored as a cookie) solely for authentication purposes. Cloudflare Web Analytics does not use cookies.
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy and updating the "Last Updated" date. Your continued use of the Service after changes take effect constitutes acceptance.
For questions about this Privacy Policy or to exercise your data rights, contact us at:
Questions@xoonbox.com
XoonBox LLC — Georgia, United States