Privacy Policy
Last revised:
This Privacy Policy explains how XoonBox LLC ("XoonBox," "we," "us," or "our") handles information when you visit xoonbox.com, contact us, have subscribed to company updates, or use Asset Studio (the "Service"). For company inquiries and any previous newsletter signups, see Section 2.
1. Information We Handle
Accounts and access requests
Asset Studio uses its own account sessions. You can sign in with Google, Facebook, or an email magic link, subject to access availability. We receive your email address, display name where provided, identity-provider identifier and verification information. We store account and access-request status, preferences, session and refresh-token records, and security information such as network prefixes and a browser user-agent hash. We do not receive your Google or Facebook password, and email sign-in does not require an Asset Studio password.
Content and activity
We handle prompts, reference images, uploads, generated images, vectors, background-removal results, titles, labels, settings, drafts and saved history. Content can be saved automatically as you work. We also record feature use, model/provider, request identifiers, credits, cost and billing events, errors and security events. These records can be linked to your account; they are separate from website traffic analytics.
If you choose voice input when available, your microphone recording is sent for transcription. The returned text can become part of your prompt and saved content. The transcription endpoint does not save an audio recording to your asset library.
Records from earlier use of the Service may remain subject to the retention and deletion practices below.
Billing and technical information
Stripe processes payment details. We store customer and subscription identifiers, plan and payment status, invoices, credits and usage accounting, rather than full payment-card numbers. Hosting, security, font and other services receive connection information such as IP address, requested URL, browser information and timestamps.
2. Company Website, Inquiries and Newsletter
Our contact forms collect your name, email, optional company and message. We store the submission with its IP address, submission time and record identifier in Cloudflare KV, and send an inquiry notification through Oracle Cloud Infrastructure (OCI) Email Delivery to our company inbox. We use this information to respond, discuss requested work, maintain correspondence and limit abuse. Mail addressed to xoonbox.com is routed through Google-hosted email.
Company newsletter signup is currently disabled. Any records from previous signups may include an email address, IP address and signup time stored in Cloudflare KV for the updates requested. Disabling signup does not itself delete earlier records. Signup records and contact submissions have no automatic expiry; separate short-lived rate-limit records do not determine how long a submission is kept.
To request removal from the company newsletter list, deletion of an inquiry or signup record, or information about correspondence we hold, email Questions@xoonbox.com. An Asset Studio invitation-email unsubscribe control, where supplied, is separate from the company newsletter list.
3. Why We Use Information
- Provide account access, image generation, vector conversion, background removal, reference search, dictation and saved work.
- Respond to inquiries and access requests, and send account and service messages.
- Process payments, subscriptions, credits and usage accounting.
- Maintain service reliability, investigate errors, prevent abuse and enforce our Terms.
- Handle privacy requests, legal obligations and disputes.
We do not sell your personal information or use your content for advertising. Provider processing is described below and can include safety review or other uses under the applicable provider terms.
4. Providers and Other Recipients
Data sent depends on the feature you use. A generation request can include your prompt, style instructions and attached references. Automatic or random model selection can send different variants to different providers. Google also processes reference analysis and automatic naming; selecting another image model does not exclude those auxiliary Google calls.
| Provider | Information and purpose | Provider documentation |
|---|---|---|
| Google Gemini | Prompts, style/context, reference images and outputs for generation, reference analysis and naming. | API terms; abuse monitoring |
| OpenAI | Prompts, context, reference images and outputs for image generation/editing. | API data controls; service terms |
| xAI / SpaceXAI | Prompts, context, reference images and outputs for Grok image generation/editing. | API data practices; enterprise terms |
| Meta Muse | Prompts, context, reference images and outputs for Muse image generation/editing. | Model API terms; model designations |
| Vectorizer.AI (Cedar Lake Ventures) | Raster images and conversion settings for vectorization, previews and vector downloads. | terms; privacy; API retention controls |
| Replicate | Uploaded source images, processing jobs and results for background removal using BRIA or BiRefNet models. | privacy; prediction retention; terms |
| Cloudflare | Website/app hosting, account and content storage, work queues, image preparation, security, DNS and traffic analytics. Voice recordings currently go to Cloudflare Workers AI for transcription. | privacy; data processing; Workers AI data use |
| Google and Facebook (Meta) sign-in | Authentication requests and identity information exchanged with your selected sign-in provider. | Google privacy; Meta privacy |
| Stripe | Payment information, email, customer/subscription identifiers and transaction data for checkout, recurring billing and fraud prevention. | privacy |
| Oracle OCI and email recipients | Email addresses, message content and delivery information for sign-in, access, service and inquiry messages. Recipients and their mail providers receive delivered messages. | services privacy |
| Google-hosted company email | Company correspondence, inquiry notifications and privacy/support requests, including addresses and message content. | privacy; cloud data processing |
| Serper | Search queries for reference-image search. Serper returns image locations from third-party websites. | privacy; terms |
| Image and thumbnail hosts | Your browser requests search-result thumbnails directly; our server retrieves selected images for import. The relevant host receives the request and connection information under its own policies. | Policies of the website hosting the image |
| Telegram | Operator security alerts containing event, route, environment, hashed IP, request identifier and time. The alert format does not include prompts, images, raw IP addresses or email addresses. | privacy |
| Google Fonts | Browser requests for fonts used on our website and app, including IP and request/browser information. | Google privacy |
Provider retention and training
Provider rules differ by service, account settings and contract. Google's paid Gemini terms exclude product-improvement use of prompts and responses; unpaid terms differ. Google describes 55-day abuse-monitoring retention. OpenAI's API defaults exclude training unless the customer opts in, with abuse logs generally retained up to 30 days and exceptions. xAI describes a 30-day API audit default and no training without permission. These are provider rules, not a promise that Asset Studio has zero-retention arrangements.
Meta currently designates Muse Image as a Standard Service, whose terms exclude model training on content but allow safety/security processing and purpose-based retention. Other Meta service tiers can have different rules.
Vectorizer.AI's terms permit model-training use with exceptions for service-specific published policies. Its API separately provides image/result retention controls: our preview requests specify one day, while production conversion uses the API default. This does not establish deletion of every provider record or revoke permitted training use.
Replicate normally removes API prediction inputs, outputs and logs after an hour. Uploaded file resources have separate expiry information, and saved Asset Studio results remain subject to our retention practices. We do not promise that every provider record is erased on that schedule.
5. Storage, Browser Processing and Location
We use Cloudflare D1 for account, content metadata, permissions, usage and billing records; R2 for images, vectors, references and some security records; and KV for company form records. Browser storage also holds drafts, preferences, references and cached history. Clearing browser storage does not delete server copies, and a server deletion request does not clear files already downloaded to your devices.
Asset Studio is a connected service, not a guaranteed offline workflow. Browser-side editing or tracing does not prevent uploads, reference processing, cloud saving or service telemetry. The current interface does not provide a verified, entirely browser-only option for confidential images. Do not submit content unless you are authorized to send it to the recipients described here.
XoonBox operates in the United States. Cloudflare and other providers operate internationally, so information may be processed outside your country. We do not promise a single processing country or data-residency region for every service.
6. Retention
There is no single automatic deletion period for all information. Account and saved content can remain until removed; older versions or temporary assets may be pruned separately. Deactivating a feature, signing out or cancelling a subscription does not itself erase stored content.
Authentication-audit and provider-diagnostic cleanup targets 90 days, and administrative-audit cleanup targets one year. These cleanup processes are not guarantees that all records disappear at those ages. Historical activity-feed retention is currently configured to 30 days and is separately adjustable. Usage/accounting records, security records, email delivery/suppression records and backups can have different lifetimes. Suppression records help prevent unwanted or undeliverable email, and some have no automatic expiry.
Billing, fraud-prevention, dispute and legally required records may need to remain after other data is deleted. Company form records have the retention described in Section 2. Provider retention is separate from our copies. Contact us for the status and scope of a particular deletion request.
7. Privacy Requests and Account Deletion
Email Questions@xoonbox.com to request access, correction or deletion of your information, or to raise a privacy concern. Applicable rights and exceptions depend on your location. We may need to verify your identity and clarify which account, content or company-site record your request concerns.
Sending an account-deletion email does not automatically deactivate your account or start an automatic 30-day purge. Request verification, access closure, any recovery period and deletion timing need to be confirmed with you. Applicable legal response deadlines still apply. See Data Deletion for the request process, billing considerations and retained-record exceptions.
You can download available assets through the Service. For information no longer accessible in the interface, contact us. Third-party deletion options and legal exceptions vary; we cannot promise immediate erasure of every provider or recipient copy.
8. Cookies, Local Storage, Analytics and Security
Asset Studio uses session, refresh and sign-in security cookies. Browser storage supports preferences, drafts and cached work. Cloudflare Turnstile and challenge services process connection and browser signals to prevent abuse; see the Turnstile Privacy Addendum.
The company website uses Cloudflare Web Analytics for traffic and performance information. This is separate from authentication, security and account-linked product usage records. We do not use advertising cookies. External sign-in, payment and image-hosting sites apply their own cookie and privacy practices.
Our safeguards include HTTPS, application session checks, access controls and rate limiting. They do not make the Service suitable for every type of confidential information, and no system can guarantee absolute security.
9. Children
Asset Studio is intended for people aged 18 or older. We do not knowingly collect personal information from children through the Service. Contact us if you believe a child has provided information so we can investigate and address it.
10. Changes and Contact
We may update this policy and its revision date as our services change. Where required, we will provide additional notice. The revision date identifies this version; it is not a statement of when you first agreed to any terms.
For privacy questions or requests, contact XoonBox LLC at Questions@xoonbox.com.
XoonBox LLC — Georgia, United States