Privacy Policy
Last updated 7 August 2026
This policy explains what we collect, why, and what you can do about it. The Visual Alchemy Studio is operated by Sorcelux Digital Solutions, based in the Philippines. We are the data controller for the information described here.
1. What we collect
When you create an account
- Email address — to identify your account and contact you
- Name — optional
- Password — stored only as a scrambled value produced by a one-way function (scrypt). We never store or see your actual password and cannot recover it for you
- Account created date and your current plan
When you use the studio
- Your conversations — what you type and what the studio replies, stored so your projects are there when you return
- Usage counts — how many messages you have used in the current period, so we can apply your plan's allowance
- Which discipline and level you chose
When you subscribe
Payments are handled entirely by Paddle, which acts as merchant of record. We never see or store your card details. We receive only a confirmation that a payment succeeded and which plan it was for.
Technical information
Our servers keep standard logs including IP address and timestamps, used for security and to diagnose faults.
2. What we do not do
- We do not sell your personal information
- We do not use your conversations for advertising
- We do not share your projects with other users
- We do not use your content to train our own AI models
3. Who else processes your data
Running this service means passing some information to other companies. These are all of them:
| Who | What they receive | Why |
|---|---|---|
| OpenAI | The content of your studio conversations, plus an anonymous account identifier | To generate your responses |
| Paddle | Your email and payment details, which you provide to them directly | To take payment as merchant of record |
| Render | Hosts the service; holds all stored data | To run the application |
| Neon | Database hosting for accounts and conversations | To store your projects |
| Netlify | Serves the website pages | To deliver the site |
We deliberately send OpenAI an opaque account identifier rather than your email address, so your conversations are not linked to your identity on their systems.
These providers operate outside the Philippines, so your information is transferred and stored internationally.
4. Why we are allowed to hold it
We process your data to provide the service you asked for, to take payment, to keep the service secure, and to meet our legal obligations. Where the law requires consent, we ask for it and you may withdraw it at any time.
5. How long we keep it
- Account and conversations — while your account is open
- After you delete your account — removed within 30 days, except where we must keep records for tax or legal reasons
- Payment records — kept by Paddle under their own policy and applicable tax law
- Server logs — around 30 days
6. Your rights
You may ask us to:
- give you a copy of the personal data we hold about you
- correct anything inaccurate
- delete your account and its data
- stop processing your data in certain circumstances
- provide your data in a portable form
Email vastudio@sorceluxdigital.com and we will respond within 30 days. There is no charge.
If you are in the Philippines, you also have rights under the Data Privacy Act of 2012 and may complain to the National Privacy Commission. If you are in the UK or EU, you may complain to your local supervisory authority.
7. Security
Passwords are hashed with scrypt and never stored in readable form. Traffic is encrypted in transit. Accounts are strictly separated — one user cannot read another's projects. Access to production systems is limited.
No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant authority as required by law.
8. Cookies and local storage
We use one cookie and one browser storage entry, both holding your sign-in token so you stay signed in. That is all. We use no advertising cookies and no third-party trackers.
9. Children
The service is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.
10. Changes
If we change this policy in a way that materially affects you, we will email account holders before it takes effect.
11. Contact
Sorcelux Digital Solutions
Philippines
vastudio@sorceluxdigital.com
This policy describes how the service actually handles data today. It is not legal advice. Have it reviewed by a lawyer familiar with the Philippine Data Privacy Act, and with GDPR if you expect customers in Europe.