Privacy policy

1. Overview

png2svg.art (“we”, “our”, “us”) is an image-to-vector service published by Nothing But Meow LLC. This Privacy Policy describes how we collect, use, and protect your information when you use png2svg.art (the “Service”).

2. Information we collect

• Account information: when you sign in with Google we receive your e-mail address, a verified account identifier and your name; when you sign in with a code sent by e-mail, the address you enter (the code itself is kept only until it is used or expires, at most 15 minutes). Guest use requires no personal information.
• Uploads and results: the images and PDF documents you upload, the previews and the SVG and PNG files made from them, and edits you save in the editor. They are stored privately, tied to your session or account; embedded image metadata is stripped when an upload is normalized, and a PDF is kept only while its pages are converted (the PNG files made from it are kept like your other files). Guest files are deleted after 24 hours, account files after 30 days, and every file shows its exact expiry.
• Logo studio briefs and generated logos: the brief you write in the AI logo generator (brand name, tagline, styles, colors and notes) or, for an icon set, a sticker pack or a set of badges, the list of icons, stickers or badges (with their captions, or the words of a badge's lettering), the style you choose and, for a badge that makes a claim, your confirmation that it is true for your business, the prompts we build from it and the logo images made from it, stored privately in your account. Each logo image is deleted 30 days after it was made; a brief and its prompts 30 days after you wrote it or after the last logos were made from it, whichever is later. You can delete a logo, or a whole project with its brief, prompts and logos, at any time. A brief written before signing in is kept with your guest session for 24 hours and moves to your account when you sign in.
• Sticker packs added to Telegram: when you choose Add to Telegram on a sticker pack, the numeric Telegram user ID of the account that starts our sticker bot, the name of the sticker set made for the pack, and when it was made and last updated — kept with the pack only so that the set can be updated later. We keep nothing else about your Telegram account: no username, name or phone number.
• Palettes: the color palettes you save (each one's name and colors, whether it is your default and where it came from), stored privately in your account until you delete them or your account. An image you pick colors from is read once on our servers and is not kept. Palettes you make before signing in stay in your browser and move to your account when you sign in.
• AI agents: for each agent key you create on the Security page, its name, its first few characters and a one-way code made from the key, which cannot be turned back into the key (we never keep the key itself; it is shown to you only once), whether it can change or delete your work, and when it was created, last used and revoked. Your credit history shows the key next to each charge it made, and we e-mail you when a key is created or revoked. For each request an agent sends with a request label (a label it gives a request, such as one that starts work, spends credits, uploads files or deletes something, so that it is never carried out twice), we keep which tool it used, the request label, a short code that identifies the rest of the request (not the request itself), what it made or did (with the names of the files it uploaded or deleted, and why a file was refused) and the credits it reserved or spent. The answers an agent gives on your behalf to the Service’s questions, the names it changes and what it deletes are recorded with its key. We also keep the files an agent uploads (images, PDF documents or SVG files) with their names, sizes and formats, and the files made for it to download (a single size, color or variant, or a ZIP). A download link made for an agent works without the key, for anyone who has it, for 15 minutes and at most 10 downloads.
• Usage data: conversions, credits, unlocks and support tickets, kept to operate your account and billing history.
• Technical data: IP address and request metadata, used for quotas, abuse limits and security logs (stored hashed or short-lived).
• Payment data: purchases are processed by Stripe through Link as the merchant of record. We receive order, payment and subscription events (never full card numbers) and keep them to grant credits, show your billing history and handle refunds. Stripe processes your payment details, billing address and tax location under its own privacy policy.
• Cookies: strictly necessary cookies only — session, CSRF protection, theme and your consent choice. Optional analytics cookies are set only after you accept them in the cookie banner; declining is one click and the Service works exactly the same.

3. How we use your information

• To trace your images, convert the pages of your PDF documents into images, render previews, store and deliver your files and editor versions.
• To operate your account: credits, unlocks, billing history, receipts and refunds.
• To make and update your sticker sets in Telegram when you ask for it.
• To let the AI agents you connect with your keys use the Service for you.
• To answer support tickets.
• To enforce quotas and protect the Service from abuse.
• To improve the Service through aggregated, consent-based analytics.

4. Your files

Your images, PDF documents and vectors are processed on our own servers to produce the result you asked for. We do not sell them, do not use them to train models, and do not use them for anything except providing and operating the Service. A PDF you upload is never sent to any outside service.

The one exception is the optional AI background remover: only when you choose its “Subject (AI)” mode, a copy of that one image, scaled to at most 2,048 pixels on its longest side and without metadata, is sent to our GPU provider (section 5), where the open-source BiRefNet model computes which pixels belong to the subject. The resulting mask comes back to our servers and is stored privately with your files, so that re-running that image (another mode, or turning the cut-out into an SVG) never sends it again. The mask is kept only while at least one of your files made from that image is kept: it is deleted when you delete the last of them, when the last of them expires, or when you delete your account. Tracing itself never leaves our servers and uses no AI.

The AI logo generator works the same way: only when you generate or refine logos, or make an icon set, a sticker pack, a badge or a set of badges, or a round of changes to one, the prompt we build from your brief or your list of icons, stickers or badges (for a badge, with the words you typed for its lettering, which the image model draws) — and, for a refinement, the generated logo you chose; for a round of changes, icons, stickers or badges of that set or pack; for a character's stickers, the look you picked or the logo of yours you chose — is sent to our image provider, OpenAI (section 5), whose image model makes the logos and returns them. When OpenAI is unavailable, the same request goes instead to our GPU provider (section 5), where our own server runs the open-source Ming-Image-0.1-Design model. Nothing that identifies you — your name, e-mail address, account or IP address — is sent with it. An image you upload is sent with the request only when you attach it yourself to a logo request, an icon set, a sticker pack or a set of badges, as a reference for the logos, for the look of the icons or the badges, or for the character or the style of the stickers (stored privately in your account like a generated logo, and deleted with it); images you upload anywhere else are never sent. The logos come back to our servers and are stored privately in your account (section 2); a logo you vectorize becomes one of your files like any upload.

Adding a sticker pack to Telegram happens only when you choose it: the pack's stickers (as images), the pack's name, and each sticker's name, caption, emoji and search words are sent to Telegram, which makes them a sticker set in the Telegram account that started our sticker bot. From then on Telegram holds that set under its own terms and privacy policy (section 5). To choose emoji for stickers whose words our own list does not cover, those words (a sticker's name and caption, never anything that identifies you) are sent to OpenAI (section 5). Deleting the pack or your account here does not delete the set in Telegram: it is yours, and you can delete it in Telegram.

An AI agent you connect with your key uses the same tools you use in your browser, and what it asks for is processed like the same request made there: on our own servers or, only in the cases described above, by the providers in section 5. Anything made from a file your agent uploads is kept for as long as if you had made it in your browser (section 6).

5. Data sharing

We do not sell your personal data. We share data only with the categories of service providers that operate the Service on our behalf:

• Cloud hosting and storage providers: to run the Service and store your files encrypted at rest.
• Sign-in provider (Google): to authenticate you when you sign in with Google.
• Image provider for the AI logo generator (OpenAI, L.L.C., United States): only for the logo, icon, sticker and badge requests described in section 4 (the prompt built from your brief or list and, for a refinement, the generated logo you chose, for a round of changes the icons, stickers or badges of that set or pack, for a character's stickers the look you picked or the logo of yours you chose, or the reference image you attached to the request — no other upload, and nothing that identifies you), over an encrypted connection. OpenAI keeps the prompts and the images it receives and makes for up to 30 days to monitor for abuse, then deletes them unless the law requires it to keep them longer, and does not use data sent through its API to train its models. When a sticker pack is added to Telegram, it may also receive the words of stickers (their names and captions) to choose their emoji.
• GPU provider for the AI background remover and, when our image provider is unavailable, the AI logo generator (Modal Labs, Inc., United States): only for images you send through the “Subject (AI)” mode and for logo requests described in section 4 that OpenAI could not take (the prompt built from your brief and, for a refinement, the generated logo you chose or the reference image you attached to the request — no other upload, and nothing that identifies you). The request travels over an encrypted connection to a server that runs the model in memory and returns the result; Modal passes the request and the response straight through without storing them, our server there keeps no copy and logs only sizes and timings, and neither Modal nor we use them to train any model.
• Telegram (telegram.org): only when you choose Add to Telegram on a sticker pack: the stickers and the words described in section 4, sent to the Telegram account that started our sticker bot. Telegram is not our processor: it holds the sticker set it makes for you as an independent service, under its own terms and privacy policy.
• Payment processor and merchant of record (Stripe / Link): to sell and collect payment for credits and plans, calculate and remit taxes, send receipts and invoices, and handle payment-related support, refunds and disputes. Stripe acts as an independent controller of the data it collects at checkout.
• E-mail delivery providers: to send transactional e-mail such as sign-in and support messages.
• Analytics providers: only when you have accepted optional analytics cookies, using pseudonymous identifiers.

Connecting an AI agent adds no one to this list: the agent is not one of our providers. What your agent receives from us — answers, previews and the files it downloads — goes to that agent and to the company that runs it, under your own agreement with them.

A current list of our sub-processors is available on request at privacy@nothingbutmeow.com.

6. Data retention

• Guest files: deleted after 24 hours; guest sessions expire shortly after.
• Account files: deleted after 30 days, earlier if you delete them.
• Logo studio: each generated logo 30 days after it was made; a brief and the prompts built from it 30 days after you wrote it or after the last logos were made from it, whichever is later; earlier if you delete the logo, the project or your account.
• Sticker packs added to Telegram: the Telegram user ID and the set's name are deleted with the pack (when it expires or you delete it) or with your account; the sticker set in Telegram stays until you delete it there.
• Palettes: kept until you delete them or your account.
• AI agents: a file an agent uploads is deleted 24 hours after it arrives; a conversion of it, or a logo or set drawn from it as a reference, keeps its own copy, like one made in your browser. If we refuse a file, we keep only its name and the reason (for 24 hours, and in the record of the agent’s request). A file made for an agent to download (one size, color or variant) is kept as long as the work it was made from, up to the 400 most recently used in your account; a ZIP is kept for 24 hours. Upload and download links stop working after 15 minutes. The record of an agent’s request (with the names of its files and why one was refused) is deleted after 30 days. Revoking a key immediately deletes the files uploaded with it and its download links; deleting your account deletes them, and the records of your agents’ requests, with it. A revoked key never works again, and its record (its name, first characters, one-way code, permission and dates) is deleted 90 days after you revoke it; deleting your account erases the names of your keys immediately. A key’s id and first characters (never its name) stay in our security records, with the answers an agent gave with it on your behalf, the names it changed and what it deleted.
• Account data: retained until you delete your account. We complete verified deletion requests within the timeframes required by applicable privacy laws (in any event within 90 days).
• Payment records: retained up to 7 years where required by tax and accounting regulations, in anonymized form after account deletion. These contain no image content.

7. Your rights and choices

Depending on your jurisdiction (GDPR, CCPA, etc.), you may have the right to access, correct, export, or delete your personal data. You can export your data and delete your account at any time from your account settings. For purchases sold through Link, you can also ask Stripe to delete the data held for those transactions and the associated Link account (Link support). For all other requests, e-mail privacy@nothingbutmeow.com.

You can withdraw your analytics consent at any time from the cookie settings in the footer.

8. Children’s privacy

The Service is not directed to children under 13. We do not knowingly collect data from children under 13.

9. Security

We use industry-standard security measures including TLS encryption in transit, encryption at rest, sandboxed processing of uploads and access controls. No method of transmission is 100% secure.

10. Changes to this policy

We may update this Privacy Policy. We will notify you of significant changes by e-mail or a notice on the Service. Continued use after the effective date constitutes acceptance.

11. Contact

Nothing But Meow LLC
E-mail: privacy@nothingbutmeow.com

Seller

Nothing But Meow LLC
US
legal@nothingbutmeow.com

Prices exclude tax; applicable taxes are shown at checkout.