Privacy Policy | SVGMaker

1. What this policy covers

This Privacy Policy explains what personal data SVGMaker collects, why, and how it's handled when you use SVGMaker, an AI SVG generator, vectorizer, converter and editor at svgmaker.org.

SVGMaker is operated by a company registered in England and Wales, and is the "controller" of your personal data. That means SVGMaker decides what data is collected and why, and is responsible for looking after it under the UK GDPR and the Data Protection Act 2018.

2. Some of your files never reach us

This is the most important thing to know about how SVGMaker handles your data. What happens to a file depends on which feature you run:

What you run	Where your file goes
Converting between SVG and PNG, JPG, WebP, PDF or favicon; tracing an image locally; cleaning up SVG source	Nowhere. The work is done by your own browser. The file is never uploaded to us and never reaches an AI provider.
AI generation, AI vectorization, background removal, prompt enhancement	Uploaded to our storage, then sent to a third-party AI provider that performs the work.
Conversion to STL, DXF, EPS, PS or AI	Uploaded to our storage and converted by our own software. No AI provider is involved.

The browser-only features in the first row also need no account, so we hold no record that you used them beyond ordinary server logs for the page itself.

3. Information we collect

Account information. When you sign in with Google, SVGMaker receives your name and email address, and creates an account identifier for you.

Files you supply. For the features in rows two and three of the table above, we receive the image or SVG you supply and the prompt you write. Prompts are free text — please do not put personal information into a prompt that does not need to be there.

Generated output. SVGMaker creates and stores the files produced for you.

Usage and technical data. Like most web services, our servers log information such as your IP address, browser and device information, and pages you visit.

Billing records. We keep a record of your purchases and credit balance. Full card numbers are handled directly by our payment processor and are not stored by SVGMaker.

4. Why we process your data

SVGMaker processes your data on these legal bases under UK GDPR Article 6:

Performance of a contract (Art. 6(1)(b)) — creating your account, running the jobs you request, and managing your credits and subscription.
Legitimate interests (Art. 6(1)(f)) — keeping the service secure, preventing abuse and fraud, enforcing rate limits, and understanding usage through server logs. We balance this against your rights and use the minimum data needed.
Consent (Art. 6(1)(a)) — for optional communications, such as a newsletter you choose to sign up for. You can withdraw consent at any time.
Legal obligation (Art. 6(1)(c)) — keeping records required by tax and accounting law.

5. Files sent to AI providers

For AI generation, AI vectorization, background removal and prompt enhancement, the file you supply and any prompt you provide are transmitted to third-party AI providers, who perform the actual work. SVGMaker does not run these models itself. Only what is needed for that job is sent, and it is sent for that purpose only.

We do not use your files, prompts or generated output to train AI models, and we do not permit our providers to use them for that purpose.

SVGMaker uses the following categories of service providers to operate:

Cloudflare — hosting, database, file storage, and in some cases transactional email.
AI providers — to perform the work described in section 5.
Payment processor — to process your purchases. It receives your payment details directly; SVGMaker does not store full card numbers.
Email providers — to send transactional email such as account or billing notices, and a newsletter if you opt in.
Google — to authenticate your sign-in.

We may also disclose data where we are legally required to, or to establish or defend legal claims. If the service changes hands, account data may transfer as part of that business, and this policy continues to apply until you are told otherwise.

SVGMaker does not sell your personal data, and does not share your files or generated output with advertisers or data brokers.

7. Sending data outside the UK

Some of these providers process data outside the UK, including in the United States. When personal data leaves the UK, SVGMaker relies on one of the transfer mechanisms UK data protection law allows: either the country has been judged by the UK government to offer adequate protection, or the transfer is covered by the UK's International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses), together with checks appropriate to the transfer.

If you would like more detail about the safeguards used for a particular provider, contact us.

8. How long we keep your data

Generated output: 30 days. Files produced for you stay available in your account for 30 days and are then deleted automatically. Download anything you want to keep.

Account and billing records: kept while your account is active, and afterwards for as long as tax and accounting law requires.

Server logs: kept for a short period for security and troubleshooting.

Reward fairness records. If you take part in the daily or invitation reward programme, we keep limited records needed to apply its eligibility and anti-abuse rules. These can include purpose-separated, irreversible keyed hashes derived from your email address, network address, or a random browser identifier; the reward decision and reason; and anonymous invitation-graph nodes used to prevent invitation loops. We do not store the raw email address, network address, or device characteristics in these reward records. Most signals expire within 90 days. Short-lived invitee network and repeated-attempt signals expire after 24 hours. An inviter's random browser anchor remains while the invitation is active, because removing it earlier would disable the self-invitation check; it is removed after the invitation is completed, revoked, or detached and the 90-day retention window has passed.

Limited records that survive account deletion: up to 90 days. When you delete your account, we retain a purpose-separated irreversible hash of your email address to stop immediate re-registration for sign-up or invitation rewards, plus any de-identified invitation-graph node needed to prevent reward loops. Sign-up eligibility records and their network or random-browser-identifier hashes are deleted with the account. The retained records contain no account ID, name, raw email address, raw network address, or device characteristics; they cannot be used to contact you, and they are automatically deleted when the 90-day period ends. The email hash used for deletion cooldown is cryptographically separated from the email hash used for invitation checks, so those two datasets cannot be joined by equality.

If you delete your account, SVGMaker removes your stored data through an automated cleanup process. That process is designed to fail closed — if any required step does not complete successfully, your account is not marked as deleted. The limited, time-bound reward fairness records described above are deliberate exceptions. Reward eligibility rows that contain your account ID are deleted; financial ledger and lot records are retained only in anonymised form where required for balance integrity and audit.

9. Your rights

Under the UK GDPR you have the right to:

Access the personal data SVGMaker holds about you, and get a copy of it.
Correct data that is wrong or incomplete.
Erase your data ("right to be forgotten") — you can do this yourself by deleting your account. A narrow exception applies to the purpose-separated, irreversible reward fairness records described in section 8. They are retained for no more than 90 days after deletion, contain no account ID or raw identity data, and cannot be used to contact you.
Restrict or object to processing based on legitimate interests.
Port your data — receive it in a portable format, or have it sent to another provider.
Withdraw consent at any time, where processing is based on consent (such as a newsletter).

To exercise any of these rights, contact us. SVGMaker will respond within one month. Using these rights is free, and we will not treat you differently for doing so.

10. Complaining to the ICO

If you think SVGMaker has mishandled your personal data, please contact us first so it can be put right. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk or on 0303 123 1113. Complaining to us first is not a precondition — you can go to the ICO directly.

11. If there is a data breach

If a breach of personal data is likely to result in a risk to your rights and freedoms, we will report it to the ICO within 72 hours of becoming aware of it, as UK GDPR requires. If the risk to you is high, we will also tell you directly and explain what you can do.

12. Children's privacy

SVGMaker is not intended for anyone under 13. Under UK data protection law, 13 is the youngest age at which someone can consent to an online service on their own. Anyone under 18 should use SVGMaker only with a parent or guardian's permission, and purchases must be made by an adult (see our Terms of Service). SVGMaker does not knowingly collect personal data from children under 13 — if you believe a child has created an account, please contact us so it can be removed.

13. Security

SVGMaker transmits data over encrypted connections and uses access controls to limit who can reach stored data. Generated files are served through authenticated routes rather than public links.

Because SVG is an executable document format, SVGMaker strips scripts, event handlers and external references from SVG content before storing or serving it, and serves it with response headers that prevent it executing in your browser.

No method of transmission or storage is completely secure, but SVGMaker takes reasonable steps to protect your information.

14. Changes to this policy

SVGMaker may update this Privacy Policy from time to time. Changes will be posted on this page with a new date at the top, and continuing to use the service after an update means you accept the revised policy.

15. Contact

For any privacy question or to exercise your rights, contact us.