🥑 Avocado

Last updated: 9 July 2026

Privacy Policy

Vebros (“we”, “us”, “our”) operates Avocado at avocado.vebr.no. This policy explains what personal data we collect, how we use it, and your rights under the General Data Protection Regulation (GDPR) and applicable Norwegian law.

1. Data controller

Vebros, Norway. Contact: avocado@vebr.no

2. Data we collect

  • Account data: email address, created at timestamp.
  • Generated images: images you generate and the text prompts you submit.
  • Usage data: generation count, model used, generation time, token balance and transaction history.
  • Payment data: token purchase history, saved payment method metadata (last 4 digits and card brand). We do not store card numbers — these are held by Stripe.
  • Session data: an authentication session cookie set by our login system.
  • Product analytics (only with your consent): pages visited, feature interactions, approximate device/browser and referrer, and session replays (recordings of your on-screen activity with input fields and sensitive content masked). Collected in your browser only after you accept our cookie banner. We also record a small number of server-side product events (e.g. a completed purchase, an API key or project created) tied to your account ID.

We do not use advertising cookies, tracking pixels, or ad networks, and we do not sell your data.

3. Legal basis for processing (GDPR Art. 6)

  • Contract performance (Art. 6(1)(b)): processing your email, prompts, images, and payments is necessary to provide the service you signed up for.
  • Legitimate interests (Art. 6(1)(f)): server-side product/operational statistics used to improve the service and prevent abuse.
  • Consent (Art. 6(1)(a)): in-browser product analytics and session replay (PostHog), set only after you accept our cookie banner. You may withdraw consent at any time via the banner or the controls on our Cookie Policy page.
  • Legal obligation (Art. 6(1)(c)): transaction records retained for accounting and tax purposes.

4. Third-party processors

We share data with the following sub-processors, all operating under GDPR-compliant data processing agreements:

  • MongoDB Atlas (MongoDB, Inc.) — stores account data, generation records, and token transactions. Servers located in EU region.
  • Vercel, Inc. — hosts the application and stores generated images (Vercel Blob). Data processed in the US under Standard Contractual Clauses.
  • Google LLC (Google AI Studio) — processes text prompts to generate images. Prompts are sent to Google's API. Refer to Google's API data policy for details.
  • Stripe, Inc. — processes token pack payments and stores payment method data. Stripe is PCI-DSS compliant.
  • Resend, Inc. — sends transactional emails (sign-in codes). Email addresses are transmitted to Resend only at the time of sending.
  • PostHog (PostHog, Inc.) — product analytics and session replay, hosted in the EU. Used to understand how the service is used and to improve it. In-browser analytics run only with your consent; session replays are captured with input fields and sensitive content masked.

5. Data retention

  • Account and generation data: retained while your account is active and for 90 days after deletion.
  • Payment records: retained for 5 years for legal/accounting obligations.
  • Session cookies: expire when you close your browser or after 30 days.

6. Your rights

Under GDPR you have the right to:

  • Access the personal data we hold about you.
  • Rectification of inaccurate data.
  • Erasure (“right to be forgotten”) — request deletion of your account and data.
  • Portability — receive your data in a machine-readable format.
  • Restriction of processing in certain circumstances.
  • Object to processing based on legitimate interests.

To exercise any of these rights, email avocado@vebr.no. We will respond within 30 days. You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) at datatilsynet.no.

7. Cookies

We use an essential session cookie and, with your consent, non-essential analytics cookies (PostHog). We show a consent banner on your first visit and you can change your choice at any time. See our Cookie Policy for details.

8. Changes to this policy

We may update this policy when the service changes. Material changes will be communicated by email. Continued use of the service after the effective date constitutes acceptance.

9. Contact

Questions or requests: avocado@vebr.no