Last updated: November 6, 2026
Vormly is operated by Vormly AI Labs LLC, a Wyoming limited liability company registered at 30 N Gould St Ste R, Sheridan, Wyoming 82801, USA. That company is the one responsible for the personal data described below — the controller, in the language of data protection law — and "we" and "us" on this page mean it. Privacy questions, access requests and deletion requests all reach us at support@vormly.ai, or by post at the address above.
We collect the information you provide when creating an account (name, email) and the content you create with the service (prompts, generated images, video and audio). When you buy something we keep the transaction record — what was bought, the amount, the payment status, and the processor's reference ids — but never card numbers, which stay with the payment processor. We also record technical information that arrives with every request: your IP address, the country it resolves to, and your browser's user-agent string. Sign-ins are logged with the IP and country they came from. We do not collect precise location — the country is derived from the IP by our infrastructure provider and is no more specific than that. We do not collect sensitive personal data beyond what the service needs. Vormly is not directed at children: the service requires you to be 18 or older, and we do not knowingly collect personal information from anyone under 18 — if we learn that we have, we delete it.
Your information is used to provide and improve Vormly, process your generations, manage your account and credits, and send you important updates. IP addresses and sign-in records are used to keep accounts secure and to detect abuse of the free tier. Country is used in aggregate to understand where our users are and to shape regional availability and pricing. Google Analytics and Google Ads measurements are used to understand which channels and campaigns bring people who find Vormly useful, and to decide where to advertise. Microsoft Clarity session recordings and heatmaps are used to see where pages confuse people or break, so we can fix them. We do not sell your personal data to third parties.
Your data is stored on Cloudflare's global infrastructure, encrypted in transit and at rest. Generated files are stored in Cloudflare R2 with access controlled by your account. Sign-in records are kept only as long as the session itself: sessions expire after seven days and expired records are removed. Account information is kept until you delete your account.
Generation requests are processed by third-party AI providers — including Google, OpenAI, ByteDance, Kuaishou, Alibaba, MiniMax, xAI, Black Forest Labs and Suno. Your prompt and any reference files you upload are sent to the provider that runs your request, and may be routed through infrastructure partners we use to reach those providers; a current list of these partners is available on request at support@vormly.ai. Payments are processed by Stripe or by Waffo Pancake, a merchant of record; we never see or store your card details. Sign-in with Google uses Google's OAuth service. Our support chat is provided by tawk.to: it loads only once you interact with the page, and when you start a conversation the messages you send — together with the account details we attach so we can answer without asking you to recite them (your name, email, plan and credit balance) — are processed by tawk.to on our behalf. Cloudflare provides our hosting, storage, email delivery and bot protection, and therefore processes your IP address on our behalf — and, for the emails we send you, your email address. Google Analytics and Google Ads, both provided by Google, measure where visitors come from and whether a visit or an ad click led to a sign-up, a trial or a purchase. When a visit that began with a Google ad leads to a sign-up or a trial, the Google Ads tag in your browser records that. When you start a trial, buy a plan or a credit pack, or are charged for a renewal, and when a payment is refunded, our server reports that transaction to Google Analytics: the plan or pack, the amount and currency, the payment processor's reference for the charge, whether it was a first payment, a trial conversion or a renewal, and the pseudonymous Google Analytics identifier your browser carried when you opened the checkout (or, if Google Analytics never loaded in your browser, a pseudonymous identifier derived from your account). If you came to Vormly from a Google ad, your first payment, and any refund of it, is also reported to Google Ads against that ad's click identifier, so we can tell which ads lead to paying customers. None of these reports include your name, your email address or your card details. We have set Google Analytics to keep event-level data for two months. How Google uses data from sites that use its services is described at policies.google.com/technologies/partner-sites. On vormly.ai we also use Microsoft Clarity, provided by Microsoft, to understand how visitors use the site through behavioral metrics, heatmaps and session replay: it records how you move, click and scroll and what the page showed you, and masks fields that hold sensitive information, such as passwords and email addresses, before the recording leaves your browser. Microsoft also uses this data for its own purposes, including advertising and fraud and security protection, as described in the Microsoft Privacy Statement at privacy.microsoft.com/privacystatement.
We use essential cookies for authentication and session management, and local storage for preferences such as your theme, sidebar state and recent work. We also set a few first-party cookies of our own: vfy_aid, a random device identifier (kept for a year) that ties together our own usage records and applies free-tier limits; vfy_attr, which remembers the link or campaign that first brought you to Vormly (kept for a year); pixflow_ref, which remembers an invitation link you followed (kept for 30 days); and, when you arrive from a Google ad, vfy_gclid, which keeps that ad's click identifier (kept for 90 days). On vormly.ai we also run two Google tags: Google Analytics 4, which sets the _ga and _ga_* cookies to measure visits, and Google Ads, which may set its own conversion cookies (for example _gcl_aw) when you arrive from an ad. Both run with ad personalization switched off: we use them to measure our own site and our own campaigns, not to build an advertising profile of you. We also run Microsoft Clarity, which sets the first-party cookies _clck and _clsk to group the pages of a visit, and may set Microsoft's own cookies (for example MUID). You can block or delete these cookies in your browser settings, or install Google's Analytics opt-out browser add-on at tools.google.com/dlpage/gaoptout; Vormly keeps working without them.
When we email you, links in that message carry an identifier so we can record that the message was clicked. It tells us which emails are useful and which ones to stop sending. We do not use tracking pixels, so we cannot and do not detect whether you opened an email. Every non-essential email carries an unsubscribe link, and unsubscribing takes effect immediately.
You can access, update or delete your account data at any time from your account settings, and export the files you have generated. Deleting your account removes your profile, your content and the sign-in records attached to it. To request a copy of your data or complete deletion, contact us at support@vormly.ai.
We may update this privacy policy from time to time. We will notify registered users of significant changes via email. Continued use of Vormly after changes constitutes acceptance of the updated policy.
Questions about privacy? Contact us at support@vormly.ai