Privacy Policy

This policy applies to VU Lab’s website, accounts and creator tools. VU Lab is an independent third-party creator service and is not affiliated with, endorsed by, sponsored by, operated by or part of IMVU.

VU Lab separates server account records from projects kept in your browser. Signing in does not turn browser-local projects into cloud backups.

When you register, VU Lab stores your normalized email address, display name, account identifier, account role, account status and email-verification timestamp, together with creation and update timestamps. New public accounts receive a FREE entitlement but cannot use creator tools until email verification is complete.

Registration also stores separate server-authoritative acceptance records containing the account ID, acceptance timestamp and version identifiers for the Terms of Use and Privacy Policy. This evidence supports future renewed acceptance if a policy changes materially. Account roles may include user, admin and owner; Owner Permanent Pro is an internal administrative grant, not a purchasable subscription.

VU Lab uses your email address to send the required account-verification message and security or account communications. The verification URL contains a cryptographically random token, not a password, session, role or entitlement claim. VU Lab stores only a SHA-256 hash of that token with the account ID, creation time, 24-hour expiry and optional consumption time.

Successful activation atomically records the account verification time and consumes the token. Requesting a resend uses persistent pseudonymous rate limits and invalidates prior outstanding verification tokens. The response is deliberately generic so an arbitrary email-address probe does not reveal whether an account exists. Temporary delivery failure does not create a duplicate account; the user can safely request another message.

VU Lab uses password authentication. Passwords are not stored in plaintext. The server stores a salted scrypt password hash and a password-provider subject associated with the account.

VU Lab does not ask for or use IMVU passwords, IMVU cookies or IMVU session credentials.

After a successful sign-in by a verified account, VU Lab sets one essential opaque session cookie named vu_lab_session. It is HTTP-only, uses SameSite=Lax, is marked Secure in production, applies across the site and has a maximum lifetime of 14 days. The server stores only a SHA-256 hash of the session token with the account ID and creation and expiry times.

Signing out revokes the current server session and clears that cookie. Expired sessions are deleted during session checks. VU Lab does not currently use analytics, advertising or other non-essential tracking cookies, so no cookie-consent banner has been added for the implemented service.

For VU Lab Pro checkout, VU Lab selects the approved fixed ZAR payment amount from trusted server-side pricing, signs an account-bound checkout confirmation, and sends Paystack the account email address, exact ZAR amount, a unique payment reference, callback URL and metadata containing the VU Lab account ID and canonical plan ID. USD prices are reference prices only. Paystack hosts the payment form and processes payment credentials; VU Lab does not receive or store full card or bank details.

VU Lab stores checkout and payment-event identifiers, the VU Lab account and plan binding, amount, currency, Paystack customer identifier where returned, event/payment status, received and processed times, and the resulting FREE or PRO entitlement state, start and end times and last verified payment reference. Signed webhook data is checked against a server-to-server Paystack verification response before paid access is granted.

Public login and registration use persistent abuse controls to prevent automated signup, password guessing, credential stuffing and high-frequency authentication traffic. VU Lab creates keyed HMAC digests for normalized account identifiers, trusted network identifiers and account/network pairs. Separate HMAC domains prevent the same raw value from producing the same digest for different identifier types.

The abuse table stores only the action, scope, 64-character keyed digest, window start, attempt count, optional block-until time, expiry and update time. It does not store raw IP or network addresses, plaintext email addresses, attempted passwords, password hashes, session tokens, user-agent strings, human-verification tokens or Turnstile responses.

Retention is rule-bounded: short request buckets expire after 1–2 hours, login-failure buckets after 2–24 hours, and daily registration buckets after no more than 48 hours. Expired rows are deleted opportunistically and can also be removed by scheduled database maintenance.

Registration can be configured with no external human-verification provider or with Cloudflare Turnstile. When Turnstile is disabled, VU Lab does not send registration verification data to Cloudflare.

When Turnstile is enabled, the registration page obtains a verification token and VU Lab sends Cloudflare that token, VU Lab’s secret verification key and, when a trusted address is available, the visitor’s network address. VU Lab checks the returned success, action and hostname values but does not persist the token or Cloudflare’s verification response.

Shop Studio

Shop Studio saves a versioned draft in your browser’s localStorage when the project contains meaningful work. The draft can include the collection name, notes and product IDs, names, image URLs, product URLs and featured selection. Starting over removes that browser record.

Range Builder

Range Builder similarly saves its range name, notes, product details and complete-look groupings in localStorage. Starting over removes that browser record.

Range Builder and Shop Studio can download versioned JSON project backups and restore them after strict local validation. Imported files replace meaningful current work only after confirmation. The files are read in the browser and are not uploaded to VU Lab.

These localStorage records remain on that browser profile until you clear them, clear site data or the browser removes them. They are not uploaded to the VU Lab account database, are not synchronized across devices and are not cloud backups.

The Shop Studio → HTML Lab handoff uses sessionStorage. Range Builder → HTML Lab and Product Inspector or Range Builder → Catalog Image Maker use the same short-lived browser-session approach. Each handoff contains only the mapped project or allowlisted public product details needed by the destination, is valid for up to 15 minutes and is removed when consumed. Browser session storage may also be cleared when the tab or browsing session ends.

HTML Lab keeps its current Product Page Builder project in sessionStorage so meaningful work can be protected when a creator collection arrives during the same browser session. Image Lab, Catalog Image Maker, Range Builder contact-sheet output, GIF Lab, Music Cutter, Snapshot Studio, Shop Studio banner editing and the current Spotlight image preview process selected files or public images through browser memory, canvas, audio APIs or temporary object URLs. The implemented tools do not upload those selected local files to a VU Lab file-storage service. Remote image hosts receive ordinary browser image requests and may block Canvas export through cross-origin restrictions. Temporary data is lost when it is reset, released or the page/session ends unless you download an export yourself.

When you request a public creator or product lookup, VU Lab sends the username, creator ID, product ID or supported public URL needed to perform the request to VU Lab’s server. The server requests publicly available profile, product, lineage, image or productdata information from IMVU endpoints. Responses may be cached for short technical intervals under the application’s framework cache settings.

Returned public information can include names, public IDs, profile and product images, creator status, public profile details, product metadata, ownership information and derivation relationships. VU Lab does not use private IMVU credentials to perform these lookups.

Product Extractor requires a signed-in account with PRO access. In hosted production, it accepts an IMVU product ID and operation mode, then uses approved public IMVU product and productdata sources to return product details, derivation relationships or eligible texture resources. Server memory may temporarily contain downloaded public manifests and resource bytes while a request is processed.

The hosted extractor does not read a subscriber’s IMVU Studio projects, browser IndexedDB, Downloads folder, local Studio cache or other local files. Explicitly enabled local-development and fixture providers can read configured private server-side paths, but those providers are blocked in production and cannot be selected by supplying a filesystem path in a request.

Radio Studio sends search and station identifiers to VU Lab, which queries the public Radio Browser directory. Playing a station causes your browser to connect directly to that station’s stream host, so the station operator can receive ordinary connection information such as your network address and browser request details.

VU Lab can ask a station host for a bounded sample to validate a public stream, and it notifies Radio Browser when a listed station is played. If you submit your own public stream URL for checking, VU Lab temporarily processes that URL and destination hostname to validate it; the implemented checker does not create a persistent database record.

Promoted Creators and Creator Spotlight bookings store the customer account ID, campaign text, IMVU creator and product identifiers, destination links, selected duration, allocated position, quoted USD and ZAR amounts, payment reference and lifecycle timestamps in the VU Lab database. Uploaded advertising images are validated and stored durably for public display while a campaign is active.

Paystack supplies transaction and customer identifiers used to independently verify payment. Advertising payment records are separate from VU Lab PRO billing. Resend receives the customer email address and campaign message content for payment confirmation, activation and expiry notices. Owner-only moderation records may include a suspension timestamp and reason.

Account and entitlement records are retained while the account is maintained and as needed to operate or secure it. VU Lab has not implemented a self-service account-deletion endpoint. Session and anti-abuse retention are described above. Browser-local projects remain under your browser’s storage controls until you clear them or use the relevant Start Over action.

Account deletion, access or correction requests can be sent through the contact method below. VU Lab will not invent a fixed retention period for account records or future payment records before an approved operational schedule exists.

VU Lab uses server-only database credentials, salted password hashing, hashed session tokens, HTTP-only cookies, same-origin checks for account mutations, entitlement checks, production fail-closed storage behavior, persistent rate limits and bounded external requests. No internet service can guarantee absolute security, and users should use a unique password and protect access to their devices and email accounts.

You can sign out to revoke the current session and use creator-tool reset controls or browser site-data controls to remove browser-local drafts. Depending on the law that applies to you, you may have rights to request access, correction, deletion, restriction or objection concerning personal information.

Send privacy or account-data requests to support@vu-lab.com. VU Lab may need to verify that a requester is entitled to act for the account.

Current external services include Neon/PostgreSQL infrastructure for production account and billing-event storage, Vercel or another configured hosting/proxy environment, Paystack for hosted payment processing, optional Cloudflare Turnstile, IMVU public endpoints, Radio Browser and independent radio stream hosts. Links to external providers or other sites lead to services with their own terms and privacy practices.

These services and their infrastructure may process data in countries other than your own. The repository does not establish VU Lab’s business location or promise a particular data-hosting country, so this policy does not make an unsupported data-localization claim.

VU Lab accounts are for users aged 16 or older. Users who are under the age of majority where they live may use VU Lab only where permitted by applicable law and with any consent from a parent or legal guardian required by that law. Users are responsible for meeting the account eligibility requirements in the Terms of Use.

VU Lab does not currently ask for or store a date of birth solely to create an account, does not request identity documents for age checks and does not perform identity-based age verification. Optional Turnstile processing is an anti-abuse measure, not age verification. VU Lab does not classify creator projects or vary creator-tool permissions based on project content.

When you submit a support request, VU Lab stores your submitted name, email, category, subject and message, plus a unique reference, status and timestamps. A request is linked to an account only if you were signed in at submission. Guest requests are not automatically linked by email. Only authorized support administration can review the full message; signed-in customers can see the reference, subject, date and status of their own requests. Support messages are not public.

A keyed digest of the network address and submission time is stored for submission throttling. The system attempts to notify the support mailbox and send an acknowledgement to your submitted email through Resend; email delivery can fail without deleting the saved request. Do not submit passwords, session cookies or payment-card or banking security details. File attachments are not currently accepted.

VU Lab may update this policy when the service, providers or legal obligations change. Material changes should be posted here with a revised update date.