Privacy policy

Controller

Paul-Antoine Boit, 58 bis rue des Amidonniers, 31000 Toulouse, France. Contact for any question about your data: [email protected].

Data we use

• Account: email, identifier, and name and profile picture if you sign in with Google.
• Photos you upload and videos generated for you. Photos show faces: they are personal data, yours and that of the people you add.
• Generations: trend, model, quality, length, credits used, status.
• Purchases: product, amount, date, status and Stripe references. We never see or store your card numbers.
• Security: server logs (IP address, browser, date), results of the automated photo checks (scores and refusal reason, without the image).

Why, and on what basis

• Providing the service (account, generating and keeping your videos): performance of the contract.
• Payments, invoices and accounting: performance of the contract and legal obligation.
• Automated photo check before generation (nudity, people who appear to be minors): legitimate interest in protecting people, minors in particular, and preventing illegal content.
• Security and fraud prevention (consistency of credits and costs, alerts): legitimate interest.
• Marking videos as AI-generated (invisible watermark and metadata): legal obligation (EU AI Act).
• Audience measurement: only with your consent. No analytics or advertising tool is used today.

Automated decisions

A photo can be refused and an account suspended automatically (see the terms, section 5). You can contest the decision by writing to [email protected].

Who receives your data

• Supabase (accounts, database, private storage of photos and videos). Servers: Frankfurt (DE).
• Railway (website hosting, video trimming and marking). Servers: Amsterdam (NL).
• Sightengine (automated photo check before generation).
• fal.ai, Features and Labels, Inc., United States (Lupoka V1 and V2 video generation). fal forwards the request to the provider of the Kling model (Kuaishou).
• BytePlus, Singapore (Lupoka V3 video generation, Seedance model).
• Stripe (payments).
• Google, if you choose to sign in with Google.
• Telegram (internal security alerts: account identifier, and IP address for administrator accounts).
• These providers act on our behalf and only receive what their task requires. Your photos are only sent to the automated check and to the model you choose. Authorities may receive data when the law requires it.

Transfers outside the European Union

Some providers are located outside the European Union (United States, Singapore, and the provider of the Kling model). These transfers rely on the European Commission's standard contractual clauses or, for certified US companies, the EU–US Data Privacy Framework. You can get a copy by writing to us.

How long

• Uploaded photos: deleted 30 days after upload.
• Generated videos: deleted 365 days after creation, or earlier on request or when the account is closed.
• Account and history of generations and credits: until the account is closed.
• Invoices and accounting data: 10 years, as required by law.
• Photo refusals (without the image) and security alerts: 365 days.
• Server logs: a few weeks at most, depending on the host.
• At the generation providers: for the time of the generation, then according to their own retention period.

Your rights

• You can access, correct and delete your data, restrict its use, object to processing based on legitimate interest, get it in a readable format (portability), withdraw your consent at any time and give instructions for after your death.
• Write to [email protected] from your account email. We reply within one month.
• You can also lodge a complaint with the CNIL (www.cnil.fr) or your local data protection authority.

Cookies

We only use what the site needs to work: your account's session cookies, and your language and cookie choices stored in your browser. No advertising or analytics cookie is set. If we add any, it will only be with your consent.