Privacy Policy for Image to Video AI Services

1. Data controller

This Privacy Policy explains how the operator of Image to Video ("Image to Video," "we," "us," or "our") handles personal information when you visit imagetovideo.org, create an account, purchase credits, contact support, or use our image generation, image editing, and image-to-video services (the "Service").

The Service is publicly identified by the Image to Video service name. The official privacy and support contact is support@imagetovideo.org. No separate data protection officer has been appointed. This policy is separate from our Terms of Service and Acceptable Use Policy.

2. Personal information we collect

2.1 Information you provide

• Account information: Name, email address, authentication records, account preferences, and information received from Google or GitHub if you choose an enabled third-party sign-in option.
• Creative content: Source images, reference images, text prompts, model and generation settings, generated or edited images and videos, and related task metadata.
• Transaction information: Credit pack, amount, currency, payment status, transaction identifiers, billing contact, and tax information when required. We do not store complete payment-card numbers or payment-account credentials.
• Communications: Support emails, tickets, attachments, feedback, privacy requests, and other correspondence you send us.

2.2 Information collected automatically

• Device and network information: IP address, browser and device type, operating system, language, time zone, referring page, and similar compatibility and security data.
• Service activity: Pages visited, features used, generation and credit events, approximate timestamps, task status, error and performance logs, and abuse or fraud signals.
• Cookies and local storage: Session, security, language, theme, consent, and preference data, plus analytics or advertising identifiers when those optional services are enabled and may lawfully operate.

Please do not upload confidential information, unnecessary sensitive personal data, or media that you do not have the right and permission to process.

3. How and why we use personal information

We process information for the following purposes and legal bases, where those concepts apply:

• Provide and maintain the Service: Create accounts, authenticate requests, run generations, store history, deliver downloads, and maintain credits as necessary to perform our contract with you.
• Billing and payments: Process purchases, prevent duplicate transactions, issue receipts, and manage refunds as necessary to perform our contract and meet legal obligations.
• Customer support: Answer questions, investigate failed tasks, and process requests based on our contract and legitimate interests in supporting users.
• Safety, fraud prevention, and enforcement: Protect accounts, detect abuse, moderate content, enforce policies, and preserve platform integrity based on legitimate interests and legal obligations.
• Service notices: Send billing, security, operational, and policy messages based on our contract, legitimate interests, or legal duties.
• Analytics and improvement: Understand aggregated feature use and improve reliability based on legitimate interests or consent where required.
• Marketing: Send optional product communications only with the consent or other lawful basis required in your location. You may opt out at any time.

We may aggregate or de-identify information for statistics and service planning. We do not attempt to re-identify properly de-identified information.

4. Cookies and tracking technologies

• Strictly necessary technologies keep you signed in, protect requests, remember the active locale, record consent, and provide core functionality. Disabling them may prevent the Service from working.
• Functional technologies remember theme and interface preferences and can generally be removed through browser or site controls.
• Analytics technologies may include Google Analytics, Plausible, or Umami when enabled. They help measure visits and feature use and are optional where consent is required.
• Advertising technologies may be used when advertising integrations are enabled and only as permitted by your consent and applicable law.
• Support technologies may include Crisp or Tawk when enabled so that you can contact customer support.

You can use the site's cookie control or your browser settings to accept, reject, or remove optional technologies. Browser controls may not affect information already lawfully processed.

5. Sharing and disclosure

We do not sell personal information, including as "sale" is defined by applicable privacy laws. We disclose only information reasonably necessary for these purposes:

• AI providers and routing services: fal.ai, Replicate, and the provider of the selected model process prompts, source media, settings, and generated output to complete your request.
• Storage and infrastructure: Configured S3-compatible or Cloudflare R2 storage, hosting, database, security, and delivery providers process files and operational data.
• Authentication, email, analytics, and support: Google, GitHub, Resend, Google Analytics, Plausible, Umami, Crisp, or Tawk process relevant information only when the corresponding integration is enabled or used.
• Payment processors: The processor selected at checkout, which may include Waffo Pancake, Stripe, PayPal, Creem, Alipay, or WeChat Pay, processes payment credentials and transaction information. Complete card details do not pass through or remain on our servers.
• Legal and safety disclosures: We may disclose information to comply with law or valid process, investigate misuse, protect a person from harm, enforce agreements, or protect the rights and security of the Service and its users.
• Business transactions: Information may transfer in a merger, acquisition, financing, reorganization, or sale, subject to appropriate notice and continuing safeguards.

6. Data security

We use reasonable administrative, technical, and organizational measures, including HTTPS encryption in transit, hashed authentication credentials, access controls, secret management, provider access restrictions, and service monitoring. Sensitive configuration values may be encrypted at rest when the configured encryption feature is enabled.

No online service can guarantee absolute security. Protect your credentials and contact us if you suspect unauthorized access. If a security incident creates a legally reportable risk, we will notify affected users and authorities within the period required by applicable law, including a 72-hour regulatory period where that rule applies.

7. Data retention

We retain information according to its purpose and legal requirements:

• Account and authentication data: While the account is active. After a verified deletion request, we aim to delete or anonymize eligible account data within 30 days; residual backup copies may remain for up to 90 days.
• Creative content and generation records: While needed to provide history and downloads. After a verified deletion request, eligible stored media and task data are scheduled for deletion within 30 days, subject to provider deletion cycles and legal holds.
• Transaction and credit records: Up to 7 years, or the different period required for accounting, tax, fraud prevention, chargebacks, and legal compliance.
• Support and privacy correspondence: Up to 2 years after the matter closes, unless needed longer for a dispute or legal obligation.
• Security and technical logs: Normally up to 12 months, unless a longer period is needed to investigate abuse, protect the Service, or comply with law.

Deletion from a visible history may not immediately remove copies from backups, security logs, payment records, or a provider's systems. We delete, anonymize, or restrict those copies according to the applicable retention cycle.

8. Your privacy rights

Depending on your location, you may have rights to be informed; access and obtain a copy; correct inaccurate data; delete data; restrict processing; receive portable data; object to processing based on legitimate interests or marketing; withdraw consent; and appeal or complain to a privacy regulator.

Send a request from your account email to support@imagetovideo.org with the subject Privacy Request. State the right you wish to exercise and the relevant account or data. We may verify identity and will respond within 30 calendar days, or within a different period required by applicable law. Some information may be retained or withheld where an exemption applies, including transaction, security, fraud-prevention, and legal records.

9. Marketing communications and opt-out

Where permitted, we may send product news or offers to users who have opted in or where another lawful basis applies. You may unsubscribe using the link in a marketing email or by contacting us. Opting out of marketing does not stop necessary account, generation, billing, security, support, or policy notices.

10. International data transfers

Our providers may process information in countries other than where you live. Where required, we use appropriate safeguards such as adequacy decisions, data-processing agreements incorporating Standard Contractual Clauses, and assessments or supplementary measures designed to protect transferred information. Privacy rules may differ between jurisdictions.

11. Children's privacy

The Service is intended only for users aged 18 or older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided information, contact us so we can investigate and delete it where required. Any suspected child-unsafe content is handled under our zero-tolerance AUP and may be reported to competent authorities.

12. Third-party links and services

The Service may link to or integrate third-party websites and services. This policy covers information we control, not the independent privacy practices of third parties. Review a third party's privacy terms before using its service. Third-party model and payment terms may also apply to the function you select.

13. Changes to this policy

We may update this policy as the Service, providers, risks, or legal requirements change. The date above identifies the current version. Where required, we will notify you of a material change through the Service or account email before it takes effect. Continued use after the effective date constitutes acceptance where legally permitted, but does not replace consent where consent is required.

14. Contact us

For privacy questions, data-rights requests, or complaints, contact support@imagetovideo.org with the subject Privacy Request. Include enough information to identify the account and request, but do not send passwords, complete payment credentials, illegal content, or unnecessary sensitive information.