Privacy policy

Data we collect

Account data: your email address, name and profile picture (from Google if you sign in with Google), and a hashed password if you use email sign-in.

Inputs and outputs: the prompts, settings and any files you submit, and the results generated for you.

Purchase data: what you bought, amount, currency, order and payment IDs and payment status. Full card numbers are not stored by us; card data is processed by our payment processor.

Usage and technical data: credit balance and history, moderation decisions about your content, IP address, browser and device information, and, only if you accept analytics cookies, page views and interactions.

Support data: the contents of emails you send us.

How we use it and legal basis

To provide the service, generate and deliver your results, keep your credit balance and process purchases and refunds (performance of a contract). To screen content, prevent fraud and abuse, enforce our policies and keep the service secure (legitimate interests and legal obligations). To keep tax and accounting records (legal obligation). To understand how the site is used and improve it with analytics (your consent, which you can withdraw at any time). To send transactional emails such as sign-in and purchase confirmations (contract). We only send marketing emails if you opt in, and every marketing email has an unsubscribe link. We do not use your inputs to train AI models, and we do not sell your personal data.

Sharing and service providers

We share data only with providers that help us run the service, each for its own purpose: Vercel (hosting), Neon (database), Cloudflare R2 (private asset storage), Cloudflare DNS and Email Routing, SeeAPI (video generated by ByteDance Seedance 2.5, opening frame by OpenAI GPT Image 2.5, both called through SeeAPI), OpenAI (input content moderation), AWS Rekognition (output frame safety check), Waffo Pancake (merchant of record), Google (sign-in). AI model providers receive the inputs needed to generate your results; safety providers receive inputs and results for screening; payment card data is processed exclusively by our PCI-DSS compliant payment processor, Waffo Pancake; hosting, database, storage and email providers store or deliver data on our behalf. Analytics providers receive data only if you consent.

We may also disclose data when required by law, to protect users or the public (for example reporting child sexual abuse material), or in connection with a sale or reorganization of the service. We do not sell personal data or share it for cross-context advertising.

Storage, transfers and security

Our providers may process data in the United States and other countries. Where data is transferred out of the EU, UK or your country, we rely on our providers’ standard contractual clauses or equivalent safeguards. We protect data with HTTPS/TLS on every connection, encryption at rest by our hosting and storage providers, private file storage that is only reachable through short-lived signed links for your own account, hashed passwords, and access to production systems limited to the operator. If a personal data breach puts your rights at risk, we will notify you and the relevant authorities within 72 hours of discovery where the law requires it.

How long we keep data

Account data: until you delete your account, then removed within 30 days. Files: generated files are deleted automatically 30 days after they are created. Moderation decision logs: up to 12 months without prompt text or file links, longer only where needed for a legal claim or report. Purchase and payment records: 7 years for tax and accounting. Server logs: up to 30 days. Analytics data: at most 14 months. Support emails: up to 2 years.

Your rights

Depending on where you live, you have the right to be informed, to access your data, to correct it, to have it erased, to restrict or object to processing, to data portability and to withdraw consent at any time. To make a request, including deleting individual files or your whole account, email support@bicepheartaivideo.com from the email address on your account. We reply within 30 days. You can also complain to your local data protection authority.

Cookies

We use necessary sign-in cookies and, only with your consent, analytics cookies. See the Cookie Policy at bicepheartaivideo.com/cookies for the full list and how to manage them.

Children

Bicep Heart AI is not intended for anyone under 18, and we do not knowingly collect data from them. If you believe a minor has created an account or that an image of a minor was uploaded, contact us and we will delete it.

Changes and contact

We will give at least 15 days’ advance notice by email or on the site before material changes to this policy take effect. Contact for privacy questions and requests: support@bicepheartaivideo.com.