Privacy Policy

1. Information We Collect

We collect information you provide directly: account details (email, name), payment information processed via Stripe, uploaded content (brand assets, avatar training data), and usage analytics. We also collect technical data: IP address, browser type, device information, and API usage patterns for service optimization.

2. How We Use Your Data

Your data is used to: provide and improve our AI video generation services, process payments and manage credits, train and maintain avatar models (with your explicit consent), send service notifications, and comply with legal obligations. We do not sell your personal data to third parties.

3. Data Storage & Security

All data is stored on Google Cloud Platform infrastructure with encryption at rest and in transit. Video content is stored in region-specific GCS buckets. Authentication is handled via Firebase with token encryption through Google Cloud KMS. We maintain SOC2-ready security practices and conduct regular security audits.

4. Avatar & Biometric Data

Digital twin avatar creation involves processing biometric data (facial features, voice patterns). This data is processed only with verified explicit consent through our Active Consent Engine. Avatar training data is isolated per user and can be permanently deleted upon request. We comply with BIPA, GDPR, and other biometric data regulations.

5. Content Provenance

All generated videos include C2PA (Coalition for Content Provenance and Authenticity) cryptographic watermarking. This metadata proves the content was AI-generated and provides an immutable chain of custody. This data is embedded in the video file and cannot be removed without detection.

6. Data Retention & Deletion

Generated videos are retained according to your plan terms. Ephemeral Epilogue ensures temporary content is automatically purged after the configured retention period. You can request complete account and data deletion at any time through Settings or by contacting support.

7. Your Rights

Under GDPR and applicable laws, you have the right to: access your data, correct inaccuracies, request deletion, restrict processing, data portability, and object to automated processing. Exercise these rights through your Support page.