Privacy Policy

Photos and generation

Selecting photos creates local browser previews. When you submit a generation request, we upload the selected photos to private storage and send them to the processing services required for your video. Uploads are processed to remove EXIF location and camera metadata. Only upload photos you have permission to use.

We use Cloudflare for site delivery, private media storage and application records; Kie for composing the reference frame; Replicate for video generation and watermarking; and SeeAPI for content-safety checks. These services receive the media or request information necessary for their part of the process. Processing may occur outside your country. We do not claim a particular processing region.

Access, retention and deletion

Photo and intermediate-file access expires 24 hours after upload. New guest email-delivery videos remain available for 3 days after completion. Existing account videos retain their original deadline (six days for the current account flow); the result page shows your download deadline in your local time zone. Download your video before that deadline. Expired links cannot be renewed to extend access.

You can use Delete files on a completed result to permanently remove that task's media from our storage. Deletion is available after processing finishes. It removes our media copies and associated media pointers, while keeping necessary account, credit and payment records. It does not refund a completed generation. Files you already downloaded to your device are under your control.

Automatic deletion is enabled for our private storage: photos and intermediate files become eligible for deletion after one day, account videos after six days, and new guest email-delivery results after 3 days. Cloudflare processes these expiration rules asynchronously, typically within the following 24 hours; physical deletion is not guaranteed at an exact time. The access deadlines above still apply while cleanup is pending. You can also use the deletion control or contact support to request removal of our copies.

Our deletion controls do not delete copies held by processing providers. Replicate's API documentation states that API prediction inputs, outputs and logs are removed after one hour by default. Kie's published retention information states that generated media is retained for 14 days and logs for two months. SeeAPI's privacy policy does not specify an API-media retention period. Their policies and applicable model terms govern their handling; we do not promise that all upstream services never retain data or use it for training.

Guest email delivery

You can purchase video packs without registering. We store your checkout email separately from account identities, your paid pack allowance, generation records and private access credentials. Resend processes transactional payment, completion and recovery emails. These emails are not marketing subscriptions. We do not merge existing account orders based on a matching email address.

Email pickup links expire 72 hours after each video completes and can be reopened before expiry. Select Continue to establish a private session for up to 24 hours on that device. Use your original checkout email to request another link; this does not extend a video deadline. Keep email links private and save completed videos before they expire. Refunds or revoked payments block access to the affected results. Guest workspace pages do not load analytics or session replay.

Accounts and payments

Google sign-in provides account information such as your email, name and profile image. We store account identifiers, generation status, credit transactions and support requests to operate your account. Stripe processes checkout and payment details. We store order identifiers, payment status and purchased credits; we do not receive your complete card number. Payment notifications may include an order reference, amount and status for operational monitoring.

Analytics and privacy settings

We use Google Analytics 4 (Google LLC / Google Ireland Ltd.) to measure visits to eligible public pages, device/browser information, approximate location and permitted interactions. The analytics setting depends on your region and any choice already saved in this browser:

• In the EEA, the UK and Switzerland, analytics cookies stay off until you accept, unless you have a valid saved choice.
• In other known regions, analytics is on by default unless you reject it or have a valid saved rejection.
• If we cannot determine your region, analytics cookies stay off until you choose.

Where Microsoft Clarity is enabled, it uses the same resolved analytics setting, including the regional default. It may collect masked page-interaction, heatmap and session-replay data on eligible public pages when that setting is on. Clarity is not started while the setting is off, and an active recording is stopped when you reject analytics. Private guest workspaces, pickup and recovery pages, account pages and admin pages are excluded from analytics and session replay.

Our app sends cleaned public page paths and a limited set of product steps. Its analytics events omit selected photos, prompts, filenames, email addresses, account, task and order identifiers, checkout URLs, URL queries and fragments. Google or Microsoft may receive the technical information needed to operate their enabled service.

Use Privacy settings in the footer to change or withdraw your choice. We remember an explicit choice in this browser for up to 12 months, subject to browser storage being available. Rejecting removes accessible first-party analytics cookies and stops Clarity recording. It does not mean zero network requests: Google may still receive cookieless consent and usage pings while analytics cookies are denied. Withdrawing a choice does not erase information already sent to a provider. Advertising storage, advertising user data and ad personalization remain denied.

Google Analytics Opt-out Browser Add-on · How Google uses data.

Security and your choices

Media is stored privately and delivered through short-lived signed links without public caching. Treat a signed link as private: anyone you share it with can use it until it expires. No internet service can guarantee complete security.

You can remove selected photos before submitting, delete completed task media, and request account-related assistance through Support. Authentication and security use essential browser storage; see the Cookie Policy. We update this page when processing or retention practices change.

Contact

For privacy questions, email hello@hotellobbymaker.com. Do not send private photos or account passwords by email.