Privacy Policy

1. Information We Collect

We collect information you provide directly to us, as well as limited information generated automatically when you use videobao:

• Account information: email address, display name, and Google OAuth profile data (when you sign in with Google)
• Payment information: billing handled by our payment processor Creem.io (Merchant of Record); we never see or store your card details
• Generation inputs: text prompts, uploaded reference images or videos, and the resulting generated media
• Usage data: models used, credits consumed, generation timestamps, and feature interactions necessary for billing and abuse prevention
• Device and log data: IP address, user agent, and approximate region (derived from IP) for security and rate limiting

2. How We Use Your Information

We use your data to:

• Provide, operate, and improve our AI video and image generation services
• Process payments, manage credits, and prevent fraudulent transactions
• Authenticate users and protect accounts from unauthorized access
• Communicate with you about service updates, security notices, and account-related matters
• Enforce our Terms of Service and comply with legal obligations

AI training: We do not use your prompts, uploaded media, or generated outputs to train, retrain, fine tune, or improve any AI models. This includes but is not limited to: model fine-tuning, RLHF training data, embedding index construction, and synthetic data generation. We do not share your inputs or outputs with third parties for their independent model training.

3. Data Storage & Security

Your data is stored using Supabase (PostgreSQL with row-level security) and Cloudflare R2 (media storage). All data is encrypted in transit (TLS 1.2+) and at rest. Access to production systems is restricted to authorized personnel and protected by multi-factor authentication. While no system is perfectly secure, we follow industry-standard practices to protect your personal data against unauthorized access, alteration, or destruction.

4. Retention & Deletion

Generated media files are retained for the duration specified by your subscription tier and permanently deleted from Cloudflare R2 thereafter. Free tier retention is shorter than paid tiers to optimize infrastructure costs. Account metadata (email, plan, credits history) is retained for as long as your account is active. Backups are retained for up to 90 days before being purged.

5. Account Deletion

You may initiate account deletion directly from your account settings page (see /account). Upon deletion, all personal data and generated content are permanently erased within 30 days, except where retention is required by law (e.g., tax records, fraud investigation holds). Email us at support@videobao.com if you need assistance.

6. Your Rights

Subject to applicable law, you have the right to:

• Access a copy of the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your account and associated personal data
• Export your generated content and account history in a portable format
• Object to or restrict certain processing activities
• Opt out of marketing communications at any time
• Lodge a complaint with your local data protection authority

We will respond to verified data requests within 30 calendar days. If we require additional time, we will notify you of the extension and the reason, in accordance with GDPR Art. 12(3).

7. Third-Party Services

We rely on vetted third-party providers to deliver our service:

• AI generation: third-party generative AI providers (each provider receives only the prompt and reference media you submit for that specific generation)
• Authentication: Supabase Auth with Google OAuth
• Payments: Creem.io acts as the Merchant of Record and processes all billing
• Media storage: Cloudflare R2
• Email delivery: transactional email providers

Each provider processes data under its own privacy policy and applicable data processing agreements with us. We do not sell your personal data to third parties.

8. Cookies

We use essential cookies for authentication and session management. We do not use advertising or cross-site tracking cookies. See our Cookie Policy for a complete list of cookies in use and how to manage your preferences.

9. International Data Transfers

videobao is operated from Hong Kong SAR. Your data may be processed in Hong Kong, the United States, the European Economic Area, or other jurisdictions where our service providers maintain infrastructure. When we transfer personal data across borders, we rely on appropriate safeguards such as Standard Contractual Clauses, adequacy decisions, or other lawful transfer mechanisms recognized by applicable data protection law.

10. Data Breach Notification

In the event of a personal data breach affecting your account, we will:

• Notify affected users without undue delay (target: within 72 hours of discovery)
• Notify relevant supervisory authorities where required by applicable law (e.g., GDPR Art. 33, PDPO)
• Provide information on breach scope, data types affected, and mitigation steps

11. Hong Kong Privacy Rights

For users in Hong Kong SAR, this Policy also complies with the Personal Data (Privacy) Ordinance (Cap. 486). Hong Kong residents may request access to and correction of personal data by contacting support@videobao.com. We do not transfer personal data outside Hong Kong in a manner inconsistent with PDPO cross-border transfer requirements.

12. Contact Us

For privacy-related questions, data requests, or to exercise any of your rights described in this Policy, contact us at support@videobao.com. We aim to respond within 30 calendar days.