Halloween effects: Ghost Filter Prank and AI Halloween CostumeSee them

Privacy Policy

Last updated:

This policy explains how yayvid ("we") processes personal data when you use yayvid at yayvid.com. It is referenced by our Terms of Service.

1. Who is responsible

2. Data we collect

  • Account data: email address, and name and profile picture if you sign in with Google.
  • Content: prompts you submit, files you upload and the outputs generated for you.
  • Billing records: order number, plan, amount, currency and payment status. Card details are collected and processed by our payment processor, not by us. From the processor we receive the card brand, last four digits, expiry date, card country and billing address you entered — never the full card number.
  • Support requests: the tickets you open, your messages and our replies, and the order or generation you choose to attach.
  • Consent records: when you upload a photo, the time you confirmed that you are the person shown or have their permission.
  • Activity records: the time of purchases, generations and downloads, the files involved, your country and salted one-way hashes of your IP address and browser identifier — used to prevent fraud and to answer payment disputes.
  • Technical data: IP address, browser user agent and request logs, used for security, abuse prevention and rate limiting.
  • Visit statistics (first party): for each visit we keep the pages seen, the referring site, device type, country and the date, under a key derived from a one-way hash of your IP address and browser identifier with a salt that changes every day. No cookie is set, no IP address is stored and visits on different days cannot be linked. These statistics are kept for 90 days and are used only to understand how the site is used.
  • Cookies: a strictly necessary session cookie that keeps you signed in.
  • Analytics and session-recording cookies: see section 5.
  • Session recordings (Microsoft Clarity): on the public pages (home, effects, pricing, blog) we record how the page is used — clicks, scrolling, mouse movement, the page structure, device type and browser. Anything you type, the photos you upload, the results made for you, your email address and order numbers are masked on your device and never sent. See section 5.

3. How we use it

  • To provide the Service you request (performance of a contract).
  • To prevent fraud and abuse and keep the Service secure (legitimate interests).
  • To respond to refund requests and payment disputes, using billing and activity records (legitimate interests).
  • To process payments and meet tax and accounting obligations (legal obligation).
  • To answer your support requests (performance of a contract).
  • To send essential service emails such as sign-in codes and receipts, and notices that we replied to your ticket.
  • To measure usage of the Service and understand how the public pages are used, with your consent where the law requires it (see section 5).

We do not sell your personal information.

4. Who we share it with

We share data only with service providers that process it on our behalf:

  • Cloudflare — hosting, storage, security and bot protection (Turnstile); Cloudflare Web Analytics also counts page visits without cookies or fingerprinting.
  • Resend — delivery of transactional emails.
  • Google — if you choose "Sign in with Google".
  • Stripe — payment processing. Payment card data is processed exclusively by our PCI-DSS certified payment processor and is never stored on our servers. Stripe also uses information about your device and payment to detect fraud (Stripe Privacy Policy). If a payment is disputed, we share the relevant billing and activity records with Stripe and the card networks to respond.
  • fal.ai (fal.ai Inc., USA) — AI model inference (Alibaba Wan 3.0 image-to-video, MiniMax Hailuo H3 image-to-video, Google Nano Banana Pro image edit). Prompts and input files are sent to generate your results.
  • SeeAPI (GROWCRAFT PTE. LTD., 5 Raffles Place, Singapore) — automated content moderation. The text you submit, the photos you upload, every intermediate image and still frames of every video are sent for a check before anything is used or shown. SeeAPI states that it does not use API inputs or outputs to train AI models, keeps API request records and logs for 60 days, and does not schedule an automatic expiry for input files, output files and moderation results (seeapi.com/docs/data-handling).
  • Google Analytics — usage measurement, with consent (Google Privacy Policy).
  • Microsoft Clarity — session recordings and heatmaps of the public pages, with consent (Microsoft Privacy Statement).

We may also disclose data when required by law.

5. Cookies and consent

Strictly necessary: when you upload a photo or start a checkout we set a did cookie (a random id, one year) that lets us enforce the upload limits and bans of our Acceptable Use Policy. Only a salted one-way hash of it is stored; it is not used for analytics or advertising.

Google Analytics cookies: if you are in the European Economic Area, the United Kingdom or Switzerland, a consent bar asks you first and the cookies are set only after you accept them ("Accept all", or "Customize" to choose per service). Elsewhere they are on by default and no bar is shown. Without consent, or after you reject them, Google Analytics does not set or read cookies; it may receive basic cookieless signals (for example, that a page was viewed). You can change your choice for each service at any time with "Cookie settings" at the bottom of every page.

Microsoft Clarity session recordings: we use Clarity to see how the public pages (home, effects, pricing and blog) are used, so we can improve them. It records clicks, scrolling, mouse movement and the structure of the page, and sets the cookies _clck and _clsk (which link your page views into one session) plus Microsoft's own cookies on its domains. It never runs on your account, history, billing, support or result pages. Text you type, photos you upload, the results made for you, your email address and order numbers are masked in the recording before anything leaves your browser. If you are in the European Economic Area, the United Kingdom or Switzerland, Clarity does not load until you accept it in the consent banner; elsewhere it runs by default. When you reject or withdraw consent (with "Cookie settings" at the bottom of every page), the recording stops and its cookies are deleted. Clarity also honours the Global Privacy Control signal of your browser. Microsoft processes this data as our provider (Microsoft Privacy Statement).

6. International transfers

Our providers may process data outside your country. Where required, transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses.

7. Retention

  • Account data: while your account exists, then deleted or anonymised within 30 days of account deletion.
  • Prompts, uploads and outputs: until you delete them, and at most 90 days.
  • Videos bought without an account: the photo you upload waits at most 1 hour for its payment (then it is deleted); the finished video and the photo are deleted 3 days after the video is ready, unless you add the order to an account — then the account rules above apply. The email you gave at checkout stays with the billing record.
  • Billing records: 7 years, to meet tax and accounting law.
  • Support tickets: while your account exists; their text is erased when you delete your account.
  • Activity records: 540 days (the period in which a card payment can still be disputed).
  • Server and security logs: 30 days.
  • Abuse-prevention counters (salted one-way hashes of IP addresses and email addresses, used for sign-up and email rate limits): at most 2 days.
  • Moderation records (which check ran, its result and time, a hash of the file, and your account id or a salted hash of your IP address and device id): 540 days. A file that failed a check is kept 7 days for our review, then deleted; upload bans last 24 hours, or indefinitely after repeated bans or for content that sexualises minors.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your data, to object to or restrict processing, and to withdraw consent. You can delete your account yourself from your account page. To exercise other rights, email support@yayvid.com. You may also complain to your local data protection authority.

9. Children

The Service is not intended for anyone under 13. We do not knowingly collect data from children under that age.

10. Security and breaches

We use encryption in transit, access controls and least-privilege access to protect your data. If a breach affects your personal data, we will notify you and the relevant authority without undue delay and, where required, within 72 hours of becoming aware of it.

11. Changes

We will post updates here and change the date at the top.