Privacy Policy

Last updated: October 8, 2026

This Privacy Policy explains what ImageVideoAI ("we", "us" or "our") collects when you use imagevideoai.app (the "Service"), why we collect it, who processes it for us, how long we keep it and which choices you have. It applies to visitors who make a free video without an account and to people who sign in. If you do not agree with this policy, please do not use the Service. Privacy questions can be sent to [email protected].

The short version

The photos, prompts and videos you submit are used only to generate the video you asked for. We never use them to train AI models, and we do not hand them to anyone for training.
To create a video, your photo and prompt are sent to the third-party AI model provider behind the model you picked.
Videos made as a guest or on a free account are removed 7 days after creation, and videos made on a plan or with a credit pack balance after 180 days. You can delete any of them sooner yourself.
We do not sell your personal information.
Card details are typed into Stripe's checkout and never reach our servers.
To keep the free daily video fair, we use a visitor identifier stored in your browser together with your IP address.

Information we collect

Photos, prompts and generated videos

When you create a video, we store the image you upload (if you use one), the text prompt you write, the model and settings you choose, such as resolution and duration, and the video that comes back. We also keep a record of each generation: when it ran, how many credits it cost, whether it succeeded and whether the result carries a watermark.

Account information

Accounts are created by signing in with Google. Google shares your email address, your name and your profile picture with us. We use them to set up your account, show you who is signed in and answer your support requests. We never receive your Google password.

Using the Service without an account

Guests get one free video per day without signing up. To enforce that daily limit, we give your browser a visitor identifier. It is calculated in your browser from its configuration, a technique often called device fingerprinting, and kept for 30 days in a cookie and in your browser's local storage. Your browser sends it to our servers with its requests, and we read it together with your IP address, so that the same device cannot collect extra free videos by reloading the page or opening a private window. It is also checked when an account is created, because signup credits are given once per device. When a guest adds a photo, we open a guest session for that browser, held in the same sign-in cookie that accounts use.

Payment information

Plans and credit packs are paid on a checkout page hosted by Stripe. Stripe collects your card or wallet details. We receive only what we need to manage the purchase: a Stripe customer reference, the product you bought, the amount, the currency, the payment status and the dates of your billing period.

Device, usage and security data

We collect some information automatically when you use the Service:

Technical data: IP address, browser type and version, operating system, and the pages and requests your browser makes, as recorded in our server logs.
Security checks: Cloudflare protects the Service against attacks and automated abuse. Guests complete a Cloudflare Turnstile check before the free video starts, and we may also ask for one when a new guest session looks unusual. Turnstile reads signals from your browser to tell people from bots.
Analytics: subject to your cookie choice described below, Google Analytics 4 records how pages are used, for example pages viewed, time on page, approximate location, device type and referring site, and whether key steps such as a sign-in or a purchase happened.
Session replay: Microsoft Clarity records clicks, scrolling and mouse movement and rebuilds them into heatmaps and replays of visits, which show us where pages confuse people. Its default masking hides what you type into fields.
Referral details: on your first visit we note where you came from, such as a referring site or a campaign tag, and the page you landed on. The source is saved with your account when you sign up. Each purchase records the source, the landing page and the country your connection comes from, and these details also go to Stripe with the order.

Messages you send us

If you email us, we keep your address, your message and any attachments so that we can reply and keep a record of the request.

How we use your information

To generate the videos you request and let you preview and download them
To create your account, keep you signed in and keep your videos available until they are deleted
To grant, meter and return credits, including signup credits and free daily credits
To process payments, renew or cancel plans, and handle refunds and chargebacks
To enforce the free daily video limit and to prevent fraud, multi-account abuse and attacks
To answer support requests and send messages about your account or purchases
To understand how the Service is used and fix problems, using analytics and error logs
To meet legal, tax and accounting obligations and enforce our terms

Your uploads and videos are never used to train AI models. Our staff do not routinely look at them. A person on our side opens a file only when you ask for help with a specific generation, when we need to investigate abuse or a legal complaint, or when the law requires it.

Legal bases for processing

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on these legal bases:

Performance of a contract: generating your videos, running your account, metering credits and handling payments.
Legitimate interests: preventing abuse of the free tiers and fraud, keeping the Service secure, and understanding how it is used so we can improve it. We weigh these interests against your rights.
Legal obligation: keeping payment and tax records and responding to lawful requests.
Consent: for analytics cookies from Google Analytics and Microsoft Clarity when you visit from the European Union, the European Economic Area or the United Kingdom. You can withdraw consent at any time through Cookie settings in the footer.

Cookies and similar technologies

We use a small number of cookies and similar technologies, grouped by purpose.

If you visit from the European Union, the European Economic Area or the United Kingdom, we ask before any analytics cookies are set. Until you accept, Google Analytics sets no cookies and sends only basic signals without identifiers, and Microsoft Clarity does not load. Everywhere else, analytics run by default. Anyone can change the choice at any time through Cookie settings in the footer, and turning analytics off removes their cookies from your browser.

Sign-in cookie (iva-token, 30 days): keeps you signed in after you log in with Google, and holds a guest session once a guest adds a photo. Strictly necessary.
Visitor identifier (visitorId, 30 days, with a copy in local storage): holds the browser identifier described above. Used only to enforce the free limits and to prevent abuse.
New account notice (iva_signup, 3 hours): set when an account is created, so the Service can tell you once whether signup credits were added.
Referral cookies (_ge_src, _ge_landing and _ge_utm_campaign, 180 days): remember how you first arrived, as described above.
Cookie choice (iva_consent, 180 days, and iva_region, 30 days): remember whether you accepted or rejected analytics cookies, and whether your connection comes from a country where we ask first. Strictly necessary.
Analytics cookies: Google Analytics 4 sets _ga and a cookie whose name starts with _ga_, kept for up to 2 years, to count visits and measure how the Service is used. Microsoft Clarity sets cookies such as _clck and _clsk, kept for up to a year, to link the pages of one visit. Visitors from the European Union, the European Economic Area and the United Kingdom get them only after they accept.
Security cookies: Cloudflare may set cookies when it checks traffic or shows a Turnstile check.
Third-party services: Google sign-in and Stripe checkout may set their own cookies when you use them.

You can block or delete cookies in your browser settings. If you block the sign-in cookie, you cannot stay signed in, and if you block the visitor identifier, the free daily video may not work. You can opt out of Google Analytics with Google's browser add-on for that purpose.

We do not sell, rent or trade your personal information, and we do not share it for cross-context behavioral advertising. We share it only in these cases:

AI model providers: your photo, prompt and settings go to the third-party AI model providers, for example the companies behind Kling, Veo, Seedance, Hailuo and Wan, either directly or through an API service that forwards the request. They receive what they need to produce your video and nothing about your account. They handle the request under their own terms and may keep request data for a limited time, for example for security or abuse monitoring.
Other service providers that work for us under contract and only on our instructions: cloud hosting, Cloudflare (content delivery, file storage and Turnstile), Stripe (payments), Google (sign-in and analytics) and Microsoft (Clarity session replay).
Legal requirements: when we must comply with a law, a court order or a valid request from a public authority.
Safety and rights: to investigate fraud or abuse, or to protect the rights, property or safety of our users, the public or us. Material that appears to show the sexual abuse of a child is reported to the relevant authorities.
Business transfers: if we are involved in a merger, an acquisition or an asset sale, in which case this policy keeps applying to your information.
With your consent for any other purpose we tell you about first.

How long we keep information

Uploaded photos and generated videos: each video gets its deletion date when you create it: 7 days later if it was made as a guest or on a free account, and 180 days later if your account had an active plan or a credit pack balance at that moment. Its photo goes with it, unless another of your videos still uses that photo. A photo you upload but never use in a generation is deleted about 24 hours after the upload.
Deleting it yourself: any finished or failed video can be removed from your video history at any time. That deletes the video file and its photo straight away, instead of waiting for the date above.
Generation records (prompt, model, settings, credits and status, without the photo or video itself): kept while your account exists, so that your credit balance and purchases can be checked.
Account information: kept until you ask us to delete your account.
Payment and invoice records: kept for as long as tax and accounting law requires, even after an account is deleted.
Anti-abuse data: counters tied to your IP address reset within 24 hours. Counters tied to your visitor identifier last 24 hours for the free daily video and 30 days for guest sessions, and the note that a device has already received signup credits is kept for one year.
Server logs and support emails: kept only as long as needed for security, troubleshooting and handling your request.

A deleted file can remain in content delivery caches for a short time. Download anything you want to keep before it expires.

How we protect information

All traffic to the Service uses HTTPS. Files are stored under random names that are hard to guess, and the Service shows their links only to the person who created them. Anyone you send a link to can open that file, so share download links with care. The links do not expire on their own; they stop working once the file is deleted. Access to production systems is limited to the people who need it, and payment notifications from Stripe are verified with signatures. No way of sending or storing data is completely secure, so we cannot promise absolute security, but we will notify you and the relevant authorities of a breach where the law requires it.

Your rights and choices

Depending on where you live, you may have the right to:

Access the personal information we hold about you
Correct information that is inaccurate or incomplete
Delete your information and your account
Receive a copy of your information in a portable format
Object to or ask us to restrict certain processing
Withdraw consent where we rely on it
Complain to your local data protection authority

To use any of these rights, email [email protected] from the address on your account. We may need to confirm your identity first, and we reply within 30 days. We will not treat you differently for exercising your rights. California residents have these rights under the CCPA; we do not sell or share personal information as those terms are defined there.

Age requirement

The Service is only for people who are 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we delete it and close the account. If you believe a minor has used the Service, please tell us at [email protected].

International data transfers

We and our providers process information in several countries, which may include the United States and other countries outside the one you live in. Data protection laws there may differ from yours. When personal information leaves the European Economic Area, the United Kingdom or Switzerland, we rely on safeguards such as the European Commission's Standard Contractual Clauses.

Third-party services

The Service uses Google sign-in and Stripe checkout and may link to other websites. Those companies handle the data you give them under their own privacy policies, which we encourage you to read. We are not responsible for their practices.

Changes to this Privacy Policy

We may update this policy when the Service or the law changes. We will post the new version on this page and change the date at the top. If a change materially affects how we use your personal information, we will also tell account holders by email or on the Service before it takes effect.

Contact us

For questions about this policy or to exercise your rights, email [email protected]. The rules for using the Service are in our Terms of Service. How refunds work is explained in our refund policy. What each plan includes and how credits are counted is listed on the pricing page.