Privacy Policy

1. Who We Are

PhotoLoop ("we", "our", or "us") operates photoloopai.com, a service that turns a still image into a short AI-generated video. PhotoLoop is an independent service operated by an individual sole proprietor. There is no company, no office, and no phone line, every request reaches the same monitored inbox: support@photoloopai.com.

This policy explains exactly what we collect, who else sees it, and how long we keep it. If you do not agree with it, please do not use the Service.

2. What We Collect

Information you give us

• Account details. Your email address, and your name and profile picture if you sign in with Google. Passwords are stored only as a salted hash; we never see the original.
• The images you upload. The still image you want animated.
• The prompts you write. The text describing the motion you want.
• Messages you send us. Anything you put in the contact form or email to us.

Information collected automatically

• Generation records. Which model was used, duration, resolution, success or failure, and credits spent.
• Abuse-prevention signals. A one-way hash of your IP address and a browser identifier, used to enforce the one-free-video-per-day limit. We do not store your raw IP address for this purpose.
• Analytics. Page views and aggregate usage, collected by Google Analytics and Microsoft Clarity. These load only after you consent to analytics cookies.

What we never collect

We do not collect or store your card number, bank details, or government ID. Payments are handled entirely by Creem on their own pages. We do not buy personal data from third parties, and we do not sell yours.

3. Why We Use It

• To generate the video you asked for, and to let you download it.
• To create and secure your account, and to send you password resets and purchase receipts.
• To enforce free-tier limits and block automated abuse.
• To track credit balances and produce an auditable record of every credit change.
• To understand which pages people actually use, so we can fix the ones that fail (consent-based only).
• To comply with the law and to respond to valid legal requests.

We do not use your images or prompts to train any AI model, and we do not publish them.

4. Legal Bases (EEA / UK visitors)

We rely on contract to provide the Service you requested, legitimate interests to prevent abuse and keep the Service running, consent for analytics cookies and marketing email (withdrawable at any time), and legal obligation for tax and accounting records.

5. Who Else Sees Your Data

To run the Service we pass data to the providers below. They may only use it to perform their service for us. This is the complete list:

• EvoLink, AI video generation (receives your uploaded image and prompt)
• Neon, PostgreSQL database hosting (United States, us-east-2)
• Cloudflare R2, Storage of generated videos and uploaded images
• Cloudflare Turnstile, Bot and abuse protection
• Creem, Payment processing (card details go to Creem, never to us)
• Resend, Transactional email delivery
• Google Analytics, Aggregate traffic analytics (loaded only with consent)
• Microsoft Clarity, Aggregate usage analytics (loaded only with consent)

Your uploaded image and prompt are sent to EvoLink, our AI provider, because that is how the video gets made. We may also disclose information if required by law, or as part of a transfer of the Service to a new operator, in which case this policy travels with it.

6. International Transfers

The Service is operated from and hosted in the United States. Our database runs in the US (Neon, us-east-2) and generated files are stored on Cloudflare R2. If you use the Service from outside the United States, your information will be transferred to and processed there. Where required, transfers out of the EEA or UK rely on Standard Contractual Clauses entered into by our providers.

7. How Long We Keep It

• Free-tier videos and their source images: 24 hours. Free-tier videos and their source images are deleted 24 hours after generation. Download it before then, we cannot recover it afterwards.
• Account data: until you delete your account.
• Credit and payment records: retained after account deletion for as long as tax and accounting law requires.
• Abuse-prevention hashes: a rolling window, only as long as needed to enforce the daily limit.

8. Your Rights

Wherever you live, you may ask us to access, correct, export, or delete your personal data, and you may object to or restrict certain processing. If you are in the EEA or UK, these are your GDPR rights; if you are in California, these are your CCPA/CPRA rights, and we confirm that we do not sell or share your personal information. We will not treat you differently for exercising any of them.

Email support@photoloopai.com and we will respond within 30 days. EEA and UK users also have the right to complain to their local data protection authority.

9. Cookies

We use a small number of strictly necessary cookies to keep you signed in and to run the bot check. These cannot be switched off. Analytics cookies are loaded only if you accept them, and you can change your mind at any time. See our Cookie Policy for the details.

10. Security

Traffic is encrypted in transit, passwords are hashed, payment card data never touches our servers, and access to production data is limited to the operator. No service can promise perfect security, and we will not pretend otherwise. If a breach affects your data, we will notify you and the relevant authority as required by law.

11. Children

The Service is not intended for anyone under 13, and we do not knowingly collect their data. If you believe a child has given us personal information, email support@photoloopai.com and we will delete it.

12. Changes

If we change this policy we will update the Effective Date above, and for material changes we will notify registered users by email before the change takes effect.

13. Contact

Privacy questions, data requests, and complaints all go to one place:

• Email: support@photoloopai.com
• Website: https://photoloopai.com