Privacy Policy

1. Scope

This policy applies to personal information we process as a controller about visitors, account holders, and users of the Service. Where we process content on behalf of a business customer under an agreement, we act as that customer’s processor and their instructions govern.

2. Information we collect

• Account information, such as your name, email, and authentication identifiers.
• Billing information, processed by our payment processor; we receive limited details such as plan, transaction status, and the last digits of a card, not full card numbers.
• Content you provide, such as prompts, scripts, images, audio, documents, and brand assets you upload to generate videos, and the Output generated for you.
• Images and facial geometry when you create an avatar. Facial geometry may be biometric data; see Section 6 and our Biometric Data Policy.
• Usage and device data, such as log data, IP address, browser and device metadata, and product interactions.
• Support and communications you send us.
• Cookies and similar technologies, as described in our Cookie Policy.

3. How we use information

• To provide, operate, and generate your Output.
• To authenticate users and secure the Service and prevent abuse.
• To process payments and manage subscriptions.
• To analyze and improve the Service, and to develop new features.
• To measure the effectiveness of our advertising.
• To communicate with you about the Service and support.
• To comply with legal obligations and enforce our terms.

We do not use your uploaded content or the Output to train foundation models.

4. Legal bases (EEA/UK)

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (to provide the Service); our legitimate interests (to secure, analyze, and improve the Service, balanced against your rights); your consent (for example for biometric processing); and compliance with legal obligations. You may withdraw consent at any time.

5. AI processing of your uploads

• To generate your Output, we send your prompts and uploaded content to our AI model providers (Google and OpenAI), who process it to return the result to us. For the avatar / digital human feature specifically, we transmit the image you upload to our avatar model host (Replicate) and its model providers, who process it to return your Output.
• This processing is governed by data processing agreements; uploads are not used to train models and are deleted on the shortest necessary schedule.
• We also run safety checks on uploads and Output (for example to detect prohibited content); some checks compute features in memory and discard them.

6. Biometric data

When you create an avatar, we and our Service Providers extract facial geometry from your image, which may be a biometric identifier under laws such as BIPA. We collect and process it only with your consent and as described in our Biometric Data Policy, which sets out the purposes, disclosure to Service Providers, retention, and destruction schedule.

7. Sharing and subprocessors

• Service Providers (subprocessors) that host, process, or support the Service, including cloud hosting and storage (AWS), account authentication (Supabase), AI model providers (Google and OpenAI), our avatar model host (Replicate, used only for the avatar feature) and its model providers, payment processing (Stripe), and analytics (PostHog, Vercel, and Google Analytics). See our Subprocessors list.
• Legal and safety disclosures where required by law, to enforce our terms, or to protect users (including reporting CSAM to NCMEC as required).
• Advertising partners. Our website uses pixels from Google (Google Ads), Meta, and TikTok to measure the effectiveness of our ads. These partners may collect information such as your IP address, browser and device information, and the pages you visit, and use it under their own privacy policies. See our Cookie Policy for how to manage this.
• Business transfers, in connection with a merger, acquisition, or sale of assets, subject to this policy.

8. International transfers

We are based in the United States and process and store information there, and we may use service providers in other countries. Where we transfer personal information out of the EEA, UK, or other regulated regions, we use an approved transfer mechanism such as the EU Standard Contractual Clauses.

9. Data retention

• Account information is retained while your account is active and for a limited period afterwards as needed for legal, security, and accounting purposes.
• Uploaded content sent to model providers is deleted on the shortest necessary schedule under our data processing agreements.
• Biometric data follows the specific retention and destruction schedule in the Biometric Data Policy.
• We retain limited records, such as consent logs, for the period needed to evidence compliance.

10. Security

We apply technical and organizational measures appropriate to the risk, such as encryption in transit, access controls, and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Your rights

• Depending on your location, you may have rights to access, correct, delete, or port your personal information, to object to or restrict certain processing, and to withdraw consent.
• If you are in the EEA or UK, you may lodge a complaint with your supervisory authority.
• If you are a California resident, you have rights under the CCPA/CPRA, including to know, access, delete, and correct your personal information, and to limit the use of sensitive personal information. The categories we collect are described in Section 2 (identifiers, commercial/billing information, internet and usage activity, the content you upload, and, for avatars, biometric information), used for the purposes in Section 3.
• To exercise your rights, contact us at official@tapvid.ai. We will not discriminate against you for exercising them.

12. Cookies

We use cookies and similar technologies for essential functionality, preferences, analytics, and advertising measurement, as described in our Cookie Policy, where you can also learn how to manage them.

13. Children

The Service is not directed to children under 18, and you may not use it if you are under that age. We do not knowingly collect personal information from anyone under 18; if you believe someone under 18 provided us information, contact us and we will delete it.

14. Changes

We may update this policy from time to time. Before a material change takes effect, we will notify you by email or through a notice in the Service. Minor changes, such as corrections or formatting, take effect when we post them. The date above shows when this policy was last updated.

15. Contact

SigmaZ AI Company is the controller of your personal information. For privacy questions or to exercise your rights, contact us at official@tapvid.ai, or by mail at SigmaZ AI Company, 8 The Green, Suite B, Dover, Kent County, Delaware 19901, United States. This page is offered for transparency and is not legal advice.