Privacy Policy

Version 1.0 review draft · Updated October 16, 2026

AI Zombie Video is operated by 温勇, an individual in China. The website domain is www.zombievideoai.app and the privacy contact is [email protected]. This is a local preparation draft; final infrastructure, retention and the effective date must be confirmed before public operation. Waffo payments remain in test mode.

1. Information and purposes

We do not build a facial-identification database or independently verify identity using portraits. Photos can still contain sensitive information, and models process facial features. Submit only authorized material compatible with the access conditions below.

2. Media processing

Selected-photo previews remain in the browser before submission. After submission, originals are archived in a separate private R2 bucket and processed input copies are created. Inputs used by models have public links; delivered videos may also have public links. Anyone holding a link may be able to access that object. A private original does not revoke public copies or prevent others from saving accessible content.

Tasks may send inputs directly to MiniMax or process images through Volcengine Ark before video generation, together with necessary prompts, roles and specifications. See AI and Model Disclosure. Originals, processed copies, intermediate assets and results have different access conditions; this is not an end-to-end private or encrypted media service.

3. Providers

Our own forms do not collect full card numbers or card security codes. Payment providers may collect payment and billing details directly under their conditions. Google sign-in does not give us your Google password.

Selling personal data or portraits is not our business model. We do not independently train our own models on uploads. Third-party retention, training and international processing depend on the provider account and agreement and must be verified before launch. This statement does not guarantee zero retention or training by all providers.

4. Cookies and browser storage

Authentication cookies and related state support sign-in, security and language preferences. Session storage holds checkout request identifiers to prevent duplicate orders, not card details. Disabling necessary storage may interfere with these functions.

Optional analytics integrations exist, but code availability does not establish activation. This draft does not claim a consent manager is deployed. Before enabling non-essential analytics, identify actual providers, purposes and retention and obtain consent and offer withdrawal where required.

5. Retention, deletion and security

You may keep reference photos and creations in your account for continued access and recreation until you request deletion or account closure. We do not automatically erase your media after a fixed 30- or 90-day period. Storage is not a permanent backup guarantee; download results you need. Financial, security and dispute records are assessed separately and are not erased by deleting a media file. Account inactivity, service closure, backup retention and provider-held copies require a documented operational process before public launch.

Email requests for access, correction, deletion, account closure or restriction. After proportionate identity checks, we aim to respond or explain progress within 30 days, subject to shorter legal deadlines. We will explain records retained for financial, security or dispute obligations. Use Media and privacy to request deletion of stored portrait groups or creation assets. Deletion waits until active tasks finish. The worker removes controlled storage objects and purges configured public caches; unavailable storage or cache configuration leaves the request pending for administrator attention. Account closure, record exceptions, backups and AI-provider coordination require manual handling.

Deleting objects we control does not necessarily erase downloaded, cached or independently retained copies. Requests must consider originals, processed inputs, results and relevant backups; we do not promise instant worldwide deletion.

Measures include password hashing, authenticated sessions, access checks, separated storage and accounting audits. These do not eliminate every risk. Authorized administrators can access relevant records and assets for their duties.

6. Processing grounds, international handling and minors

We process information to fulfill requests, protect accounts and handle transactions, seeking consent where required. The operator and providers may be in different countries. Actual recipients, regions and necessary safeguards must be verified before public operation; local testing does not establish those arrangements.

The service is for adults and does not accept portraits of minors for generation. Report concerns to the privacy contact for investigation. This draft does not claim automatic age verification exists.

7. Requests and changes

Contact [email protected] with your request, account email and relevant task/order reference. Do not send passwords, full card details or unrelated identity documents. You retain the right to contact an applicable privacy or consumer authority.

Material changes will be announced with a new version. Any required new consent must precede processing for a new purpose. See the Terms and Support and Contact.