Privacy Policy

This Privacy Policy explains how Zombie AI Video ("Zombie AI Video", "we", "us" or "our") collects, uses, shares and protects personal data when you visit zombieaivideo.org or use our AI video service (together, the "Service"). Please read it together with our Terms of Service and Refund Policy.

1. Who we are

Zombie AI Video is operated by zombieaivideo, Core F, Cyberport 3, 100 Cyberport Road, Hong Kong. For the purposes of the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong, the EU and UK General Data Protection Regulations and similar laws, we are the data user / data controller responsible for your personal data.

You can reach us about anything in this policy at contact@zombieaivideo.org.

2. Scope

This policy covers personal data we process when you browse the site, create an account, upload photos, generate videos, make a purchase or contact us. It does not cover third-party websites or services that we link to, which have their own privacy policies.

3. Information we collect

3.1 Information you give us

• Account information — your email address, the name you choose, and your password. Passwords are stored only as a salted cryptographic hash; we cannot read them.
• Photos you upload — the two photos you provide for a video (for example, of yourself and of a partner, friend, family member or pet), together with the story options you choose (story type, memory scene and aspect ratio).
• Support messages — the content of emails or other messages you send us, and any attachments.

3.2 Information created when you use the Service

• Generated content — the AI-generated images and videos produced from your photos, and the status of each generation job.
• Purchase and credit records — the plan you bought, amount, currency, date, order and subscription status, the number of videos (credits) granted, used, returned or expired, and identifiers issued by our payment processor.
• Technical and usage data — IP address, browser and device type, operating system, language, referring page, pages viewed, clicks, scrolls and approximate location derived from your IP address, collected through server logs and the analytics tools described in section 6.

3.3 Payment information

Payments are processed by Stripe. Your card number and other payment credentials are entered directly on Stripe's checkout page and are never sent to or stored on our servers. Stripe shares with us only limited information such as your email address, the payment status, the amount, and transaction and customer identifiers.

3.4 Information about other people in your photos

If you upload a photo of another person, you are providing us with that person's personal data. You may only do so if that person is an adult and has agreed to appear in an AI-generated video, as required by our Terms of Service. Before you upload, please let them know that their photo will be processed as described in this policy and point them to it. We do not knowingly process photos of children.

A person who appears in a photo does not need an account to exercise their rights — see section 11.

4. How we use your information

We use personal data only for the following purposes:

1. To provide the Service — create and secure your account, upload and process your photos, generate and deliver your videos, show your video history, and keep track of your prepaid videos and subscription.
2. To process payments — take payments, grant and manage credits, handle renewals, cancellations, refunds and chargebacks, and keep accounting and tax records.
3. To support you — answer questions, investigate failed or broken renders, and handle requests under this policy.
4. To keep the Service safe — prevent fraud, abuse, spam and attacks, enforce our Terms (including our rules on consent, minors and public figures), and protect our users and us.
5. To understand and improve the Service — measure traffic and usage, find and fix bugs, and improve page layout and performance.
6. To meet legal obligations — comply with applicable laws, lawful requests from authorities, and record-keeping requirements.

We do not use your photos or videos to train AI models, we do not publish them, and we do not use them to identify you. We do not create or store facial recognition templates.

Legal bases (EU / UK users)

Where the GDPR or UK GDPR applies, we rely on: performance of a contract for purposes 1–3; legitimate interests for purposes 4 and 5 (operating a secure, reliable and improving service), balanced against your rights; and legal obligation for purpose 6. For people who appear in a photo but are not our customer, we rely on legitimate interests (creating the video the uploader asked for, on the uploader's confirmation that the person agreed), and that person can object at any time — see section 11. Where we rely on consent, you may withdraw it at any time without affecting earlier processing.

5. How your photos and videos are processed

• Photos are uploaded to our cloud storage (Cloudflare R2) so the AI models can read them.
• To render your video, your photos and a text prompt are sent to our AI model provider, Kie AI, which runs third-party image and video models (such as ByteDance Seedance). Some story templates also create intermediate images from your photos before the video is rendered.
• Where a video is produced in several parts, the parts are joined by our video processing provider, Rendi.
• Finished videos are saved to our cloud storage (Cloudflare R2) and stay in My videos for as long as your account exists.
• Our AI model provider deletes the images and videos it generates within 14 days. Our video processing provider's copies are deleted by us as soon as the finished video is saved to our storage, or when the render fails. Providers may keep request logs (such as prompts and task metadata) for longer under their own retention policies.
• The Service is automated. Nobody reviews your photos or videos as part of normal operation; we only look at them when you ask us to (for example, to investigate a broken render) or when needed to investigate abuse or comply with the law.

6. Cookies and analytics

We use a small number of cookies and similar technologies:

• Essential cookies — keep you signed in and remember your language. The Service cannot work properly without them.
• Analytics — Google Analytics measures visits and traffic sources, and Microsoft Clarity records how pages are used (such as clicks, scrolling and page interactions) so we can find usability problems. Clarity is configured by default to mask text you type. These tools set their own cookies and process your IP address and device information.

We do not use advertising cookies and we do not sell your data to advertisers. You can block or delete cookies in your browser settings, and you can opt out of Google Analytics with the Google Analytics opt-out browser add-on. Blocking essential cookies will prevent you from signing in.

7. Who we share your information with

We do not sell your personal data, and we do not share it for cross-context behavioural advertising. We share personal data only with:

• Service providers that process it on our behalf and under our instructions:
  • Cloudflare — website hosting, database and file storage, security and content delivery.
  • Kie AI — access to the AI image and video models that render your video.
  • Rendi — joining multi-part videos.
  • Stripe — payment processing, subscriptions and fraud prevention.
  • Google (Google Analytics) and Microsoft (Clarity) — website analytics.
• Authorities and others where required by law — to comply with a legal obligation, court order or lawful request, or to protect the rights, property or safety of our users, the public or us.
• A successor — if the Service is transferred to another operator, your data may be transferred as part of that transfer, subject to this policy.

8. International transfers

Our service providers operate globally, so your personal data may be stored and processed in countries outside Hong Kong and outside your own country, including the United States. Where required, we rely on appropriate safeguards such as the providers' standard contractual clauses or equivalent commitments, and we choose providers that apply recognised security standards.

9. How long we keep your information

• Account information — for as long as your account exists. When you ask us to delete your account, we delete or anonymise it within 30 days, except records we must keep (see below).
• Uploaded photos — kept while your account is active so you can view your history and re-run failed renders. They are deleted within 30 days after you ask us to delete them or to delete your account.
• Finished videos — kept in your account for as long as it exists, so you can watch and download them again. They are deleted within 30 days after you ask us to delete them or to delete your account. Provider copies are deleted as described in section 5.
• Purchase and payment records — kept for up to 7 years to meet accounting, tax and legal requirements, even after your account is deleted.
• Support messages — kept for up to 2 years after the conversation ends.
• Server logs and analytics — kept for limited periods set by our hosting and analytics providers, generally no longer than 14 months.

10. How we protect your information

We use industry-standard measures to protect personal data, including encryption in transit (HTTPS), hashed passwords, encryption of stored service credentials, access limited to what is needed to run the Service, and providers with established security programmes. No method of transmission or storage is completely secure; if we become aware of a breach that affects your personal data, we will notify you and the relevant authorities where the law requires.

11. Your rights

Depending on where you live, you have some or all of the following rights:

• Access — ask for a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data.
• Deletion — ask us to delete your account, photos and other personal data.
• Portability — receive the data you gave us in a commonly used format.
• Objection and restriction — object to processing based on legitimate interests, or ask us to limit processing.
• Withdraw consent — where processing is based on consent.
• Complain — lodge a complaint with a data protection authority, such as the Office of the Privacy Commissioner for Personal Data in Hong Kong, or the supervisory authority where you live in the EU or UK.

Hong Kong: you may make data access and data correction requests under the Personal Data (Privacy) Ordinance.

California and other US states: you have the right to know, access, correct and delete your personal information, and not to be discriminated against for exercising these rights. We do not sell or "share" personal information as those terms are defined under California law.

People who appear in a photo: if you do not have an account and believe your photo was uploaded to the Service, email contact@zombieaivideo.org with a link to or description of the video. We will ask you to verify that you are the person shown (for example with a current photo, which we use only for this check and then delete), and then delete the photos and videos that show you and tell you what was done.

To exercise any right as an account holder, email contact@zombieaivideo.org from the email address on your account. We may need to verify your identity before acting on your request. We respond within 30 days, and we do not charge for reasonable requests.

12. Children

The Service is intended only for adults aged 18 or over. We do not knowingly collect personal data from children, and photos of children may not be uploaded. If you believe a child has used the Service or that a photo of a child has been uploaded, contact us and we will delete it promptly.

13. Do Not Track

Browsers have no common standard for "Do Not Track" signals, so the Service does not currently respond to them. You can control analytics using the options in section 6.

14. Changes to this policy

We may update this Privacy Policy as the Service or the law changes. We will change the "Last updated" date above and, for material changes, give notice on the site or by email before the changes take effect.

15. Contact us

Questions, requests or complaints about privacy: contact@zombieaivideo.org, or by post to zombieaivideo, Core F, Cyberport 3, 100 Cyberport Road, Hong Kong. We aim to reply within 5 business days.