Privacy Policy

1. Controller

RapFlow AI (the "Service", at rapflowai.com) acts as the controller for personal data handled on the site. Contact: support@rapflowai.com.

2. What data we process

• Uploaded photo and description: Your image and prompt exist solely so we can build the clip you asked for.
• Generated video: You may play and download the result. We do not publish your photos or clips ourselves. If you turn on a share link, anyone with that link can watch the finished video until you turn the link off. Source photos are not on that page. A failed or blocked render cannot be shared.
• IP address: Your IP is kept only as a hash, never in clear text, so we can apply free-render caps and stop abuse.
• Technical cookie: A cookie holding a random id ("rapf_gid") ties output to your browser. That lets you reopen your clips and keeps the free cap honest. It holds no personal fields and is never used for ads. When you register, we attach that id to the account only so we can measure how free renders convert into sign-ups and sales.

Guests can render without signing up. Once you register or buy credits, we also handle:

• Account data: email, display name, a hashed password, and a session cookie that keeps you logged in.
• Google sign-in (optional): if you pick "Continue with Google", Google (Google Ireland Limited) sends us your name, email and avatar so we can open or create the account. Your Google password never reaches us. The one-tap Google prompt appears only after you press "Accept" on the cookie bar (EEA, UK and Switzerland; in other regions it is enabled by default, see section 5). Transfers to the USA may occur under the EU-US Data Privacy Framework.
• Credits and orders: remaining balance, spend history, and each purchase (item, sum, date).
• Payments: Waffo is merchant of record for credit packs and handles checkout. Card numbers never arrive here; Waffo only reports whether the charge cleared.

Account, credit and order records support the paid product under GDPR Article 6(1)(b). Order rows stay as long as tax and bookkeeping law requires under GDPR Article 6(1)(c). Email us any time to close the account.

3. Purposes and legal bases

We need your photo and prompt to deliver the clip you ordered. That step relies on GDPR Article 6(1)(b). Hashed IPs, the technical cookie and the safety screen rest on a legitimate interest in a safe free tier without abuse (GDPR Article 6(1)(f)). The cookie is strictly needed for the product under TDDDG Section 25(2).

4. Recipients and service providers

• AI processing: Image and prompt go to Kie.ai, our AI vendor, which builds the clip with a model. Files on their side are wiped after 24 hours. Work may run outside the European Union.
• Payments: Waffo (waffo.ai) runs checkout as merchant of record. Card data you type there is covered by Waffo's own privacy notice.
• Safety check: before display, every upload and finished clip is screened by Gemini (Google). See our Acceptable Use Policy. If Gemini is unavailable, the OpenAI Moderation API reviews the upload instead. We keep only the pass/fail outcome, never beside your image. The basis is a legitimate interest in blocking illegal or harmful material (GDPR Article 6(1)(f)). Work may run outside the European Union.
• Hosting and security check: Cloudflare serves the site. Cloudflare Turnstile stops bot traffic. Cloudflare Web Analytics counts visits and load times with no cookies, no device storage and no profiles. That rests on a legitimate interest under GDPR Article 6(1)(f).

5. Analytics

Inside the EEA, the UK and Switzerland, analytics plus the one-tap Google prompt start only after you press "Accept" on the cookie bar, as set out below. Elsewhere they start by default. You can shut them off any time under "Cookie settings" in the page footer, and we respect a Global Privacy Control (GPC) signal from your browser.

After you press "Accept" on the cookie bar we load two tools: GA4, operated by Google Ireland Limited, plus Clarity, operated by Microsoft Ireland Operations Limited. They show how people move through the site, which URLs get traffic and where the editor feels awkward. Both drop cookies and handle usage facts such as pages opened, clicks, scroll depth, device and browser class, and a rough location. Transfers to the USA may occur; both vendors hold EU-US Data Privacy Framework certification. Clarity masks the editor zone (your photo, prompt and clip) so those pixels are never recorded.

Campaign links: when you land via a tagged campaign URL (for instance from a creator clip), we remember that tag (e.g. "youtube" or the creator name). On registration the tag is stored on the account so we can attribute the channel and pay partner fees. The browser keeps the tag up to 30 days only if you pressed "Accept"; otherwise it lives only for the open tab. Linking it to the account rests on a legitimate interest in measuring marketing channels under GDPR Article 6(1)(f).

Consent is the basis under GDPR Article 6(1)(a) and TDDDG Section 25(1). Choosing "Decline" loads no analytics scripts. Change your choice any time under "Cookie settings" in the page footer.

6. Retention

Uploaded images are wiped after 24 hours. Per-render rows (time, status, hashed IP) stay only while needed for free-cap checks, abuse defence and debugging.

7. Your rights

GDPR Articles 15 through 21 cover access, correction, deletion, limited processing, portability and objection. You may also complain to a supervisory authority. To use these rights, write to support@rapflowai.com.

8. Photos of other people

Upload only images you are allowed to use. Images of other people require their permission. Do not upload a minor's photo without a parent or guardian's consent.

9. Children

RapFlow AI is not directed at children under 13 (or the higher minimum age where you live). We do not knowingly collect their data. If you believe a child provided data or a minor's photo was uploaded without guardian consent, email support@rapflowai.com and we will delete it.