Privacy Policy

1. Who controls your data

PhotoThaw is the data controller for the personal data described in this policy.

2. What we collect

• Account data — your name, email address and profile picture, provided by Google when you sign in.
• Content you upload — the photos you submit and the videos generated from them.
• Generation data — the model and settings used, timestamps, and whether the generation succeeded.
• Credit and payment data — your balance, transaction history, and records of purchases. We do not receive or store your card details.
• Technical data — IP address, browser type, and similar information used for security and to prevent abuse.

3. Why we use it

• To provide the service — running your generations and returning results.
• To manage your account and credits.
• To take payment and comply with tax and accounting rules.
• To keep the service secure and prevent fraud or abuse.
• To respond to support requests.
• To improve the service, using aggregated and de-identified information.

4. Where your data goes — please read this

To generate a video, we must send your photo to a third-party AI model provider. This means your photo leaves our systems and is processed by that provider, which may be located in a different country.

Our current model providers include WaveSpeedAI (Singapore) and other similar services. We choose providers that offer commercial API terms, but their handling of your photo is also governed by their own privacy policies.

By uploading a photo, you accept that it will be transferred to these providers for processing.

Photos of people are special. A photo of a person's face is sensitive data in many jurisdictions, and generating a video from it is a form of processing that data. We use it only to create the video you asked for; we do not use it to identify anyone, build profiles, or train our own models. Because this processing is inherent to the service, we rely on your consent and on performing the service you requested — and you can withdraw by deleting the photo or closing your account.

5. Other third parties we use

• Google — signing in with your Google account, and Google Fonts for the website's typefaces.
• Cloudflare — the website itself (Workers), file storage (R2), and network protection.
• Neon — the managed PostgreSQL database that holds your account and generation records.
• Upstash — managed Redis used for job queues and abuse-prevention rate limits.
• Railway — the server that runs the generation service.
• WaveSpeedAI — the AI model provider that produces your video (see section 4).
• Waffo — our payment provider. Card details are handled entirely by them; we never receive them.

6. Cookies and local storage

We use your browser's local storage to keep you signed in. We do not use advertising cookies or sell data to advertisers.

7. How long we keep things

• Uploaded photos — kept until you delete them or close your account. You can delete any photo from your account page at any time.
• Generated videos — the free download link is provided by the model provider and expires after a short period (about 7 days). We do not store those files ourselves. If you use "Save to cloud", a copy is stored in our own storage until you delete it or close your account.
• Account data — name, email and profile picture are kept while your account is active. When you close your account, they are erased and the account is anonymised.
• Purchase, subscription and credit records — kept after closure for accounting and tax purposes. They identify a closed account by number only, with no name, email or photos.
• Server logs — kept for a short period for security and troubleshooting.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent.

You can delete any photo yourself from your account page, and you can close your entire account — which erases your photos, videos and personal details — from the same page. For access, correction or export requests, or anything else, contact us.

To exercise any of these, contact support@photothaw.com. You also have the right to complain to your local data protection authority.

9. Children

The service is not intended for children. We do not knowingly collect data from anyone under 18.

10. Security

We use industry-standard measures to protect your data, including encryption in transit and access controls. No system is perfectly secure, and we cannot guarantee absolute security.

11. Changes and contact

We may update this policy. Material changes will be announced on the website before they take effect. Contact: support@photothaw.com