Privacy Policy

Who is responsible for your data

Tai Hai Ta AI is operated by TODO(site): legal entity name at TODO(site): registered business address. For privacy requests, contact privacy@taihaita.org. Our support address is support@taihaita.org.

Waffo Pancake acts as the merchant of record for payments. It handles card data, tax calculation, receipts, refunds and subscription billing. We do not receive or store your full payment-card number.

Data we collect

Account data: your name, email address, profile image from Google, authentication records, language and display preferences, and account status.

Content and task data: the photo you upload, the selected scene and duration, safety-check results, generation identifiers, generated videos, download activity and content reports.

Payment and order data: the Waffo customer, order, subscription and transaction references needed to provide credits and reconcile refunds. Waffo processes the payment instrument.

Technical and security data: IP address, timestamps, request metadata, device and browser signals, rate-limit signals and error identifiers. We use this data to keep the service available and prevent abuse.

Communication data: messages you send to support, report details, your contact email and the outcome of your request.

How we use photos and videos

Your photo is used to perform automated safety checks, prepare the requested stylized character request and deliver the generated video. We do not use your photo or video to train our own models, and we do not sell them.

The files required for your request are sent to fal.ai and the selected model provider through temporary, purpose-specific links. They are not automatically published to a public gallery.

Why we use your data

We use account and content data to provide the service you request; payment data to fulfil purchases and refunds; technical data to secure the service and prevent fraud or abuse; and communication data to answer support and legal requests.

Where applicable, we rely on performance of our contract, compliance with legal obligations, our legitimate interest in keeping the service secure, and consent where the law requires it.

Service providers and disclosures

We share only the data needed to run the service with Cloudflare (hosting, storage, queues and email delivery), fal.ai and its selected model provider (AI generation), Waffo Pancake (payments and merchant-of-record services), Google (sign-in), the configured content-safety and bot-protection services, and Plausible Analytics (privacy-friendly traffic measurement).

We may disclose data when required by law, to protect users or the public, to investigate abuse, or to enforce our Terms and Acceptable Use Policy. We do not sell personal information or share it for cross-context behavioural advertising.

Retention and deletion

Uploaded photos are deleted automatically 7 days after upload. Generated videos are kept for 30 days after they finish, unless you delete them sooner or a report requires removal. R2 lifecycle rules provide a storage-level backstop.

Order, tax, refund, credit-ledger and security records are retained for the period required for accounting, dispute handling and legal compliance. Account deletion removes active media and account records that are no longer required; a one-way hash may be retained to prevent repeat abuse or bonus misuse.

Security and international processing

Access to private media requires account authorization or a time-limited, purpose-specific link. Data is transmitted over HTTPS. No system is perfectly secure, so use a trusted device and keep your sign-in account secure.

Our providers may process data in countries other than yours. Where required, we use contractual or legal safeguards for international transfers.

Cookies and analytics

The site uses a few cookies and similar browser storage that it needs to work, such as your sign-in session and your light or dark theme preference.

We also set a first-party cookie (vt_attr, kept for 90 days) that records how you first and most recently reached us, such as a referring website or campaign link. We use it only to see which channels lead to sign-ups and purchases, and we do not share it with advertising networks.

If you open a friend’s invite link, we set a cookie (vt_ref, kept for up to 30 days and removed once you sign up) so the invite can be credited. To prevent abuse of invite rewards, we store a salted hash of your IP address with the invite, not the address itself. Neither of you can see the other’s account details.

We use Plausible Analytics to measure aggregate page views and basic traffic sources. Plausible is designed to be privacy-friendly: it does not use cookies, does not build cross-site profiles and does not store your IP address. We use the resulting aggregate reports only to understand which pages and guides are useful.

Children

The service is not directed to children. You must be at least 18 years old to create an account or upload a photo. We do not knowingly collect personal data from children. If a minor’s image was uploaded without guardian authorization, contact privacy@taihaita.org so we can investigate and remove it.

Your rights

Depending on where you live, you may have the right to access, correct, export, delete, restrict or object to processing, withdraw consent, or lodge a complaint with a supervisory authority. In Settings you can export a JSON copy of your account data, delete videos, or delete your account. For other requests, email privacy@taihaita.org.

We may need to verify your identity before completing a request. Legal and accounting records may be retained where an exception applies.

Changes and contact

We may update this policy as the service or legal requirements change. Material changes will be announced in the product. The date at the top shows the latest revision. Privacy questions and requests can be sent to privacy@taihaita.org.