Privacy Policy

Version 1.4 · Updated October 22, 2026

AI Zombie Video is operated by 长沙云之乐贸易有限公司, a company based in China. The website domain is www.zombievideoai.app and the privacy contact is [email protected]. This policy describes how information is handled when you use the service, including account access, media processing, credit purchases, delivery and support.

For this service, the company operator is responsible for deciding how personal information is processed. Business correspondence address: Unit 628, Building 11, Jiayu Yinshan, Yueliangdao Subdistrict, Wangcheng District, Changsha, Hunan, China.

1. Information and purposes

We do not build a facial-identification database or independently verify identity using portraits. Photos can still contain sensitive information, and models process facial features. Submit only authorized material compatible with the access conditions below.

2. Media processing

Selected-photo previews remain in the browser before submission. After submission, originals are archived in a separate private R2 bucket and processed input copies are created. Inputs used by models have public links; generated images and delivered videos may also have public links. Anyone holding a link may be able to access that object. A private original does not revoke public copies or prevent others from saving accessible content.

Tasks may send inputs directly to MiniMax or process images through Volcengine Ark before video generation, together with necessary prompts, roles and specifications. We also send the task’s image and video text instructions to Waffo for pre-generation prompt safety checks, with a language hint and checking mode. We do not add user photographs, generated media, account email or user identity to these text-check requests. We retain decision metadata, prompt hashes and request identifiers in task and audit records; existing task snapshots also contain the generation instructions. See AI and Model Disclosure. Originals, processed copies, intermediate assets and results have different access conditions; this is not an end-to-end private or encrypted media service.

3. Providers

The designated transactional sending domain is mail.zombievideoai.app. The customer-support and privacy contact remains [email protected]. Customer-support correspondence is accessed and handled using Gmail, separately from transactional delivery; mailbox and forwarding services used to deliver that correspondence may also process it. Do not infer that customer-support correspondence is processed by Resend solely because Resend sends account notifications.

Necessary service emails concern account security or the service you requested. They are distinct from optional marketing. If marketing is introduced, its purpose, lawful basis and withdrawal or unsubscribe mechanism must be disclosed separately.

Our own forms do not collect full card numbers or card security codes. Payment providers may collect payment and billing details directly under their conditions. Google sign-in does not give us your Google password.

We do not sell personal information or portraits. We do not authorize a provider to use your portrait in our advertising merely because you submitted a generation task. We do not independently train our own models on uploads. Third-party retention, model-improvement settings and international processing are governed by the applicable provider account and agreement. We do not promise that all providers retain no data or never use it for model improvement. Contact us for information about the providers used for a specific task or for help with a provider-held copy.

4. Cookies and browser storage

Authentication cookies and related state support sign-in, security and language preferences. Session storage holds checkout request identifiers to prevent duplicate orders, not card details. Disabling necessary storage may interfere with these functions.

Necessary sign-in and security storage is distinct from optional analytics or advertising. Optional integrations in the code are not evidence that they are enabled. Before optional tracking is activated, the applicable provider, purpose and controls must be disclosed and consent obtained where required. We do not currently offer a separate optional-tracking consent manager.

5. Retention, deletion and security

You may keep reference photos and creations in your account for continued access and recreation until you request deletion or account closure. We do not automatically erase your media after a fixed 30- or 90-day period. Storage is not a permanent backup guarantee; download results you need. Financial, security and dispute records are assessed separately and are not erased by deleting a media file. Deleting media does not erase the related order, credit or security record. Requests concerning account closure, service discontinuation, backups or provider-held copies are handled through support; copies retained to meet legal obligations or resolve disputes are assessed separately.

Depending on applicable law, you may request access, correction, deletion, account closure, restriction, a portable copy of information, or object to certain processing. Where processing relies on consent, you may withdraw it for future processing without changing the lawfulness of earlier processing. Email the privacy contact to make a request. After proportionate identity checks, we aim to respond or explain progress within 30 days, subject to shorter legal deadlines. We will explain records retained for financial, security or dispute obligations. Use Media and privacy to request deletion of stored portrait groups or creation assets. Deletion waits until active tasks finish. The worker removes controlled storage objects and purges configured public caches; unavailable storage or cache configuration leaves the request pending for administrator attention. Account closure, record exceptions, backups and AI-provider coordination require manual handling.

Deleting a creation removes its results and task references. A portrait still present in your photo library or referenced by another creation is not physically erased by deleting one creation; request deletion of the portrait separately. Deleting a portrait removes its original and processed input group, but does not automatically delete already generated creations. Request those creations separately if needed.

Deleting objects we control does not necessarily erase downloaded, cached or independently retained copies. Requests must consider originals, processed inputs, results and relevant backups; we do not promise instant worldwide deletion.

Measures include password hashing, authenticated sessions, access checks, separated storage and accounting audits. If a personal-data incident occurs, we will assess the affected information, contain the incident and provide notices to affected people and authorities where applicable law requires them. These do not eliminate every risk. Authorized administrators can access relevant records and assets for their duties.

6. Processing grounds, international handling and minors

Where applicable privacy law requires a lawful basis, processing may be necessary to provide the requested service, comply with legal obligations, protect service security and resolve disputes, or rely on consent where required. Security and dispute handling must be proportionate and account for your rights. A general acceptance of terms is not a substitute for consent required for a particular processing purpose. The operator is based in China, while hosting, storage, AI, email and payment providers may process information in other countries. Processing locations and available safeguards depend on the provider and service selected for your task. Contact us before uploading if you need information about a particular location or transfer arrangement; we do not promise processing in a single country.

The service is for adults and does not accept portraits of minors for generation. Report concerns to the privacy contact for investigation. Age eligibility is based on user acknowledgments; we do not independently verify age from identity documents or automatically infer it from portraits.

7. Requests and changes

Contact [email protected] with your request, account email and relevant task/order reference. Do not send passwords, full card details or unrelated identity documents. You retain the right to contact an applicable privacy or consumer authority.

Media is retained for continued account use until a deletion or closure request, rather than automatic expiry after 30 or 90 days. Other records are retained according to their purpose, outstanding disputes and applicable legal obligations. We do not promise a fixed deletion period for third-party backups or provider copies; support will explain the applicable handling and any limits when responding to a request.

Material changes will be announced with a new version. Any required new consent must precede processing for a new purpose. See the Terms and Support and Contact.