Privacy Policy
Last updated: 23 October 2026
- We use your photo only to make the video you ordered.
- We never store your original photo. It stays on your phone until you have paid. Then it is sent to our AI processor, and it is deleted as soon as your video is finished.
- We do not use your photo or video to train AI, and we do not build face databases or use your face to identify you.
- Your finished video is kept for 7 days behind a private link, and then it is deleted permanently.
- There is no account, no advertising and no tracking. The site sets no cookies.
1. Who is responsible
The controller for this website (peek-a-boo.elevateweb.ro) is CIORAN A. RADU-FLORIN PERSOANĂ FIZICĂ AUTORIZATĂ, 48384070, Bucureşti Sectorul 1, Bulevardul BUCUREŞTII NOI, Nr. 136, PARTER, Ap. 5, Romania. Email: [email protected].
2. What we process, why and for how long
| Data | Purpose | Legal basis (GDPR) | How long |
|---|---|---|---|
| Your photo | To create the video you ordered | Art. 6(1)(b) (performing our contract with you) and Art. 6(1)(a) (your explicit consent before payment) | While you pay, the photo stays only on your device. After payment it passes through our server's memory (never saved to disk) and is uploaded to our AI processor. It is deleted there as soon as your video is finished or the job fails. The processor also automatically removes all job inputs within about 1 hour. |
| Your generated video and a still image from it | So you can watch, download and share your video | Art. 6(1)(b) | 7 days, then deleted automatically. You can ask us to delete it earlier. |
| Your email address (optional) | To send you the link to your video | Art. 6(1)(b), at your request | Deleted together with the video after 7 days. Never used for marketing. |
| Order record: a random order ID, the chosen scene, timestamps, the version of the consent text you accepted and the Stripe payment reference | To prove your consent and to handle refunds, disputes and legal obligations | Art. 6(1)(c) and (f) (legal obligations, defending legal claims) | Up to 3 years. It contains no photo, video or email address. |
| Technical data (IP address, browser type, time of request) | Security, preventing abuse (rate limiting) and running the service | Art. 6(1)(f) (legitimate interest in a secure service) | Held in memory for a maximum of 1 hour for rate limiting. Server logs are kept for up to 14 days. |
3. No biometric identification, no AI training
An AI model uses your photo once, to create a video likeness of you in the scene you chose. We do not use your photo to recognise or identify you, and we do not create face templates or face databases. We do not use your photo or your video to train or improve any AI model. Our processor may use your data only to carry out our instructions.
4. Payments
Payments are handled by Stripe through Stripe Managed Payments. Stripe acts as merchant of record and collects your payment details, name, email and billing address directly on its own checkout page. Stripe processes that data as an independent controller under its own privacy policy. We never see your card details. We only receive a confirmation that the payment succeeded, together with a payment reference.
5. Who receives your data
- Replicate, Inc. (USA) runs the AI model that creates your video. It receives your photo and the template video, and it acts as our processor.
- Cloudflare, Inc. (R2 storage) stores your finished video for 7 days, as our processor.
- Sendinblue SAS / Brevo (France) sends the email with your link, if you ask for it. It acts as our processor.
- Cyber_Folks SRL hosts our server and acts as our processor.
- Stripe handles payment as an independent controller (see section 4).
We do not sell or rent your data, and we do not share it with anyone else unless the law requires us to.
6. Transfers outside the EU
Replicate and Cloudflare are based in the USA. Transfers to them rely on the EU–US Data Privacy Framework, where the provider is certified, and/or on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can ask us for a copy of the relevant safeguards.
7. Storage on your device
This site uses no cookies. To make the payment step work without uploading anything early, your browser keeps the following on your own device:
- Your photo, in IndexedDB, only while you are on the Stripe payment page. It is deleted once it has been sent, or after 24 hours at the latest.
- Your language choice, plus a random order ID and access key, so you can reopen your video and email its link from this phone.
This storage is strictly necessary for the service you requested (Art. 5(3) ePrivacy Directive), so no consent banner is needed. You can clear it at any time in your browser settings. Stripe's checkout page may set its own cookies, as described in Stripe's policy.
8. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR). Where we rely on your consent, you can withdraw it at any time with effect for the future. To use your rights, for example to have your video deleted early, email [email protected] and include your video link.
You can also lodge a complaint with a supervisory authority: in Romania, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP, dataprotection.ro), or the authority in your country of residence.
9. Age
The service is only for people aged 16 or older. Please do not upload photos of children.
10. Security
All connections are encrypted (HTTPS). Videos are stored in a private bucket and can only be opened through long, random links that work for a limited time. Your photo is never written to our server's disk.
11. Changes
We may update this policy if the service or the law changes. The date at the top always shows the current version.