Privacy Policy

Introduction

We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use and safeguard your information when you use 58th Floor AI Video (the "service"). Please read it before using the service.

Who is responsible for your data

58th Floor AI Video is operated by an independent individual developer based in mainland China (UTC+8) — see About. That operator is the data controller for the personal data described in this policy and can be reached at support@58thflooraivideo.org.

The operator's full legal name and postal address are available on request from the same address, for compliance, tax and law-enforcement purposes. No data protection officer is appointed (not required at our scale); privacy requests sent to the same address are handled directly by the operator.

Information we collect

We collect the following to provide and improve the service:

1. Account information — your name (optional), email address and credentials when you create an account. If you sign in with a third-party identity provider, we receive the email address and basic profile attached to that account.
2. Your prompt, reference photo and generated video — the text prompt you submit, the photo you upload (if any) and the video generated from them. The photo is used only to run and deliver your generation. You may only upload your own photo, or one you have explicit permission to use — see Acceptable Use.
3. Usage data — how you interact with the service: features accessed, frequency of use, interaction patterns.
4. Device information — device type, operating system, browser type, and a coarse country-level location derived from your connection.
5. Safety-check records — for every submission, an automated moderation record: what was checked, which policy categories matched, a confidence score, and a one-way hash of the request.
6. Payment information — your email address and order data (amount, payment status). Card data is processed exclusively by our Merchant of Record and PCI-DSS payment processor, Waffo Pancake, and never reaches our servers. We never store full card numbers.
7. Cookies — a few first-party cookies (see below). We do not use third-party advertising or tracking pixels.

Cookies and similar technologies

• Strictly necessary — keeping you signed in. Cannot be turned off.
• Preference — your language choice. Can be turned off.
• Analytics — first-party usage statistics and attribution, stored in our own database. Can be turned off.
• Marketing — we do not use marketing cookies today.

Our first-party analytics runs on our own infrastructure and respects the Do-Not-Track browser setting. If we ever enable a third-party analytics service, we will name it here and link its privacy policy.

How we use your information

• Running the service (generating, storing and delivering your clips) — performance of a contract.
• Billing and payment (via our Merchant of Record, Waffo Pancake) — performance of a contract.
• Customer support — performance of a contract / legitimate interests.
• Service notices (delivery, security alerts, policy updates) — legitimate interests.
• Safety, moderation and abuse prevention — legitimate interests.
• Product analytics (first-party) — legitimate interests.
• Legal compliance — legal obligation.
• Marketing — consent; we do not send marketing email today.

We may aggregate or de-identify data for statistical purposes; such data cannot be linked back to you.

Data sharing

We do not sell your personal information. We share data only in these limited cases:

• Processors (bound by confidentiality and data-processing terms):
  • Video moderation (SeeAPI) — prompts, reference images and generated output are sent for automated safety checks. SeeAPI does not train on this data, but its default policy has no automatic expiry, so copies may persist until a deletion request is made.
  • AI model provider (xAI, via the SeeAPI gateway) — your prompt and uploaded photo are sent to the provider that runs your generation (currently Grok Imagine Video, xAI). The provider processes them to return the generated video; we do not authorise using your input to train models (Terms 9.2).
  • Prompt moderation (Waffo Prompt Sift) — when Waffo is the merchant of record, the prompt text is sent for a pre-generation content-safety check.
  • Object storage, hosting and database (Cloudflare R2 / Workers / D1) — uploaded photos, generated videos and generated task records are stored in our own Cloudflare account so download links keep working.
  • Merchant of Record & payments (Waffo Pancake) — order and payment data (amount, status, your email). Card data never reaches our servers.
• Legal obligations — to comply with law, court orders or lawful requests from public authorities.
• Rights and safety — to protect our rights, property or safety, or that of our users.
• Business transfers — in a merger or acquisition, with advance notice and continued protection of your data.

Data security

We implement industry-standard measures: encryption in transit (TLS/HTTPS), credentials stored hashed, access controls, and automated plus manual safety checks on submissions. No method of transmission over the internet is 100% secure, but we work continuously to protect your information.

If a security incident affects your rights or personal data, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of it, as required by law.

Data retention

We keep personal information only as long as we need it for the purposes described in this policy, and then delete or anonymise it.

• Generated videos are deleted from our storage about 30 days after delivery — after that the download link stops working.
• Uploaded photos are kept only to run and deliver your generations. They are deleted when you request deletion (see "Your rights" below) or removed under our Takedown process.
• Account data is kept while your account is open. When you delete your account (or ask us to), we remove your personal information within 30 days, except where a legal exception below applies.

Legal exceptions. A small set of records is kept beyond a deletion request where the law requires it:

• Moderation and safety records — what was checked, which policy categories matched, a confidence score and a one-way hash of the request. These exist to detect repeat abuse, to stop removed content being recreated, and to answer valid legal requests. For text we may also keep a short excerpt so a decision can be reviewed; for images and video we keep only the hash, never the media.
• Child safety — where we detect apparent child sexual abuse material, we are legally required to report it to the relevant authorities (in the United States, the National Center for Missing & Exploited Children) and to preserve the associated records. This obligation overrides a deletion request and does not expire.
• Financial records — orders, payments and invoices are kept as long as tax and accounting law requires.

These records are never used for advertising or profiling. If we cannot fully honour a deletion request for one of the reasons above, we tell you which one applies.

Your rights

Email support@58thflooraivideo.org to exercise any of the following rights; we respond within 30 calendar days:

• Access — get a copy of your personal information.
• Rectification — correct inaccurate or incomplete information.
• Erasure — have your data deleted in specific situations.
• Restriction — ask us to pause processing in specific situations.
• Portability — receive your data in a machine-readable format.
• Objection — object to processing based on legitimate interests or marketing.
• Withdraw consent — withdraw consent previously given.
• Complaint — complain to your local data protection authority.

Minors

You must be at least 18 years old to use the service. We do not knowingly collect personal information — including photos — from anyone under 18. If you believe a minor has provided information to us, please contact us and we will delete it promptly.

Cross-border transfers

Our infrastructure and processors may be located in the United States and other countries, so your information may be transferred internationally. Where that happens, we rely on safeguards such as the EU Standard Contractual Clauses and our processors' contractual commitments. You can ask us (same contact address) which providers handle your data and where they are located.

Third-party links

Our pages may link to third-party websites or services. This policy covers only the information we collect directly; we are not responsible for third parties' privacy practices. Please review their policies before using them.

Changes to this policy

We may update this Privacy Policy from time to time. We will announce material changes at least 15 days before they take effect — through the service or your registered email — and update the "last updated" date on this page. Continuing to use the service after the new version takes effect means you accept it.

Payment processing

Payments are handled by third-party payment processors. When Waffo Pancake acts as our Merchant of Record, it is the seller on your statement and the controller of the payment data it collects, under its own privacy policy; our other payment channels (card, Alipay, WeChat Pay) are processed by their respective providers on the same basis.

We never receive or store full card numbers, CVV codes or bank credentials on our servers. We receive only transaction metadata (amount, currency, transaction ID, status) and keep order and invoice records for accounting and tax purposes.

Contact us

• Privacy contact and data controller: the operator described in "Who is responsible for your data" above — support@58thflooraivideo.org (English and Chinese; we reply within 2–3 business days, China time UTC+8).
• Or use the contact page.