Privacy Policy

You sign in with Google. From Google we receive your email address and the ID of your Google account, nothing else: no password, no contacts, no profile picture. We keep both with your account, which holds your credits, your videos and your purchases. The email address is where we send “your video is ready”.

Signing in sets one cookie in your browser. It only says that this browser is signed in, lasts 30 days, and is removed when you sign out. The site sets no advertising or tracking cookies.

If you pick photos before signing in, your browser keeps them in its own storage while you are at Google, for half an hour at most, and removes them when you are back. They are not sent anywhere until you start a video.

When you start a video, the photos you chose are uploaded to our server and sent to the providers of the AI models that make it (Volcano Engine, the Seedream image model, on servers in China, which puts two photos into one picture; and APIMart, an API service for AI video models, which fetches the picture through a one-time address and passes it to the operator of the model). We use the photos for nothing else. We delete our copies, and the picture made from them, 24 hours after the video is made or has failed. The finished video is stored on our server for 30 days and then deleted. Anyone who has a video’s link can watch it, so share the link only with people you want to.

Upload only photos of yourself, or of adults who agreed. Anyone can report a video with the link under it; a reported video is hidden while we look at it.

With a video we keep which account made it, when it was made and whether it succeeded, for up to 90 days after the video is deleted, and a record of the credits your account received and spent for as long as the account exists.

Our hosting provider, Cloudflare, serves the pages. Our server counts page visits by page, country and referring site, and interface events such as opening the upgrade box (the event, the spot on the page and the country). It also keeps a short code made from your IP address and browser, which changes every day, so the pages one person opens on one day, and a checkout they start, can be counted together; the IP address itself is not kept. Our own page code measures how long each page stays visible on your screen and how far down you scroll, and sends those two numbers with a random number made for that page load. It reads nothing you type or load. It does not store your IP address or your browser’s user-agent text, and the site sets no cookies of its own.

Card payments are handled by Waffo, our merchant of record. We never see your card details. With an order we keep which account started it, the email address and country entered at checkout and the amount paid, to add the credits to your account and to answer support and refund requests. Our payment system also emails a license key for every order; you do not need it here, because your credits are in your account.

The first time you open a page of this site, the page writes one small note into your browser’s local storage: the website you came from (host name only, such as “google.com”, or “direct” if there is none), the utm_source, utm_medium and utm_campaign values if the link had them, the path of the page you landed on (without anything after a “?”), and the date. Nothing is sent when the note is written. It leaves your browser only if you press a buy button: it then goes with that order to our server and is kept with the order, so we can see which websites bring buyers. It never holds your emails, anything you typed, your IP address or the full address you came from, and values that look like an email address or a long number are left out. After 90 days a new visit replaces it. Clearing your browser data deletes it.

If you pay with USDT we keep, with the order, the wallet address you paid from, the transaction hash, the network, the amount, the time, and the email address if you chose to give one in the payment panel (it is optional). The address, hash, network, amount and time are already public on the blockchain. They are kept for as long as other order data (see “How long we keep data”). When you open the USDT payment panel, our server also keeps, with the quote, a keyed one-way hash of your IP address (for IPv6, of its /64 network), only to limit how many quotes one visitor can request per hour; it is kept with the quote record.

To confirm your payment, our server asks public blockchain nodes (PublicNode and dRPC for BNB Smart Chain and Polygon) and TronGrid (for TRON) which USDT transfers have reached our receiving address. Those requests carry our own address, block numbers and, if you paste a transaction hash, that hash, all public blockchain data. We send them no personal information about you.

Depending on where you live (for example under the GDPR or the CCPA), you can ask us what personal data we hold about you, get a copy of it in a machine-readable file, have it corrected or deleted, ask us to stop or limit using it, and withdraw any consent you gave. Email support@waistheartai.com from the address of your Google account, so we can find your account. Deleting your account removes your videos and your remaining credits. We reply within 30 days. Deleting an order also deactivates its license key. Where the law requires us to keep a payment record we keep only that, and Waffo, as the seller, keeps its own records under its privacy policy. You can also complain to the data protection authority where you live.

Order records (email, country, amount, how you first arrived, and the encrypted license key) are kept while the license can be used and for as long as we need them to resend keys, handle refunds and meet legal requirements; you can ask us to delete them sooner. Orders that were never paid are deleted about 90 days after they expire, incoming USDT transfers that match no order after 90 days, and records of payment notifications after 400 days. Visit counts, time on page and the one-day visitor code are kept for up to three months; the code changes every day and holds no IP address. Support emails are kept for as long as the matter needs.

Our server and database run on Cloudflare’s global network, so data may be processed in a country other than yours. Card payments are processed by Waffo.

Waist Heart AI is not directed at children under 16 and we do not knowingly collect their personal data. If you think a child has given us data, email support@waistheartai.com and we will delete it.

When this policy changes we update it here and change the date at the top of the page.

Questions about privacy: support@waistheartai.com.