bulin47-ai.me privacy policy

This bulin47-ai.me privacy policy explains photo and face-data processing, account information, linked evidence and your choices. Contact support@bulin47-ai.me for privacy, access or deletion requests.

Information and purposes

Information	What it includes	Purpose
Account	Email, account identifier, authentication records, password hash when used, and profile details shared through Google sign-in	Sign-in, verification and access to your tasks
Photo and face data	The uploaded image and visible facial appearance used for safety checks, identity reference and any scene-image editing	Screen the submitted photo and carry out the particular generation request
Temporary sign-in draft	A privately saved pre-sign-in photo, permission/notice versions and draft times	Restore the selected photo through sign-in for up to 30 minutes before it is claimed
Generated media	Edited template images, the video, task identifiers and processing states	Generate, provide private access and support the result
Permission and evidence	Declaration/version, original upload, output, review results, user ID, timestamps and IP bound to the task	Authorization evidence, safety, complaints and disputes
Purchases, credits and refunds	Pack, amount, payment reference/status, credit grants, deductions, returns, refund-linked credit removals and correspondence	Deliver purchased credits, account for generation and reconcile payment refunds
Support and reports	Contact details, messages, reported links and claim information	Support, rights requests, complaints and enforcement
Technical activity	Request IP, device/browser information, errors, access events and times	Deliver and secure the service
Optional analytics and attribution	Public-page interactions, selected campaign parameters, first referral source and landing path, analytics client/session identifiers and internal account/order identifiers	Understand discovery and use and associate permitted interaction events with the relevant account or order, subject to the applicable choice

We do not need private media, email addresses, passwords or signed download links in analytics events. Do not include unrelated private information in a photo or initial support request.

Face data: generation, evidence and no identity matching

Facial appearance is used to process this generation request: the photo is checked and supplied as the identity reference, with scene-image editing if needed. The service supplies a built-in, silent line-drawing video processed to mask identifying features as the motion reference. The model generates a new full-colour scene; the original colour recording, soundtrack and a separate portrait of the original performer are not sent. There is no user or administrator source-video submission field.

We do not use your face data to train AI models, submit it as training feedback, build a face library, identify you against other people or compare your identity across users. Input safety classification is used to assess prohibited subjects and content; it is not account identity verification or a promise that age or rights have been certified.

The photo is not repurposed for another user's generation. We do not publish on your behalf or use your photo or result in marketing without separate permission. The restricted evidence copy described below has a separate authorization, safety and dispute-handling purpose; that is why the photo is not necessarily erased when generation finishes.

Checks and private video access

Once attached to your signed-in account, the submitted photo receives checks before generation, including visual safety classification through Kie.ai. A photo may therefore be sent for classification even if it is subsequently rejected and never used for editing or video generation. Unavailable required safety services block generation before credits are charged; failed or unknown checks do not pass. Any edited scene images are checked before use. A completed video is available privately while background video safety review and synthetic-media detection continue; it may be withdrawn if prohibited content is found. Review information and enforcement actions are part of the linked evidence record. Content-checking services receive the media needed for their checks.

Temporary drafts and twelve-month linked evidence

Before sign-in, a selected photo stays in browser memory unless you save it as a private sign-in draft on our servers. The photo is not persisted in browser local storage or IndexedDB; a necessary browser cookie supports draft recovery. An unclaimed draft is kept for 30 minutes from saving, then scheduled for deletion. While it remains an unclaimed draft, it is not sent to model or safety-check providers and is not a formal account evidence record.

A signed-in photo upload starts a formal evidence record lasting 12 calendar months from that upload. If you instead claim a saved draft after sign-in, the period starts when the photo is bound to your actual account at that claim. The original permission time is preserved. Once claimed, the photo follows the formal evidence schedule and is not deleted under the draft’s 30-minute limit.

Each generation task also starts its own 12-calendar-month record when that task is reserved. The permission record, original photo, edited images, video and derived exports, review results, user ID, timestamps and IP are linked to the relevant records. A photo used by several tasks remains until all its linked evidence periods have ended and any valid preservation hold has been released; starting another task with it can therefore extend its actual retention.

Access is restricted to authorized people and systems handling authorization, safety, complaints and disputes. These records are not a public gallery or an analytics feed. Eligible records and media are scheduled for expiry and cleanup when their applicable periods end. A documented legal preservation requirement may retain the necessary subset for longer; the reason and access are recorded and the hold is reviewed. A support or deletion request is not treated as proof that every retained or provider-held copy has already been erased.

Account closure and media withdrawal are separate actions. We can revoke access to a video without immediately destroying evidence needed for a complaint. Non-required account information can be removed separately from the user identifier and evidence still retained for the stated purpose.

Services receiving information

The service configuration uses the following recipients for their stated roles. Information leaves your device; this is not on-device-only processing.

Recipient	Information and role
Cloudflare Workers, D1 and private R2	Website delivery, account/task/evidence records and private media storage
Google sign-in	Authentication and permitted profile information when you choose Google
Kie.ai and relevant model providers	Pre-generation visual safety classification of the submitted photo, including photos later rejected; identity photo, any scene-image editing, built-in processed line-drawing motion video and generation instructions
SeeAPI	Image, prepared-text and background video checks, task and moderation records
Sightengine	Planned auxiliary nudity/deepfake checks on media or sampled frames; commercial processing remains disabled until the applicable entitlement is verified
Resend	Verification and transactional messages and their delivery information
Lark	Support, privacy and complaint email, including information you send; recipient email addresses, message content (including verification links) and delivery information for backup verification and transactional messages
Google Analytics 4	Optional page and interaction/conversion analytics using internal identifiers
Microsoft Clarity	Optional heatmaps and session replay, with private media and identity areas masked or excluded

Replicate is a moderation backup rather than an assumed active recipient. Live payment processing is not open. Stripe, PayPal and Waffo are planned, independently controlled channels. When enabled, the selected provider receives the order, amount, currency and payment/refund details needed for that transaction; payment details are handled through that provider. Credit grants, video deductions/returns and refund-linked removals are recorded separately in the service’s ledger. We may share necessary information to meet legal obligations or handle a rights complaint. Relevant complaint information may be supplied to an affected party where needed for the notice process or a response; reports are not a public feed.

Provider retention is separate

Our 12-month evidence schedule does not set every provider's retention period. SeeAPI's published policy states that stored inputs, outputs, task information and moderation results have no scheduled automatic expiry, while API request records and logs are retained for 60 days. SeeAPI accepts support deletion requests; revoking our URL or deleting an R2 object does not delete copies it already retrieved. See SeeAPI Data Handling & Privacy.

Kie.ai's API documentation describes a 14-day period for generated media and two months for text and related task metadata. The generated-media period does not establish a deletion period for all uploaded photos or copies held by underlying model providers. See Kie.ai Getting Started. This is separate from the site's evidence copy and from any model provider's own processing. SeeAPI also states that it does not use API inputs or outputs to train models. Kie.ai and its underlying model providers have separate data-use terms. Ask support for help identifying the providers and pursuing deletion for a particular task.

Account, analytics and other records

Account information is used while you maintain an account and when necessary to complete requested account actions. Payment, tax and dispute records may be retained as required for those purposes and applicable law. Support and enforcement records are kept for handling the relevant matter, with the linked generation evidence subject to the schedule above.

After analytics acceptance, a first-visit record may be linked to your account and orders. Its browser cookie lasts for the shorter of 30 days or the remaining analytics-choice period. A separate HttpOnly cookie links the valid choice to actual analytics client/session identifiers held on the server, so permitted events can be associated with that browser session. This optional association expires no later than the 180-day choice; withdrawal stops its use for delivery, and its stored analytics client/session identifiers are removed at the next scheduled cleanup. Account/order records and restricted media evidence follow their separate purposes and schedules above.

GA4 event data is configured for two months and user data for 14 months, with its user-activity reset setting enabled. Those data-retention settings differ from browser-cookie lifetimes. Optional analytics load only after acceptance on public pages, not on authentication or private pages. Operational order and safety records needed for the service are separate. Clarity processes interaction data under its retention settings and terms. The Cookie Policy lists the actual browser-record names, providers, lifetimes, expiry/withdrawal behaviour and your choices.

Purposes, legal bases and transfers

Where EU or UK data-protection law applies, requested account and generation processing relies on performance of the contract; security, proportionate safety checks, complaint handling and evidence retention rely on legitimate interests where appropriate; accounting and legally required handling rely on legal obligations. Optional analytics rely on consent where required. Processing a third person's image still requires an applicable basis and the necessary permissions; the upload declaration alone does not replace them.

Providers may process information outside your country. Applicable locations and transfer arrangements depend on the service and provider. Contact support about a particular transfer or the safeguards that apply. Use is not presented as a blanket waiver of transfer protections.

Access, deletion and complaints

Email support with the account email and relevant task reference to ask for access, a copy, correction, account closure or deletion. Do not send a password or card number. We may verify account control before disclosing information or taking destructive action.

We assess deletion requests under applicable rights and explain what can be removed, any restricted evidence or legal hold retained, and any provider deletion request that is still pending. You can also ask about portability, restriction, objection, withdrawing consent or appealing a privacy decision where those rights apply. Withdrawal does not undo earlier lawful processing. Requests are handled within applicable legal time limits, and you may complain to a competent regulator.

Photo subjects, security and updates

A submitted subject must be at least 18, have reached legal adulthood where they live and not be a celebrity or public figure. You need the photo rights and, for another person's likeness, their explicit permission for AI-generated images and videos. Report a photo that does not meet these conditions through Report.

We use HTTPS, private-media access controls and restricted evidence access. We provide legally required breach notices where applicable and publish material policy updates here with notice where required.