Privacy Policy

What data RemixFlick collects, how photos are processed and how long we keep them.

1. Who is responsible for your data

RemixFlick is an independent studio based in Shenzhen, Guangdong, China, operated by an individual and not a registered company. We are the controller of the personal data described in this policy. Full operator details are available on request at support@remixflick.com.

Contact for privacy questions or requests: support@remixflick.com.

This policy explains what we collect when you visit remixflick.com, buy a video, upload photos, generate a video or contact support. It does not apply to third-party websites or apps you reach from our Service.

2. Who can use the Service

The Service is intended for people aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has used the Service, contact us and we will delete the relevant data.

3. What we collect and why

We collect only what we need to run the Service.

Data	When	Why we use it
Email address	Guest checkout, account sign-up, support, order recovery	Create and deliver your order, send the private order link and receipts, provide support and handle refunds
Account details (name, email, avatar, password hash)	If you sign in with email/password or Google	Create and secure your account, show your history and credits, prevent abuse
Photos you upload	When you use a template	Generate your video; route the image to the AI model that renders the scene
Generated videos and task data (template, prompt, status, credits used, timestamps)	When you generate	Deliver, store and let you download your video; provide remakes, refunds and support; prevent fraud
Order and payment data (order number, product, amount, currency, payment status, payment-provider transaction ID)	When you pay	Process payments, reconcile orders, issue credits and refunds, keep accounting records. Card numbers are handled by our payment provider, not us
Guest order access token (stored only as a hash)	Guest checkout	Let you return to your order without an account; valid for 30 days
Essential technical data (request ID, page path, HTTP status, duration; IP address used transiently for rate limiting)	Every request	Keep the Service secure and available, prevent abuse and debug errors. We do not write IP addresses into our application database
Support messages	When you contact us	Answer your question and keep a record of the resolution

We do not use your uploaded photos to train our own models. We instruct our AI providers to process them only to generate the video you request. Photos may contain faces, which can be sensitive personal data; we use them for generation and support, not to identify people.

We do not require your real name, address, ID number or date of birth. If you sign in with Google, we may receive the display name and avatar from your Google account. Do not send us identity documents unless we specifically ask and explain why.

4. Cookies and similar technologies

We use only essential cookies and local storage, including:

Authentication session cookie — keeps you signed in.
Guest order cookie (rf_guest) — lets a guest buyer access their own order; HttpOnly, expires after 30 days.
Sign-in security cookies — short-lived cookies set during email or Google sign-in to protect the login flow.
Locale preference (NEXT_LOCALE) — remembers whether you use English, Chinese or another supported language.
Local photo draft — stores a photo locally in your browser so you can return to the maker after signing in or paying. It stays on your device and is cleared on success or when it expires.

We do not currently use advertising cookies, cross-site tracking pixels or third-party analytics. If we introduce analytics or advertising tools, we will update this policy and, where required by law, ask for your consent first.

5. Who receives your data

We share personal data only with service providers that help us run the Service, or where the law requires it. These providers process data on our instructions and under their own contractual and security obligations:

Cloudflare — object storage for photos and videos (Cloudflare R2), DNS and email routing.
Stripe or another payment provider shown at checkout — payment processing, card data and fraud checks. The provider receives your payment details directly; we receive transaction and order information.
fal.ai and other AI model providers we may use — your uploaded photo and the template prompt are sent to the provider so it can generate the video.
Resend — transactional email delivery (order links, receipts, support messages), when email is configured.
Google — if you choose “Sign in with Google” (authentication and your name, email and avatar), and as the provider of the inbox that receives and stores messages sent to support@remixflick.com.
Our hosting and infrastructure providers — to serve the website and keep it secure.

We may also disclose data if required by law, legal process or a competent authority, to protect our rights or the safety of others, to investigate fraud or abuse, or as part of a transfer of the business (subject to this policy).

We do not sell your personal data and do not share it for cross-context behavioural advertising.

6. International transfers

We and our providers may process data in countries other than your own, including the United States and the European Union. Where required, we rely on appropriate safeguards such as standard contractual clauses or an equivalent legal mechanism. You can contact us for more information about the safeguards used for a specific transfer.

7. How long we keep data

Data	Retention
Uploaded photos	Deleted automatically from our object storage 7 days after upload. Our cleanup job runs daily. Some copies may remain briefly in backups or provider systems before they are overwritten
Generated videos and task records	Kept while your order or account remains active so you can download, remake or seek support, and until you ask us to delete them. Guest order access links expire after 30 days
Account details	Until you close your account or ask us to delete it
Order, payment and tax records	Kept for as long as required by accounting, tax, anti-fraud and consumer-protection law, even after your account is closed
Support messages	Kept while needed to resolve the request and for dispute, accounting or legal purposes; normally no more than 24 months
Technical logs	Our own application logs are normally kept no more than 90 days; hosting and network providers may keep their own logs under their policies

When data is no longer needed, we delete it or anonymise it. Deletion from backups may take longer and is completed on the normal backup cycle.

8. How we protect data

We use HTTPS, access controls, hashed guest tokens and hashed passwords, and we limit access to production systems. Uploaded files are stored in Cloudflare R2 and are not listed in our public pages; anyone with a file URL may still be able to open it, so do not share your order link or file URLs publicly.

No method of transmission or storage is completely secure. If we become aware of a breach that affects your rights, we will notify you and any authority as required by law.

9. Your rights

Depending on where you live, you may have the right to:

access the personal data we hold about you;
correct inaccurate data;
delete your data, including your photos, videos and account;
restrict or object to certain processing;
receive a portable copy of the data you provided;
withdraw consent where we rely on consent; and
complain to your local data-protection authority.

To exercise a right, email support@remixflick.com from the address used for the order or account, and include your order number if you have one. We may need to verify your identity (for example by confirming control of the email address) before acting. We will respond within the time required by applicable law.

You can also ask us to delete a generated video or your account. Deleting a video removes it from the active system; order, payment and tax records may be retained as described above.

10. Automated decisions and AI

We use AI models to generate videos. This is a creative generation process, not profiling or an automated decision that produces legal or similarly significant effects about you. Outputs can be unexpected or imperfect; you decide whether to download, use or publish them.