Privacy Policy

1. Who is responsible

The controller of personal data processed through this site is the operator of Bulin 47 Video (“we”). Contact: hello@bulin47video.site.

2. Your photo (early access)

Photos you add in the studio are read and checked (file type, size, resolution, framing) entirely inside your browser. They are not uploaded to our servers, not sent to any AI model or third party, and we cannot see them.

If you click “Save my photo”, a downscaled copy plus the date and policy version of your consent is stored in your browser's local storage on that device only. It stays there until you click “Remove” or clear your browser data. Because this storage happens only on your device at your request, we do not process this data on our side.

3. Face data and biometrics

We do not create face templates, face prints or any biometric identifiers, and we do not use photos to identify anyone. When video generation opens, a photo will only be used to produce the video you request.

Before any photo is uploaded we will update this policy and ask for your explicit consent, including: which processors receive the photo, where they are located, the legal basis (your explicit consent, GDPR Art. 6(1)(a) and, where applicable, Art. 9(2)(a)), and the retention period. Our intended default is to delete source photos automatically within 24 hours of generation and never to use them to train AI models.

4. Data we process when you visit

• Server and security logs (IP address, browser user agent, requested URL, time) kept by our hosting provider for up to 30 days to operate and protect the site — legal basis: legitimate interests (GDPR Art. 6(1)(f)).
• Emails you send us (for example support or takedown requests) — kept as long as needed to handle the request and for legal record-keeping.
• Waitlist: if you join the waitlist we store your email address, language, the page you signed up on and the time you agreed, in our Cloudflare D1 database. We use it only to send you the launch email and founding-member offer (legal basis: your consent, Art. 6(1)(a)). We delete it when you unsubscribe or ask us to, and at the latest 12 months after launch.
• Usage analytics with Microsoft Clarity: pages viewed, clicks, scrolls, device and browser type, approximate location from IP, and masked session replays. The photo studio is excluded from recordings. Cookies are only set if you accept analytics (GDPR Art. 6(1)(a), consent); otherwise Clarity runs cookieless based on our legitimate interest in improving the site (Art. 6(1)(f)). Microsoft keeps Clarity data for up to 13 months (recordings ~30 days unless marked) and acts as our processor under its Data Protection Addendum. See the Cookie Policy.
• Usage statistics with Google Analytics 4: pages viewed, traffic source, device, browser and approximate location (country/city). GA4 does not log or store full IP addresses. It runs with Consent Mode v2 — cookies only after you accept (Art. 6(1)(a)); otherwise only cookieless, aggregated pings. Google acts as our processor under the Google Ads Data Processing Terms; data is kept for 14 months. Google signals and ads personalization are disabled.
• Purchases: payments are handled by Paddle.com as Merchant of Record. Paddle collects your name, email, billing country/postcode and payment details as an independent controller under its own privacy policy (paddle.com/legal/privacy). We receive your email, country, what you bought and the transaction ID — never your card details — to deliver your purchase and provide support (contract, Art. 6(1)(b)), and keep order records as long as tax law requires.
• We use no advertising cookies or ad tracking pixels.

5. Sharing and selling

We do not sell or “share” personal information (as defined in the California Consumer Privacy Act) and we do not use it for targeted advertising. We disclose data only to service providers needed to run the site — Cloudflare (hosting and security), Paddle (payments), Google (Analytics) and Microsoft (Clarity analytics) — under data processing agreements, or when legally required.

6. International transfers

If a service provider processes data outside your country (for example outside the EU/EEA), we rely on appropriate safeguards such as the EU–US Data Privacy Framework (Cloudflare, Google and Microsoft are certified) or the European Commission's Standard Contractual Clauses.

7. Your rights

Depending on where you live (EU/EEA and UK GDPR, California CCPA/CPRA, Brazil LGPD and similar laws) you can request access, correction, deletion, restriction, portability, or object to processing, and withdraw consent at any time without affecting earlier processing. Email us and we will respond within the legal deadline (generally one month). We will not discriminate against you for exercising your rights.

You also have the right to complain to your local data protection authority.

8. Children

This service is only for people aged 18 or older. Do not upload photos of anyone under 18. If we learn that a minor's data or image has reached us, we delete it.

9. Security

The site is served only over HTTPS. Because your photo never leaves your device during early access, the main protection is your own device: use “Remove” on shared computers.

10. Changes

We will post changes here with a new effective date. Material changes (such as starting to upload photos) will require fresh consent in the studio. See also the Terms and Cookie Policy.