Privacy Policy

1. Introduction

This Privacy Policy explains how Inflictor AI ("Service", "Platform", "we", "us", "our"), accessible at inflictor.ai, collects, uses, stores, and protects your personal information. By using the Service, you consent to the practices described in this policy.

We are committed to protecting your privacy and handling your data responsibly. We collect only what is necessary to operate the Service and never sell your personal information to third parties.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address — provided directly or via Google/Apple Sign-In
• Full name — if provided through your Google or Apple account
• Profile picture URL — if provided through your Google or Apple account
• Authentication identifiers — unique user IDs assigned by our authentication provider

2.2 Uploaded Content

When you use the generation feature, we collect:

• Source Images — photographs you upload containing human faces. These are processed (resized, converted to WebP format) and stored in private cloud storage for the purpose of generating your requested content.

2.3 Generated Content

We store references to the output of the generation process linked to your account, including:

• URLs to face-swap images
• URLs to generated videos
• Generation job metadata (status, timestamps, selected template, generation parameters)

2.4 Transaction Data

When you purchase tokens, we collect:

• Purchase amount and token package selected
• Stripe checkout session ID and payment intent ID
• Transaction history (credits, debits, reservations, refunds)

We do not collect or store your credit card number, CVV, or full billing details. All payment processing is handled by Stripe.

2.5 Automatically Collected Information

When you use the Service, we may automatically collect:

• Browser and device information — browser type, operating system, screen resolution
• Language preferences — detected via your browser settings, used to display the Service in your preferred language
• Usage data — pages visited, features used, generation history
• IP address — for security, fraud prevention, and approximate geolocation

3. How We Use Your Information

We use the information we collect to:

• Provide the Service — process your uploads, generate content, deliver videos to your account
• Manage your account — authenticate you, maintain your session, display your profile
• Process payments — handle token purchases, manage your token balance, process refunds
• Improve the Service — analyze usage patterns, diagnose technical issues, improve generation quality
• Communicate with you — send transactional notifications (generation complete, payment confirmed), respond to support requests
• Ensure security — detect and prevent fraud, abuse, and unauthorized access
• Comply with legal obligations — respond to lawful requests from authorities where required

We do not use your Source Images or Generated Content to train AI models. Your uploaded images are used solely to fulfill your specific generation requests.

4. How We Store Your Information

4.1 Account and Transaction Data

Account information, generation job records, token balances, and transaction history are stored in our database hosted by Supabase, which uses encrypted PostgreSQL databases with secure infrastructure.

4.2 Source Images

Uploaded Source Images are processed server-side (resized to a maximum of 1024px, converted to WebP) and stored in a private Google Cloud Storage bucket. These images are not publicly accessible. Access is restricted to our server-side processes for the purpose of generation only. Source Images are automatically and permanently deleted 7 days after upload. This means we do not retain your uploaded photographs beyond the time needed to complete your generation request and allow for video retries.

4.3 Generated Content

Generated face-swap images and videos are produced by and stored on the infrastructure of third-party AI generation providers. Inflictor AI does not host Generated Content on its own servers. We store only the URLs linking to your Generated Content in our database so that you can access it from your account. The availability and retention of Generated Content is subject to the storage policies of these third-party providers, which means Generated Content may become unavailable over time. We recommend downloading any videos you wish to keep.

4.4 Data Retention

• Account data is retained for as long as your account is active.
• Source Images are automatically deleted 7 days after upload. No user action is required.
• Generated Content is hosted by third-party AI generation providers and may be subject to their own retention policies. URLs are stored in your account for as long as your account is active. You may delete individual generation jobs from your archive.
• Transaction records are retained for a minimum period as required by applicable tax and financial regulations, even after account deletion.

Upon account deletion, we will delete your personal data and generation records within 30 days, except where retention is required by law. Source Images will already have been deleted per the 7-day automatic deletion policy.

5. Third-Party Services

We rely on the following third-party services to operate Inflictor AI. Each has its own privacy policy governing how they handle data:

We use third-party AI generation providers to produce face-swap images and videos. These providers receive your Source Image and template parameters necessary to generate your content. Generated Content (images and videos) is hosted on these providers' infrastructure. We may change providers at any time to improve quality or reliability; this policy applies regardless of which specific provider is used.

We share only the minimum data necessary for each service to perform its function. We do not sell, rent, or trade your personal information to any third party.

6. Cookies and Local Storage

Inflictor AI uses cookies and similar technologies for:

• Authentication cookies — to maintain your logged-in session across pages and visits. These are essential for the Service to function and cannot be disabled.
• Language preference — to remember your selected language.

We do not use advertising cookies or tracking pixels. We do not serve ads on the platform.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — Request a copy of the personal data we hold about you.
• Correction — Request correction of inaccurate or incomplete data.
• Deletion — Request deletion of your account and associated personal data, Source Images, and Generated Content.
• Data portability — Request your data in a structured, machine-readable format.
• Objection — Object to certain types of data processing.
• Withdrawal of consent — Withdraw consent for data processing at any time, where consent is the legal basis.

To exercise any of these rights, contact us at support@inflictor.ai. We will respond within 30 days.

7.1 European Economic Area (EEA) Residents

If you reside in the EEA, you have rights under the General Data Protection Regulation (GDPR). Our legal basis for processing your data is:

• Contractual necessity — to provide the Service you signed up for (account management, generation, payments)
• Legitimate interests — to improve the Service, ensure security, and prevent fraud
• Consent — where you explicitly opt in (e.g., marketing communications, if any)

You also have the right to lodge a complaint with your local data protection authority.

7.2 California Residents

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA):

• The right to know what personal information is collected, used, and shared
• The right to delete personal information
• The right to opt out of the sale of personal information — we do not sell personal information
• The right to non-discrimination for exercising your privacy rights

8. Children's Privacy

Inflictor AI is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have collected data from a person under 18, we will delete that data and terminate the associated account promptly.

It is a violation of our Terms & Conditions to upload images of minors to the platform.

9. Security

We take reasonable technical and organizational measures to protect your personal data, including:

• Encrypted data storage and transmission (HTTPS/TLS)
• Private cloud storage for Source Images with no public access
• Secure authentication via Supabase with session management
• Webhook signature verification for payment and generation callbacks
• Timing-safe comparison for cryptographic operations
• Service role key separation between client-side and server-side database access

No system is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

10. International Data Transfers

Your data may be processed and stored in countries outside your country of residence, including the United States and the European Union, through our third-party service providers. Where data is transferred internationally, we rely on appropriate safeguards such as Standard Contractual Clauses or the service provider's compliance with recognized data protection frameworks.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page. Continued use of the Service after changes are posted constitutes your acceptance of the updated policy.

We encourage you to review this Privacy Policy periodically.

12. Contact

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us at:

Email: support@inflictor.ai
Website: inflictor.ai/contact

By using Inflictor AI, you acknowledge that you have read and understood this Privacy Policy.