Privacy Policy
How Vibopop handles account information, uploaded portraits, generated videos, payments, and privacy requests.
Version 1.0 · Effective date and last updated: October 5, 2026
Vibopop is an independent AI video service operated by Enzo at vibopop.com. This policy explains how we handle personal information when you browse the website, create an account, upload portraits, generate videos, make purchases, or contact support. For privacy questions and requests, email support@vibopop.com.
Data controller: Enzo, the individual operator of Vibopop. Privacy contact: support@vibopop.com.
1. Information we process
- Account information: your email, name, profile image if provided, verification status, and authentication records. Email/password sign-in stores a password hash rather than your readable password. Google sign-in provides the profile information needed to create or authenticate your account, such as your name, email, and avatar.
- Uploaded content: portraits and other files you upload, file names, file types, sizes, storage references, and ownership information. A portrait may identify you or another person; upload it only with the necessary rights and permission for AI processing.
- Generation records: your selected template, cast assignments, resolution, generation inputs, task references, status, errors, generated video segments, and completed MP4 output.
- Payment and credit records: purchaser and order references, product or price identifiers, payment status, billing period, cancellation state, credit balances, and usage history. Waffo collects payment and billing information directly at checkout; we do not collect or store full card numbers or security codes.
- Technical information: request URLs, IP addresses, browser and device information, session identifiers, and operational logs used to deliver and secure the service. Cloudflare processes standard request information as our hosting provider.
- Support communications: the email, message, and attachments you choose to send, including order or task references needed to investigate an issue.
2. Purposes and legal bases
We use account information to authenticate you; uploads and generation records to deliver requested videos; payment and credit records to fulfill purchases and manage subscriptions; and messages to provide support and handle refunds or privacy requests.
We rely on our legitimate interest in understanding and improving website performance for proportionate, cookieless traffic statistics, subject to your right to object and any consent requirement under applicable law. We use technical records to prevent fraud and unauthorized access, recover interrupted tasks, and investigate errors. We may retain necessary records to meet legal obligations and resolve disputes. We do not sell your personal information or use your portraits for advertising.
Where applicable law requires a legal basis, we rely on performance of our agreement for requested services, legitimate interests for proportionate security and operations, legal obligations for required records, and consent where required for optional processing. Where consent is the basis, you may withdraw it by contacting us; withdrawal does not affect prior lawful processing.
3. AI processing of portraits
In live generation, Vibopop sends the portraits you select, reference material, and generation instructions to Kie.ai, our AI API provider, for the selected model; the current template uses MiniMax H3. The provider receives time-limited links allowing it to retrieve the necessary media. Provider task identifiers and output are returned to us so we can complete your request.
The purpose is to create the requested synthetic video, not to authenticate your identity. AI processing can transform your likeness and may produce imperfect results. Obtain the depicted person's permission before uploading their portrait, including permission for third-party AI processing and your intended use of the output. Do not upload children's portraits or sensitive identity documents.
When the interface explicitly identifies a demo or fixture mode, it returns prepared sample videos and does not send your portraits to a live AI generation request.
Our storage and deletion controls apply to data held by Vibopop. AI providers and their model providers have their own processing and retention practices; deleting a file here does not by itself prove deletion of a copy already processed by a provider. Contact us about a provider-side deletion request so we can assist through the relevant provider channels.
We do not use your portraits or outputs to train our own AI models without separate, explicit consent. This statement does not override a third-party provider’s policies. We do not send marketing emails unless you opt in; you may withdraw that choice at any time. Account, payment, security, and support messages remain service communications.
4. Recipients and third parties
We disclose information only as needed for the service, support, security, or legal obligations:
- Cloudflare: hosts the website and application, stores account and task records in D1, and stores uploaded and generated media in R2. Cloudflare also provides service infrastructure and transactional email delivery.
- Kie.ai and the selected model provider: process necessary media and instructions to perform live AI video generation, as described above.
- Waffo Pancake: processes checkout, recurring billing, payment verification, receipts, and payment refunds. For purchases through its Merchant of Record service, the Waffo entity identified at checkout is the transaction's seller and handles its own payment records under its privacy policy.
- Google: authenticates you if you choose Google sign-in. Google receives information necessary for that sign-in and operates under its own privacy policy.
- Authorized support personnel and lawful recipients: may access relevant records to resolve a request, protect the service, or comply with a valid legal requirement. In a business transfer, relevant data may transfer subject to continued privacy protections and any required notice.
Third-party websites reached through outbound links have their own policies. We do not make your portraits or videos public by default, and we do not disclose them to other customers as part of ordinary service use.
5. Cookies and local storage
The website uses session cookies to keep you signed in, along with locale and interface preferences stored in cookies or browser storage. These support authentication and the operation of the website. Blocking necessary cookies may prevent sign-in or other functions.
We use self-hosted Umami at umani.fastscribe.org for cookieless traffic statistics: page paths, referrers, browser, device type, and approximate location. The tracker excludes URL query parameters and fragments and respects the browser’s Do Not Track setting. Umami uses request information to derive anonymized statistics without advertising cookies; see Umami’s data explanation. We do not send portraits, videos, account emails, or payment card data as analytics event properties. Self-hosted statistics have no automatic expiry and are kept until manually deleted. You may enable Do Not Track, block the statistics script, or contact us to object. Where applicable law requires consent, optional analytics must remain disabled until consent is obtained. We do not enable advertising trackers or chat tracking. If we introduce optional tracking, we will update this policy and obtain consent where required before enabling it. You can clear cookies and local storage in your browser settings; doing so does not delete server-side account information.
6. Retention and deletion
| Data | Retention rule |
|---|---|
| Uploaded portraits, generated videos, and segments | Until you delete the file, corresponding work, or account; removed from active private storage when deletion succeeds. Portraits must be deleted separately from a completed work. |
| Account and application records, including minimal task and credit records | While your account remains open; account deletion removes the account-linked records from the application database. Cancelling a subscription alone does not delete your account. |
| Login session | Expires after 7 days without refresh; active sessions can be refreshed or revoked. |
| Language preference cookie | Up to 400 days, unless cleared or replaced earlier. |
| Cloudflare Workers logs and traces | Up to 7 days in Cloudflare's current observability service. |
| Support correspondence | Up to 90 days after the request is closed; relevant records may be held longer for an unresolved dispute or a legal obligation. |
| Payment-provider and AI-provider records | Held by those providers under their own policies and legal obligations; our deletion controls do not delete their separate records. |
You can delete uploaded files in file settings, completed works through the studio's work controls, and your account in security settings. In-progress or review tasks must be completed or resolved before account deletion so that a provider cannot later recreate your media. Contact support for assistance or a provider-side deletion request. Deleting your account does not cancel a Waffo subscription; cancel renewal through billing settings first.
7. Security and international processing
We use access controls, authenticated media access, private storage, time-limited provider links, and HTTPS for the public website to protect information. Access to user media is limited by account ownership and operational needs. No system can guarantee absolute security; do not upload material you are not authorized to share.
Our infrastructure and service providers may process data outside your country. Where legally required, appropriate transfer safeguards must apply, such as recognized contractual safeguards or an applicable adequacy arrangement. You may contact us for information about processing locations and safeguards relevant to your request.
If a personal-data breach occurs, we investigate and contain it, and notify affected people and the competent authority without undue delay when legally required, within the applicable notification deadline.
8. Your choices and rights
You may update account details, delete available files and works, cancel renewal, and request account deletion through the corresponding controls. Depending on your location, you may also have rights to access, correct, erase, or obtain a copy of your information; restrict or object to processing; withdraw consent; and complain to your local data protection authority.
Send requests to support@vibopop.com, preferably from your account email, describing the request. We may ask for proportionate verification of identity before disclosing or deleting data and will respond within 30 calendar days, or a shorter period required by law. If an extension is legally permitted and necessary, we explain the reason and expected response date within the initial period. Some information may need to be retained for legal obligations or another lawful exception, which we will explain where applicable.
9. Children, changes, and contact
The service is intended for adults aged 18 and over. We do not knowingly collect information from children for this service. If you believe a child has provided personal information or someone uploaded a portrait without permission, email us so we can investigate and take appropriate action.
We publish policy changes with a version and revision date. We give at least 15 days’ notice of material changes through the website or email, except where law or an urgent security requirement needs an earlier change. Version 1.0, October 5, 2026, describes the current video service, providers, retention, and rights procedures.
Privacy, support, and rights requests: support@vibopop.com. See also About Vibopop and our Terms of Service.