Privacy policy

What this policy covers

Rap Duo Video is operated by Wei Yang ("we", "us"), 5161 Lankershim Boulevard, North Hollywood, CA 91601, USA, who runs the website rapduovideo.com, where you upload face photos and get back a short AI-generated rap video of the people in them, and who is responsible for the personal information described here. This policy explains which personal information the site handles, why, who else touches it, how long it is kept and what you can ask us to do with it.

It applies to the website, its account area and the emails we send. Sites we link to, such as the payment page Stripe hosts for us, have their own policies.

Your photos, in brief

• Photos are used for one thing: making the video you asked for, plus the safety checks that come with it. We never publish them, sell them or use them to train AI models.
• Before a photo leaves your device it is shrunk and re-saved as a plain JPEG, and its original file name is never sent to us.
• We delete uploaded photos from our storage automatically after 30 days.
• To render the video, the photos go to Replicate, which runs the AI video and music models for us. Replicate deletes the inputs, outputs and logs of each render about 1 hour after it finishes.
• Photos of anyone who appears to be under 18 are rejected, and you may only upload people who agreed to it.

Information we collect

• Account details: your email address and name, and the profile picture Google or GitHub shares if you sign in with them. With email sign-in we store a hash of your password, never the password itself.
• What you create: the photos you upload, the optional topic you type, the lyrics we write from it, the stage and quality settings you pick, the finished videos, and the time you ticked the box confirming you may use the photos.
• Purchases: what you bought, when, the amount and the Stripe reference. Card numbers are entered on Stripe's page and never reach our servers.
• Messages: support tickets and emails you send us, with our replies.
• Usage data: pages viewed, buttons used, the referring site or campaign, device and browser type, and an approximate country derived from your IP address. A session cookie keeps you signed in; your browser's local storage remembers the theme and a draft of the studio while you sign in.

How we use it

We use this information to run your account, write and render your videos, check uploads and results for safety, take payments and keep the credit balance right, send receipts and "your video is ready" emails, answer support requests, stop fraud and abuse, and understand which pages and features work so we can improve them.

The legal grounds are the contract with you (making what you ordered), our legitimate interest in a safe, working service, your consent where the law asks for it, and our legal duties such as keeping tax records. We do not sell personal information and we do not share it for cross-site advertising.

Who processes your data

A few companies do work on our behalf. Each one receives only what its job needs:

• Cloudflare hosts the site on Workers and stores accounts in D1 and files in R2, and forwards mail sent to our support address.
• Replicate, LLC (101 Townsend St, San Francisco, CA 94107) runs the video models, and the image moderation model that checks photos and finished videos. It receives your photos, the lyrics and the render settings.
• Some of the models Replicate runs for us are made by other companies, whose models process only what they need: ByteDance and Google receive your photos and the scene prompt to make the scene image or the video; Kuaishou receives the generated scene image, with your face or your pet in it, to animate it to a reference dance, or, for the ChatGPT millionaire skit, to turn it into a 13-second talking video that speaks the skit's lines in a voice its AI generates; MiniMax receives the lyrics to sing them, never your photos.
• Amazon Web Services, through Amazon Bedrock running a model by Anthropic, writes the lyrics and performs our text and image checks: the topic, the lyrics, whether a photo shows a real adult face or, for the skit, one real dog or cat with no people, and frames sampled from the finished video.
• Stripe takes payments and handles refunds and disputes.
• SendGrid, a Twilio company, delivers our emails.
• Google provides "Sign in with Google" and Google Analytics 4; GitHub provides "Sign in with GitHub"; Plausible gives us cookie-free visit statistics.

We may also disclose information when the law requires it, to protect people from harm, or to a buyer if the service changes hands, who would remain bound by this policy.

Retention and deletion

• Uploaded photos are deleted from our storage 30 days after upload.
• Replicate removes the inputs, outputs and logs of each render about 1 hour after it completes; we copy the finished video to our own storage within that hour. Because nothing is left with Replicate by then, closing your account needs no deletion request to it.
• Frames we sample from a video for the safety review are deleted after one day.
• Your videos stay in your account until you delete them or your account is deleted.
• When you delete your account we remove your profile, photos, videos and lyrics. Order and payment records are kept for as long as tax and accounting law requires.
• Google Analytics data expires after 14 months.

Security

All traffic uses HTTPS. Photos and videos sit in private storage and are only served through short-lived signed links that work for your account. Passwords are hashed, payment details stay with Stripe, and staff access to user data is limited to support and safety work. No system is perfectly secure; if a breach affects you, we will tell you and the relevant authorities as the law requires.

Your choices and rights

You can delete any video from your account at any time and cancel a plan whenever you like. You can also ask us for a copy of your data, to correct it, to delete it along with your account, or to stop a particular use of it. Depending on where you live (for example the EU, the UK or California), these are legal rights, and you may also complain to your data protection authority. We do not sell data, so there is nothing to opt out of on that front.

If someone uploaded a photo of you without asking, write to us and we will remove the video and the photos together. To limit analytics, block cookies in your browser or use a tracker blocker; the site keeps working without them.

Children

The service is for adults aged 18 and over. Every uploaded photo is checked, and a photo of anyone who appears to be under 18 is rejected before any video is made. If you believe a child's data reached us, contact us and we will delete it.

International processing

Our providers process data in the United States and in other countries where they run data centres; Cloudflare serves the site from locations close to each visitor, and the Bedrock checks run in the US East region. Where European or UK law applies, these transfers rely on the providers' standard contractual clauses or an equivalent safeguard.

Changes and contact

When this policy changes, the date at the top changes too, and we tell account holders by email about any change that matters before it takes effect. Questions, data requests and photo complaints go to support@rapduovideo.com, or by post to Wei Yang, 5161 Lankershim Boulevard, North Hollywood, CA 91601, USA. The terms of service and the refund policy cover the rest of how the service works, and the pricing page lists what each plan and pack costs.