Privacy Policy

1. Who is responsible

NexusGrowth LLC (Delaware, United States) is the controller of the personal data described here. You can reach us through the contact page.

2. What we collect

Account data

When you create an account we store your name, your email address, whether that address has been verified, and — if you sign in with Google — the profile image URL Google returns and the identifier that links your DoneVid account to your Google account. If you sign in with a password, we store a cryptographic hash of it, never the password itself.

Session data

Each sign-in creates a session record holding a session token, its expiry, and the IP address and browser user-agent string the session was created from. This is what keeps you signed in and lets us detect an account being used from somewhere it should not be.

What you create

We store the prompts and settings you submit, the model you chose, the state and result of each run, the Credit cost applied, any files you upload as input, and the images and video the models produce for you. Output files are held in cloud object storage together with their size, type, dimensions and a checksum.

Billing data

We store your Credit balance and a ledger of how it changed — releases, consumption and restorations. When you buy something, we store the identifier your payment is linked to at our payment processor, the plan or Pack purchased, and the state of the subscription. We never receive or store your full card number, expiry date or security code. Those go directly to the payment processor.

Attribution data

When you first arrive we record how you got here: the referring source, medium and campaign values in the link, any advertising click identifier, the first page you landed on, the country your request came from and whether you were on a desktop or a mobile device. This is attached to a visitor identifier and, if you later sign up, to your account.

Abuse-prevention data

To stop automated abuse we keep counters of recent activity and a record of each decision to allow, challenge or reject a request. The IP address is stored in these records as a salted hash, not in readable form. Sign-up and some actions may be protected by a bot-detection challenge served by a third-party provider.

Diagnostic data

When something breaks, an error report — the technical error, the page it happened on, and the account identifier it happened to — is sent to our error-monitoring provider so we can fix it.

3. Why we process it

• To provide the service — running your generations, keeping your work, keeping you signed in. This is necessary to perform our contract with you.
• To take payment and account for Credits — necessary to perform our contract and to meet our accounting obligations.
• To keep the service safe — preventing fraud, abuse and automated attack, and enforcing the Acceptable Use Policy. This is our legitimate interest in a service that is not being abused.
• To fix and improve the product — error reports and aggregate usage. Our legitimate interest in a service that works.
• To understand how people find us — the attribution data above. Our legitimate interest in knowing which of our own channels work.
• To meet legal obligations — including responding to lawful requests and reporting illegal material.

4. Who we share it with

We do not sell personal data and we do not share it for cross-context behavioural advertising. We use service providers who process data on our instructions:

• AI model providers. To run a generation we send your prompt, your settings and any input file you supplied to the provider hosting the model you chose. Their handling of that data is governed by their own terms.
• Cloud hosting and infrastructure — for running the application, its database and its background processing.
• Cloud object storage — for the files you upload and the output you generate.
• Our payment processor — Stripe, which handles card details and processes payments and refunds.
• Error monitoring and bot protection providers — for the diagnostic and abuse-prevention data above.

We may also disclose data where the law requires it, to protect someone’s safety, or as part of a merger or acquisition — in which case this policy continues to apply until you are told otherwise.

5. International transfers

We operate from the United States and our providers may process data in the United States and elsewhere. Where data is transferred out of the European Economic Area or the United Kingdom, we rely on the standard contractual clauses or another lawful transfer mechanism in our agreements with those providers.

6. How long we keep it

• Account data — while your account exists, and for a short period afterwards so an accidental closure can be undone.
• Your generations and files — until you delete them or your account is closed. We do not offer a zero-retention mode: your work is stored so that you can come back to it.
• Billing records — for as long as tax and accounting law requires us to keep them, which is normally several years after the transaction.
• Session, abuse-prevention and diagnostic records — for a limited period, long enough to investigate an incident.

7. Your choices and rights

Depending on where you live you may have the right to access a copy of your data, to correct it, to delete it, to restrict or object to processing, to data portability, and to withdraw consent where processing rests on consent. To exercise any of these, write to us through the contact page from the email address on your account. We answer within the time the applicable law allows, and we will not treat you differently for asking.

You can also close your account at any time, which deletes the account and the work stored under it, subject to the billing records we are required to keep. If you are in the European Economic Area or the United Kingdom, you have the right to complain to your data protection authority.

8. Cookies and similar technology

We use cookies and equivalent browser storage for two things: keeping you signed in, and holding the visitor identifier that the attribution data above is attached to. Bot protection sets its own token when a challenge is shown. We do not run third-party advertising or cross-site tracking cookies.

9. Security

Traffic is encrypted in transit with HTTPS, passwords are stored only as hashes, IP addresses in abuse records are hashed, card details never reach our systems, and access to production data is limited to the people who need it. No service can promise perfect security, and we do not claim to hold a security certification we have not been audited for.

10. Children

DoneVid is not for children. You must be at least 18 to use it, and we do not knowingly collect data from children. If you believe a child has given us data, tell us and we will delete it.

11. Changes to this policy

If we change how we handle personal data we will update this page and change the date at the top. If a change is material we will give notice on the site before it takes effect.