Privacy Policy

Who we are

Bicep Heart AI turns one photo of an adult into a seven-second video of a bicep heart pose. This policy explains what we collect, who processes it, how long we keep it, and what you can ask us to do with it.

It covers this website and the render service behind it. It does not cover other sites you reach from here.

The short version

• We collect the photo you upload, the video we generate from it, and the account and payment records needed to run the service.
• Your photo is sent to our rendering vendor to produce the video. That vendor and its model provider process it outside our systems.
• We delete uploaded photos from our storage after seven days. You can delete a generated video yourself, at any time.
• We do not use your photo or your videos to train models, and we do not sell them.
• We do not keep your full card number. Payments are handled by the provider you choose at checkout.

Information we collect

Account data. Your name, email address, and authentication records. If you sign in with a third-party identity provider, we receive the identifier and email address that provider releases to us. We never receive your password for that provider.

Uploaded photos. One image per render, plus its file size and format.

Generated videos. The MP4, its duration, resolution and aspect ratio, and the task record that ties it to your account.

Orders and credits. The pack you bought, the amount, the currency, the payment provider, the order status, and the credits granted or spent. Card and bank details are entered on the payment provider's page and are not stored by us.

Technical data. IP address and user agent are used for rate limiting and abuse prevention. Server logs record request paths, status codes and errors. We do not log photo contents or photo URLs.

Messages you send us. Support tickets and email, including any attachment you choose to add.

Uploaded Photos

You upload a photo through the generator. It goes to our object storage (Cloudflare R2) and is stored under a fingerprint of its contents, so the same file uploaded twice is stored once. The URL is derived from that fingerprint: it is not listed, not indexed, and not linked from any public page.

The photo is used for one purpose: to render your video. We do not use it for advertising, we do not build a face database, and we do not attach it to a public profile. Your account has no public profile.

You must have the right to upload the photo. By submitting it you confirm that you are the person in it, or that you are an adult who has given explicit permission, and that no minor appears in it.

AI Video Processing

Rendering is not done on our servers. We send the photo and a fixed motion prompt to a third-party video generation service, which runs a video model and returns an MP4.

In practice:

1. Your photo is transmitted to Kie.ai, our rendering vendor.
2. Kie copies the image to its own temporary storage so its model can read it, and passes it to the ByteDance Seedance video model it operates for us.
3. The model generates the clip and Kie returns a download URL.
4. We download the MP4 and store our own copy in Cloudflare R2, under your account.

We do not control the copy that Kie or ByteDance holds. Their terms govern how long they keep it and whether they use it for anything beyond producing your render. We cannot delete their copy on your behalf, and we do not tell you it is gone when it is not. If you need a vendor-side deletion, contact us and we will pass the request on and tell you what the vendor says.

The prompt is fixed by us. It describes the pose and the camera, and contains no personal data beyond what is in the photo itself.

Third-Party Service Providers

We share data only with processors that are needed to run the service, and only the part they need.

We do not sell personal information, and we do not use your photo or your renders for advertising. If advertising is enabled on this site, the ad provider may set its own cookies, subject to the consent banner.

We may disclose data when the law requires it, when a valid legal request compels it, or when it is necessary to investigate abuse or protect someone's safety. If we are required to disclose something about your account, we will tell you unless we are legally barred from doing so.

Photo Retention and Deletion

Seven days. An automated sweep runs every day. It deletes a photo from our bucket once the render it belongs to is more than seven days old, and it clears the photo reference from the task record at the same time. Uploads that were made but never turned into a render are found by listing the bucket and removed on the same schedule.

Why a sweep and not a timer per file. Object storage has no per-object expiry we can rely on across providers. The sweep is idempotent: if a delete fails, the record is left untouched and the next run retries it. If a photo is still needed by a render inside the seven-day window — including the case where two accounts uploaded identical bytes — the sweep leaves the shared object alone.

What survives. The task record keeps the render settings, timestamps and the video, but not the image. It is not possible to reconstruct the photo from what remains.

What we cannot delete. The copy Kie and ByteDance received. See AI Video Processing.

Generated Video Storage

Your renders are stored in our bucket under your user ID and the task ID. They are served either through an ownership-checked download endpoint or, when a CDN domain is configured, through a URL derived from that task ID. Neither is listed publicly.

A render stays in your library until you delete it. Settings → Videos has a delete button on every clip: it removes the MP4 from storage and deletes the task record. That action is immediate and cannot be undone, so download anything you want to keep first.

If you close your account, we delete your renders and your task records. Unspent credits are forfeited when the account closes.

Payments and Billing

Checkout happens on the payment provider's page. We receive the order result — amount, currency, status, and a provider reference — and we store it so your credit balance and receipts are correct. We do not receive or store your full card number, and we do not store your bank or wallet credentials.

Cookies and Local Storage

We use a small number of strictly functional cookies and storage entries:

• a session cookie that keeps you signed in;
• a locale cookie that remembers your language choice;
• a theme preference in local storage;
• a pending-render record in local storage, so a render survives a page refresh.

If analytics is enabled, it runs through Plausible (which does not set cookies) or Google Analytics 4 (which does, and is loaded with consent mode). You can refuse non-essential cookies in the consent banner without losing access to the service.

Data Security

Data is transmitted over TLS. Photos and videos live in a private bucket; access from the app is scoped to the signed-in owner, and the download endpoint checks ownership on every request. Uploads are validated by content, not by the file name the browser sends. Rate limits apply per IP and per account.

No system is perfectly secure. If we become aware of a breach that affects your personal data, we will notify affected accounts and the relevant authority as required by law.

International Transfers

Our storage and CDN run on Cloudflare's global network. Our rendering vendor and its model provider may process data in a different country from yours. Where transfer rules apply, we rely on the standard contractual clauses our providers offer, or on your request being fulfilled as part of the contract.

Your Rights and Deletion Requests

You can:

• Access and export. Ask for a copy of your account data and a list of your renders.
• Correct. Update your name and email in account settings.
• Delete a video. Do it yourself in Settings → Videos, immediately.
• Delete your account. Email us. We verify the request, delete your renders and task records, remove your uploaded photos from storage, and delete the account record. We aim to complete requests within 30 days.
• Object or restrict. Tell us what processing you object to and we will explain what we can change.
• Complain. If you are in the EU/EEA or the UK, you can lodge a complaint with your local supervisory authority.

We do not sell personal information, and we do not discriminate against you for exercising these rights.

Some records may be kept after a deletion request where the law requires it — for example, tax records for a completed purchase, or records preserved for a fraud or safety investigation. Those records are kept only for that purpose.

Children

The service is for adults. You must be at least 18 to use it, and no photo of a minor may be uploaded. If we learn that an account belongs to a minor, we close it and delete its content.

Changes to This Policy

We update this page when the processing changes. The date at the top is the date of the last substantive change. If a change materially affects what happens to your photos, we will say so in the service, not only here.

Contact Information

Privacy questions, data requests, and deletion requests: support@bicepheartai.app.

For a content or likeness complaint, use the same address with "Content report" in the subject; the Terms of Service describe what to include.