Version 1.1 · Effective October 17, 2026
This Privacy Policy explains how PictureToVideo (“PictureToVideo”, “we”, “us”) collects and uses personal data when you use picturetovideo.org (the “Service”), who processes it, how long we keep it and what rights you have.
Who is responsible
PictureToVideo is operated by Chen Zhe, an individual based in the People’s Republic of China, who is the controller of your personal data. Privacy questions and requests: support@picturetovideo.org. We have not appointed a data protection officer.
What we collect
- Account data: your name, email address and profile picture. If you sign up with email, we store your password only as a secure hash and record whether your email address is verified. If you sign in with Google, we receive your name, email address and profile picture from Google, along with the sign-in tokens it issues; we never receive your Google password.
- Photos, prompts and videos: the photos you upload, the prompts you write, your render settings (model, length, resolution, audio) and the videos generated for you.
- Purchases: your plan, the credits granted to you and spent, the products you bought and order references. Payments are processed by Waffo (see below); we receive the payment status, the amount and the email address you paid with, never your full card details.
- Support messages: what you send us by email or in support tickets, including attachments.
- Technical data: the IP address and browser information recorded with each sign-in session, a short-lived counter keyed by your IP address when you sign in, sign up or reset a password (to limit abuse), and request logs used for security and to keep the Service running.
- Moderation log: for every content check on a prompt, a photo or a finished video, a record with your account ID, the prompt text or a link to the checked file, the result, the reason and the check scores.
Why we use it
- To provide the Service: store your photos, generate your videos and keep your account, credits and purchases in order (performance of our contract with you).
- To process payments and manage subscriptions (performance of our contract with you).
- To answer your messages and support requests (performance of our contract and legitimate interests).
- To tell you about important changes to the Service, your account or our policies (legitimate interests).
- To prevent abuse and fraud and keep the Service secure, including checking prompts, photos and finished videos against our Content Policy (legitimate interests).
- When analytics is turned on, to see how our pages are used (legitimate interests).
- To meet legal obligations, such as tax records and reporting child sexual abuse material (legal obligation).
We don’t sell your personal data, including “selling” as defined by laws such as the CCPA. We don’t use it for advertising, and we don’t use your photos, prompts or videos to train AI models.
Who processes it
We share data only with service providers that help us run PictureToVideo, under terms that limit their use of it:
- Cloudflare: hosting, our database and file storage (R2) for your uploads, videos and support attachments. Cloudflare also runs our automated content checks (Workers AI) on your prompts, the photos you use in a render and your finished videos, routes email sent to our support address and sends our account emails, such as email verification and password reset.
- AI video model providers: third-party API providers that run the video models we offer (Kling, Veo, Wan, Hailuo and Grok Imagine). They receive your prompt, your render settings and the photos you use in a render, only to generate your video and run their own safety filters, and may hold the files for a limited time under their own retention policies.
- Waffo Pancake Prompt Sift: before generation, the text of your prompt and a language hint are sent to Waffo’s content-safety check, which returns a verdict. According to Waffo, the check is stateless and doesn’t keep the prompt text after answering. No photos are sent.
- Waffo Pancake: our payment processor and Merchant of Record, which processes payments, handles tax and issues receipts. Waffo receives your email address and payment details directly and acts as an independent controller for that data under its own privacy policy. Card data is processed by Waffo Pancake and never stored on our servers.
- Google: “Sign in with Google”. Our support mailbox is also hosted on Gmail, so emails you send to support@picturetovideo.org are stored there.
These take part only when we turn them on, and only for the purpose shown:
- Google: with Google One Tap on, our pages also show Google’s sign-in prompt to visitors who are not signed in; your browser loads it from Google even if you don’t use it.
- GitHub: “Sign in with GitHub”.
- Resend: account emails, as an alternative to Cloudflare’s email service.
- Google Analytics or Plausible: website analytics.
- Crisp or Tawk: a live-chat widget; what you type into it goes to that provider.
We may also disclose data if the law requires it, to protect people’s safety or our rights, or as part of a sale or reorganization of the business, in which case we’ll tell you first and the buyer must keep protecting it.
Cookies and similar storage
We use essential cookies that keep you signed in and protect sign-in requests, a cookie that remembers your language, and browser storage for interface preferences and an unsent generator draft (your prompt and settings) while you sign in. These are needed for the Service to work and can’t be switched off on our side. We don’t use advertising or cross-site tracking cookies.
When we turn on analytics, the tool we use, Google Analytics or Plausible, records the pages you visit and details such as your browser and device. You can block analytics cookies and scripts in your browser settings.
Emails
We email you only to answer your messages or about your account, purchases or changes to our policies; receipts come from Waffo. We don’t send marketing emails. If we ever do, they will need your consent and include an unsubscribe link, and unsubscribing won’t stop essential account and billing notices.
How long we keep it
- Uploaded photos and generated videos: kept with your account until you ask us to delete them or delete your account. Copies held by our AI video model providers are kept under their own retention policies.
- Account data: until you delete your account, then removed within 90 days (the moderation log follows its own 12-month period). Deleted data can remain in the automatic point-in-time backups of our database for up to 30 more days, until those backups expire.
- Support messages: up to 2 years after the conversation ends.
- Sign-in sessions and abuse-prevention counters: sessions until they expire or you sign out; counters are short-lived and cleared as new requests come in.
- Moderation log: kept for 12 months, including after your account is deleted, so we can investigate abuse, answer appeals and show our moderation to our payment partner when asked. Records of serious violations are kept longer only where the law requires it.
- Purchase records: as long as tax and accounting laws require.
To have specific photos or videos deleted, or your whole account, email support@picturetovideo.org from your account email.
Your rights
Depending on where you live (for example under the GDPR, UK GDPR or California law), you have the right to:
- know what data we collect and how we use it;
- access and get a copy of your personal data;
- correct data that is inaccurate or incomplete;
- have your data deleted;
- restrict how we process it in certain cases;
- receive your data in a machine-readable format;
- object to processing based on legitimate interests;
- withdraw consent where we rely on it.
You can update your name and profile picture in your account settings. For anything else, including a copy of your videos, email support@picturetovideo.org from your account email and we’ll respond within 30 days. You can also complain to your local data protection authority.
International transfers
Our providers may process data outside your country, including in the United States. Where required, transfers are protected by safeguards such as the European Commission’s Standard Contractual Clauses.
Security
All traffic to the Service uses HTTPS, passwords are stored only as hashes, and access to our systems is limited to what is needed to run the Service. Your photos and videos are stored under long, unguessable links that we don’t publish; anyone who has one of those links can open that file, so share them with care. No system is perfectly secure: if a breach affects your personal data, we will notify you and, where required, the relevant authority within 72 hours of becoming aware of it. Please contact us at once if you suspect a problem with your account.
Third-party links and services
Our pages may link to other websites or services, such as Waffo’s checkout or the websites of the companies that make the video models. Their privacy practices are governed by their own policies.
Children
You must be 18 or older, or the age of majority where you live, to create an account. We don’t knowingly collect personal data from children. Parents and legal guardians may upload photos of their own children for wholesome family videos, as our Content Policy allows; those photos are processed only to make the video they request. If you believe a child has given us personal data, contact us and we’ll delete it.
Changes
We’ll post any update here with a new date and announce material changes on the site at least 15 days before they take effect. Continuing to use the Service after that means you accept the updated policy.
Contact
Privacy questions and requests, support and feedback: support@picturetovideo.org. We usually reply within 2 business days.