Privacy Policy

Account data

Name, email address, password (stored hashed by our authentication provider), plan, credit balance and account settings.

Payment data

Payments are processed by Stripe. We receive a customer reference, the plan, amounts, dates and payment status — never your full card number.

Uploads and generated videos

Character images (which may include a person's face), reference videos, object images, prompts you write, and the videos generated from them. Uploads may contain biometric-sensitive information (faces); see the next section.

Consent and safety records

When you sign up and each time you upload a character, we record your confirmations (age, Terms, consent for the person shown), the document versions, the date and time, your IP address and browser user agent. We also keep the results of automated safety checks.

Usage and technical data

Generation settings and history, credit transactions, and technical logs (IP address, device and browser information, errors) needed to run and secure the Service.

Reports

If you report content, we collect the reference, your description, your email address and a hashed version of your IP address (to prevent abuse).

Images and videos showing faces are processed only to:

• generate the video you requested; and
• run automated safety moderation (detecting nudity, apparent minors and public figures) before generation and before delivery.

They are never used to train AI models, never used to build face templates for identifying you, never sold and never shared for any other purpose. Safety checks return labels and confidence scores; we keep those results, not a biometric profile. Face images are deleted with your uploads after 30 days unless you saved the character.

We share data only with providers that process it on our behalf, under contracts requiring them to protect it and use it only to provide their service to us:

We may also disclose data when required by law, to respond to valid legal requests, to protect the rights and safety of users or others, or as part of a business transfer (in which case this policy continues to apply). We do not sell or "share" your personal information for cross-context behavioural advertising, as defined by the CCPA.

Video generation is performed by BytePlus ModelArk in the Asia-Pacific region, which means your character image, reference video, object images and prompt are transferred outside the European Union and the United States for processing. Moderation runs on Amazon Web Services in the United States. Where GDPR applies, these transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. You can ask us for more information at legal@www.goloopy.io.

• Uploads and generated videos: deleted automatically after 30 days. Our AI provider's temporary copy of each video is replaced by our own copy as soon as it's ready; its link is never shown to you and expires within 24 hours.
• Saved characters (My characters): kept until you delete them or your account.
• Account data: kept while your account is open; deleted when you delete your account.
• Consent, moderation and report records: kept after account deletion for as long as needed to meet legal obligations and to establish or defend legal claims.
• Billing records: kept by our payment provider and us for the periods required by tax and accounting law.

Depending on where you live, you have the right to:

• access the personal data we hold about you and get a copy of it;
• correct inaccurate data;
• delete your data (you can delete your account yourself in Settings → Danger zone);
• receive your data in a portable format;
• object to or restrict certain processing, and withdraw consent at any time (this doesn't affect processing done before);
• know what categories of personal information we collect, use and disclose (CCPA), and not be discriminated against for exercising your rights;
• lodge a complaint with your data protection authority.

To exercise these rights, email legal@www.goloopy.io from the address linked to your account. We'll answer within one month (or the time required by your local law) and may need to verify your identity. You can also use an authorised agent where the law allows it.

We only use strictly necessary cookies: the ones that keep you signed in and secure your session. We don't use advertising, analytics or tracking cookies, so there's nothing to accept or refuse. If that changes, we'll update this policy and ask for your consent first.

Files are stored privately and are only reachable through short-lived signed links. Access to production data is restricted, connections are encrypted in transit, and secrets are kept server-side. No method is 100% secure, but we work to protect your data and will notify you and the authorities of a breach where the law requires it.

GoLoopy is only for people aged 18 or older. We don't knowingly collect data from minors. If you believe a minor has used the Service or appears in content on it, report it and we'll delete the data.

We may update this policy; the version and date at the top show the current version, and we'll notify you of material changes. Privacy questions and requests: legal@www.goloopy.io. Everything else: support@www.goloopy.io.