Privacy Policy

Last updated: 20 October 2026

HiVideoStudio ("HiVideoStudio", "we", "us") is operated by Ye Zheng, an individual sole proprietor based in Hong Kong SAR. This policy explains what personal data we collect when you use hivideostudio.com (the "Service"), why, and your choices. We act as the data user (controller) for this data under the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486).

1. Data we collect

  • Account data. If you sign in with Google, we receive your name, email address, profile picture and Google account ID through Google OAuth. If you sign up with email and password, we store your email address and a salted hash of your password (never the password itself).
  • Content. Photos and other files you upload, the prompts and settings you choose, and the videos generated for you.
  • Credits and billing. Your credit balance, purchases, subscriptions and generation history. Payments are processed by Stripe; we do not receive or store your full card number. We receive limited details from Stripe such as the payment status, amount, and the card brand and last four digits.
  • Technical data. IP address, browser and device information, and request logs that we and our hosting provider need to run, secure and debug the Service.

2. How we use your data

  • To create and secure your account and keep you signed in.
  • To generate videos from your uploads and prompts, and deliver the results to you.
  • To process payments, manage credits and subscriptions, and issue refunds.
  • To prevent fraud and abuse and to enforce our Terms of Service, including content moderation.
  • To respond to support requests and send essential service messages (for example receipts or changes to these policies).

We do not sell your personal data, and we do not use your uploads or outputs to train AI models.

3. Google user data

When you sign in with Google we only request the basic scopes needed to identify you (openid, email, profile). We use this data only to create and authenticate your HiVideoStudio account and to contact you about it. We do not access your Gmail, Drive, contacts or any other Google data, we do not share Google user data with third parties except the service providers listed below that are needed to run the Service, and we do not use it for advertising. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke access at any time from your Google Account permissions page.

4. Service providers who process data for us

  • Cloudflare hosts the Service. Account and credit records are stored in Cloudflare D1; uploaded photos and generated videos are stored in Cloudflare R2.
  • fal.ai and the third-party AI model providers it routes requests to receive your uploaded files and prompts in order to generate your video.
  • Stripe processes payments and subscriptions under its own privacy policy.
  • Google provides sign-in if you choose "Continue with Google".

These providers may process data outside Hong Kong, including in the United States and other countries. We only share what each provider needs to perform its service. We may also disclose data if required by law or to protect the rights and safety of users and the Service.

5. Retention and deletion

  • Uploads (photos you submit) are deleted automatically 30 days after upload.
  • Generated videos are kept for 30 days so you can download them, then deleted automatically. Please download anything you want to keep.
  • You can delete a generated video, together with the photos uploaded for it, at any time from My videos; it is removed from our storage immediately.
  • Account data is kept while your account is active. If you ask us to delete your account, we delete your account, uploads and outputs within 30 days, except records we must keep for legal, tax, accounting or fraud-prevention reasons (for example payment records, which we keep as required by law).
  • Copies held by AI model providers are governed by their retention practices; fal.ai and its providers process files only to produce your output.

6. Cookies

We use strictly necessary cookies to keep you signed in and to protect sign-in and payment flows (for example session and CSRF cookies set by our authentication system, and cookies set by Stripe on checkout pages for fraud prevention). We do not use advertising cookies or third-party analytics. We use two first-party cookies (hv_vid, a random visitor id kept up to 13 months, and hv_sid, a 30-minute session id) to measure which pages and referring sites bring visitors, together with the referring URL, UTM tags, country and device type; IP addresses are stored only as a salted, daily-rotating hash. You can block cookies in your browser, but you will not be able to sign in without them.

7. Security

Data is transmitted over HTTPS and stored with our hosting provider using access controls. No system is perfectly secure, but we take reasonable steps to protect your data.

8. Your rights

You may request access to, correction of, or deletion of your personal data, or ask questions about how we handle it, by emailing support@hivideostudio.com. We will respond within 40 days as required by the Personal Data (Privacy) Ordinance. If you are in another jurisdiction (for example the EU/UK), you may have additional rights, such as objecting to processing or data portability, and you can contact us to exercise them.

9. Children

The Service is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

10. Changes

We may update this policy. We will post the new version here with a new "Last updated" date, and notify you by email for material changes.

11. Contact

Questions or requests: support@hivideostudio.com.