Privacy Policy

Effective October 31, 2026

Current availability

This website provides account access and credit-based video generation. Account registration, sign-in and video generation are available. A video credit is required to submit a job. Checkout is not yet open. Selecting a portrait locally does not upload it. The descriptions of accounts, purchases and generation below apply when those features are made available; these policies do not make an unavailable feature available.

Who to contact

Catrina AI is the project brand. The service is operated by Dylan Zou, based in San Francisco, California, USA. Contact: zoumouou@gmail.com.

Information used by the service

When you create or use an account, the service processes your email address and authentication records to provide sign-in, account confirmation and password recovery. If you contact support, we process the information you provide to investigate and respond. When the relevant features are enabled, order records, credit transactions, job status and private media are processed to provide the service; browsing alone does not create a purchase or generation job. Account sessions use an essential HttpOnly cookie. The backend keeps hashed IP-based rate-limit keys to help prevent abuse; hosting and infrastructure providers may process connection and diagnostic information.

Your photo and generated media

Selecting a photo displays it locally in your browser without uploading it. Submitting a generation uploads the portrait to private Supabase storage and sends Kie a time-limited image URL and fixed prompt. A separately supplied music track may also be sent as an audio reference when configured; generated audio is removed and the supplied track is added during finishing. The reference video shown on the page is not uploaded to the generation API.

Optional Google sign-in

Where enabled, Continue with Google lets Supabase authenticate your Google account using your email address and basic profile information. This option does not request access to your Gmail messages or contacts. Available sign-in methods are shown on the website. Google has its own privacy terms; review the authorization screen before continuing.

Service providers and access

Supabase supports authentication, application data and private storage. Kie provides video generation. Waffo Pancake provides checkout and payment processing; payment details are entered on its checkout, not collected by this application. Access to existing completed works requires an authenticated owner check before a short-lived link is issued. A person who receives a valid signed link may use it until it expires, so do not share it unintentionally.

Content safety checks

Selecting a photo locally does not send it to a content-review provider. The workflow uses Waffo Prompt Sift for its fixed prompt. Alibaba Cloud Content Moderation, using the US (Virginia) endpoint and baselineCheck_cb service, is selected for visual checks; Google Cloud Vision SafeSearch is retained as an alternative and is not automatically called when Alibaba Cloud is unavailable. Before any change of provider, the replacement must be configured and verified.

A resized portrait is checked before submission to the generation provider, and 15 frames sampled across the video are checked before delivery. Alibaba Cloud receives short-lived signed links to temporary JPEGs in private storage, not your email address or order details. Normal processing deletes those temporary objects immediately after checking. Expiry records support later cleanup after an interruption or deletion failure; cleanup runs hourly while the server is running and retries after failures. The links expire after 90 seconds. Provider-side processing and retention are governed by the provider’s terms; using a US endpoint is not a promise that every processing step or log stays exclusively in the United States.

Restricted operational records contain decisions, risk labels, content hashes, provider and policy versions, request identifiers and usage counts rather than additional raw images or signed links. Uncertain or unavailable checks pause delivery. Sampling does not inspect every video frame or determine consent, identity, age or copyright ownership. See Alibaba Cloud privacy information and Google Cloud privacy information.

Retention and requests

Media associated with completed or confirmed-failed jobs is scheduled for automatic cleanup 30 days after the job ends. Expired media links stop working. Cleanup runs hourly while the application server is running and retries after failures; server downtime may delay physical deletion. Active jobs, uncertain submissions, audio-retry jobs, shared files and uploads without an associated finished job are held for review to avoid deleting material still in use. Encrypted recovery backups are retained separately under the backup rotation rules; deletion from active storage does not mean every backup copy disappears immediately. Order, credit and account records have separate retention rules; media cleanup does not automatically delete your account. Contact zoumouou@gmail.com to request access, correction or deletion review; do not email passwords, card numbers or unnecessary identity documents. Requests require verification and may involve provider records or records that must be retained. No automatic deletion deadline is promised in this notice.

Providers have their own processing and retention practices. See Supabase privacy information and Kie service documentation. This notice does not promise that providers never retain inputs or use them for training.

Optional website analytics

With your permission, the website uses Google Analytics to understand visits and basic interactions. Analytics stays off until you accept. You can decline or change your choice using Analytics choices on the home page. We do not send your email address, photos, videos, filenames or confirmation tokens as analytics event data. Google processes browser and connection information for its service. Analytics depends on the configuration of the current environment. Test payments are not recorded as production revenue.

Support and appeals

Contact zoumouou@gmail.com with questions, reports or appeals. Ordinary requests are acknowledged within 2 business days, with an initial investigation within 5 business days and updates at least every 5 business days while unresolved. Appeals are acknowledged within 2 business days and initially reviewed within 5 business days. Business days are Monday–Friday in America/Los_Angeles. Credible child-safety concerns or imminent threats receive priority: restrict service-controlled access within 24 hours of receipt when actionable, with initial investigation within 48 hours. This is not a continuously staffed service. These timelines do not replace statutory rights or set bank refund-processing times.

Catrina AI · Operated by Dylan Zou · San Francisco, California, USA
Support: zoumouou@gmail.com