Privacy Policy

Who we are

TipToe AI (tiptoeai.com) is operated by Novalia, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, USA ("we", "us"). Novalia, LLC is the controller of the personal data described here. Questions about this policy: support@tiptoeai.com.

What we collect

1. Account details. Your name, email address and sign-in information (a securely hashed password if you sign up with email, or your Google sign-in), plus your profile picture if Google provides one.
2. The two photos you upload. Before anything is sent to us, your browser finds the person in each photo and makes a few close-up crops (face, head, upper body, legs). The points it uses to find the person are calculated on your device and are not sent to us. So you don't have to pick them again after signing in or checkout, your browser keeps the photos you picked on your own device for up to an hour, only for the account that picked them, and deletes them when you sign out; this copy is never sent to us. We receive the two photos and the crops when you start a video.
3. Photos of the second person. The partner photo usually shows someone other than you. We receive it from you, not from that person, so you must have their agreement (see "Your photos and consent" in the Terms of Service).
4. What we make from them. Five still frames of the two people in the barn and the finished video, which is silent.
5. Orders and payments. Which pack you bought, when, and the amount. Card details go straight to Stripe; we never see or store your card number.
6. Technical data. IP address, browser type and request logs, used to keep the service secure, stop abuse and fix errors.
7. Usage data, only if you accept cookies. Which pages you visit, which steps of making a video you reach (for example "photo selected" or "checkout started"), clicks and scrolling, and device type. Session recordings in Microsoft Clarity hide text you type and the photos and videos on the page. We never send your photos, videos, email or name to these tools.
8. Messages you send us. Support requests and anything you attach.

Why we use it (legal bases)

• To provide the service you asked for (contract): your account, your orders and payments, making and delivering your videos, answering your messages.
• To keep the service safe and working (legitimate interests): security, preventing abuse and fraud, and fixing errors.
• The partner's photo (legitimate interests): you and the person in the partner photo want the video made, and they agreed to it. That person can object at any time by emailing us, and we will delete the copies we hold.
• To meet legal duties (legal obligation): for example tax and accounting records, and answering lawful requests.
• To count visits without cookies (legitimate interests): Plausible Analytics counts page views and where visitors come from, without cookies and without storing your IP address. The numbers are anonymous and only shown to us in total.
• To understand how the site is used (your consent): Google Analytics and Microsoft Clarity, only after you click "Accept All" in the cookie banner. You can withdraw consent at any time under Cookie settings in the footer.

How we use your photos

Your photos are used only to make your video. We do not show them publicly, sell them, or use them to train AI models. Every person who appears in a photo must have agreed to this, and photos of children or public figures are not allowed.

Who processes your data

We use a small number of service providers, each only for the job below:

• Cloudflare: hosting, database and private file storage. Receives everything the service stores.
• Kie.ai and the AI model providers it routes to (ByteDance Seedream for the still frames, ByteDance Seedance for the video): generate the still frames and the video. Receive your photos, crops and the generated frames through short-lived private links. Kie.ai states that it keeps media files for 14 days and logs for 2 months.
• Stripe and Link, LLC (part of Stripe): run checkout and payments. Link sells your purchase as the merchant of record and collects transaction data (such as your payment details, billing country and email) for payments, tax and fraud prevention under Stripe's privacy policy.
• Google: sign-in with Google. Google and jsDelivr also supply the photo-cropping software your browser downloads, so they receive normal technical connection data (such as your IP address); the cropping code does not send them your photos.
• TikTok: only if you click to watch the original meme clip, your browser loads it from TikTok, which then receives normal technical data and may set its own cookies under TikTok's privacy policy. Nothing loads from TikTok until you click.
• Resend: sends account emails such as sign-up confirmation and password reset. Receives your email address.
• Plausible Analytics (Plausible Insights OÜ, EU): anonymous visit counts on every page. Receives the page address, the referring site, browser, device type and country; your IP address is only used to make a daily-changing anonymous count and is not stored. Sets no cookies.
• Google Analytics (Google) and Microsoft Clarity (Microsoft): only if you accept cookies. Receive the usage data described above, your IP address and device information, and set their own cookies.

These providers process data under their own terms and privacy policies. Several of them, and we, are in the United States, so your data is transferred to and processed in the US and possibly other countries, which may not have the same data protection laws as yours.

How long we keep it

• Photos, crops and still frames: we delete our copies as soon as your video is finished or has failed, or when an order is refused before it starts. Anything left behind is deleted automatically by our storage within 14 days.
• Videos: kept for 30 days in My videos so you can download them, then deleted automatically.
• Account and order records: kept while your account exists, and deleted when you delete your account. Stripe keeps its own payment records as the law requires.
• Technical logs: kept only for a short time by our hosting provider.

Cookies

We always use the cookies needed to keep you signed in and remember your settings, including your cookie choice. Plausible Analytics, which we use to count visits, sets no cookies.

If you click "Accept All" in the cookie banner, we also load Google Analytics and Microsoft Clarity, which set their own cookies to measure visits and how the site is used. If you click "Reject All" or ignore the banner, they are not loaded at all. You can change your choice at any time under Cookie settings in the footer. We do not use advertising cookies. After you accept analytics, we also use browser session storage to avoid counting the same video observation twice and to remember the entry and method of a login attempt for up to ten minutes. These local bookkeeping keys are not sent to our analytics tools; session storage is cleared when the tab is closed.

Your rights

You can ask us to see, correct, export or delete your personal data, or delete your account, by emailing support@tiptoeai.com from the address on your account. Depending on where you live (for example under the GDPR in the EU and UK, or the CCPA in California) you may also object to or ask us to restrict some processing, and you may complain to your local data protection authority. We do not sell your personal information or share it for advertising.

If you appear in a video someone else made without your permission, email us. After checking the report we will delete the copies we hold; we cannot remove copies someone has already downloaded.

Children

TipToe AI is for people aged 18 and over. Photos of children must not be uploaded.

Changes

If we change this policy, we will update the date above. For significant changes we will notify you by email or on the site.