Privacy Policy

1. Summary at a glance

This Privacy Policy explains what personal data Onefancam ("we", "us", "our") collects, how we use it, who we share it with, how long we keep it, and what choices you have. It applies to onefancam.com, app.onefancam.com and any other Onefancam services that link to it (the "Service").

We have written it to be readable. If anything is unclear, email us at contact@onefancam.com.

2. Who is the data controller

The data controller responsible for your personal data is Onefancam, organized under the laws of France. Specific corporate identification details (legal form, registered office, SIREN) are published in our legal mentions and updated as the entity is registered. You can always reach us at contact@onefancam.com.

Given the size of our operation, we are not currently required to appoint a Data Protection Officer. The contact email above is the single privacy contact point. We will appoint a DPO if and when required by law.

3. What data we collect

We collect only what we need to run the Service and to keep it safe.

• Account data. When you sign in with Google: your name as it appears on your Google profile, your email address, your Google account ID, and your Google profile picture URL.
• Uploaded content. The photos you upload to create a video, and any prompt, description or sport selection you provide. A photo of a person is personal data; in some jurisdictions, it may qualify as biometric or "special category" data. See section 6.
• Generated content. The AI-generated videos we create for you, together with metadata such as creation timestamps, chosen sport, watermark status (free vs paid), and rendering duration.
• Purchase data. The products you buy, the price paid, the country of purchase, applicable VAT, the date of the transaction, and a payment reference. Full card details are collected and stored directly by our payment processor (Stripe) and never reach our servers.
• Customer support data. If you email us, we keep the email address you wrote from, the content of your messages, and our replies.
• Technical and usage data. IP address, approximate location derived from IP, user-agent string, device type, browser, operating system, referring page, pages viewed, buttons clicked, time spent, generation attempts and errors. This includes anonymized session recordings via Microsoft Clarity (see section 13).
• Anti-abuse data. Signals we collect to detect fraud, scraping, automation, watermark tampering and policy violations. This may include hashed fingerprints of uploaded images, content-moderation scores, and rate-limit counters tied to your account or IP.

4. How we collect it

• Directly from you, when you sign in, upload a photo, pick a sport, buy a pack, or email us.
• Automatically, as you use the Service (cookies, server logs, analytics, error monitoring).
• From third parties, namely your identity provider (Google) when you sign in, and our payment processor (Stripe) when you pay.

5. Why we use it and on what legal basis

We process your data only for the purposes listed below, and only on a legal basis that GDPR Article 6 (and, where relevant, Article 9) requires:

• Provide and operate the Service — create your account, accept your photo, generate your video, deliver and store it, prevent duplicate accounts. Legal basis: performance of a contract with you (Art. 6(1)(b)).
• Process payments and meet accounting obligations — charge the right amount, issue invoices, store transaction records for the duration required by tax law. Legal basis: contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)).
• Keep the Service safe and fight abuse — detect fraud, deepfake misuse, NSFW uploads, watermark tampering, chargebacks, account takeover, scraping or other policy violations. Legal basis: legitimate interest in protecting our users, our community and our business (Art. 6(1)(f)); legal obligation where applicable.
• Improve the Service — understand which features work, debug errors, prioritize roadmap, monitor performance, in aggregate and (where possible) anonymized form. Legal basis: legitimate interest in improving our product (Art. 6(1)(f)). You can object — see section 11.
• Communicate with you — answer your support messages, send transactional emails (purchase receipts, account warnings). Legal basis: contract (Art. 6(1)(b)) for transactional emails; legitimate interest for support replies.
• Marketing emails — only if you opt in. You can withdraw your consent at any time using the unsubscribe link or by emailing us. Legal basis: consent (Art. 6(1)(a)).
• Comply with the law and respond to authorities. Legal basis: legal obligation (Art. 6(1)(c)); legitimate interest (Art. 6(1)(f)) for cooperating with law enforcement when needed.

6. Photos, faces and AI processing

Because the photos you upload to Onefancam typically depict an identifiable face, we treat them with particular care. To be clear about scope:

• We use your uploaded photo as input to a generative video model so that the model can produce an AI video that resembles the person on the photo. We do not extract or store a stand-alone biometric template for the purpose of identifying a person from another image. We do not run identity-matching against any database. We do not use the photo to recognize you across services.
• Generation is performed by our upstream AI providers under contract. They are required to process the photo only to produce the requested output, to delete it within their own retention window, and not to use it to train their models.
• You may only upload photos of yourself, or of a third party who has given you explicit, freely-given consent to be depicted by an AI-generated video that you will own and may share publicly. By uploading any photo, you warrant that you have that consent. See Terms section 5.
• Where applicable law treats face data as a special category of personal data, our legal basis for processing it is your explicit consent (GDPR Art. 9(2)(a)), which you give actively each time you upload a photo and click "generate". You can withdraw consent at any time by deleting your account, the photo, or the relevant generated video. Withdrawal does not affect processing already carried out.

7. We do not train AI on your uploads

We do not use the photos you upload, the prompts you write, or the videos we generate for you to train, fine-tune, retrain or evaluate our own AI models or anyone else's. Our upstream model providers operate under contractual commitments that prohibit training on user inputs and outputs.

If we ever want to use a specific Output to publicly showcase the Service, we ask for your separate, explicit opt-in (or rely on the showcase license in Terms section 7, which you can opt out of at any time).

8. Who else processes your data

We do not sell your personal data. We share it only with the sub-processors we need to run the Service, and only for the purposes described below. Each one is bound by a written data-protection agreement that requires confidentiality, security, and processing strictly on our instructions.

• Vercel — hosting and delivery of our website and APIs (United States, with EU edge regions).
• Google (Sign in with Google) — user authentication. Google sees that you signed in to Onefancam; we receive the basic profile information described in section 3.
• Stripe — payment processing and tax/VAT handling. Stripe collects and stores your full payment information; we receive only the metadata listed in section 3.
• AI model providers — generation of your video from your photo and prompt. Providers are contracted to delete inputs and outputs within a short retention window and not to train on them. We may switch providers to keep quality and safety high; the current list is available on request at contact@onefancam.com.
• Cloud storage — storage of uploaded photos and generated videos during their respective retention windows.
• Microsoft Clarity — product analytics and anonymized session replays. We use Clarity to understand aggregate usage patterns and fix UX issues. See section 13.
• Transactional email provider — to send receipts, password-style sign-in links and account notifications.
• Customer support tooling — to manage your email exchanges with our support team.

We may also disclose your data to (i) competent public authorities when we are legally required to do so, (ii) professional advisers bound by confidentiality, and (iii) a successor entity in case of a merger, acquisition or asset sale, in which case we will notify you in advance.

9. International data transfers

Some of our sub-processors are located outside the European Economic Area, including in the United States. When we transfer personal data outside the EEA to a country that the European Commission has not recognized as offering an adequate level of protection, we rely on appropriate safeguards under Chapter V GDPR, including the European Commission's Standard Contractual Clauses (SCCs) and supplementary measures (encryption in transit and at rest, access controls, vendor due diligence). You may request a copy of the safeguards we use at contact@onefancam.com.

10. How long we keep your data

• Uploaded photos: automatically deleted within 30 days of upload. You can also delete a photo manually at any time from your account.
• Generated videos: kept while your account is active. You can delete any video at any time. When you delete your account, all your videos are scheduled for deletion within 30 days, plus up to 30 additional days for backups to expire.
• Account data: kept while your account exists. On deletion, scheduled for permanent erasure within 30 days, plus the backup window.
• Purchase and accounting records: kept for 10 years as required by French commercial law (Code de commerce, Art. L123-22).
• Server logs and security events: kept for up to 12 months, then deleted or fully anonymized.
• Anti-abuse signals linked to suspended accounts (e.g. hashed identifiers): kept for up to 24 months to prevent ban evasion.
• Support emails: kept for up to 3 years after our last exchange.

11. Your rights (GDPR and CCPA)

Under EU and UK data-protection law, and to the extent applicable also under the California Consumer Privacy Act (CCPA/CPRA) and similar US state laws, you have the following rights:

• Right of access — a copy of the data we hold about you.
• Right of rectification — correction of inaccurate data.
• Right of erasure ("right to be forgotten") — deletion of your data, subject to legal-retention exceptions (e.g. accounting records).
• Right to restriction of processing in specific cases.
• Right to data portability — receive the data you provided in a structured, machine-readable format.
• Right to object to processing based on our legitimate interest, including profiling.
• Right to withdraw consent at any time, where we relied on consent. Withdrawal does not affect processing already done.
• CCPA-specific rights: right to know, right to delete, right to correct, right to opt out of "sale" or "sharing" of personal information (we do not sell or share for cross-context behavioral advertising), and right to non-discrimination for exercising these rights.
• Right to lodge a complaint with a supervisory authority. In France, that is the Commission Nationale de l'Informatique et des Libertés (CNIL), www.cnil.fr. EU residents can also complain to the authority of their habitual residence.

To exercise any right, email contact@onefancam.com from the email address linked to your account. We may need to verify your identity before acting on the request. We will respond within one month, extendable by two more months for complex requests, as permitted by GDPR Art. 12(3).

12. Children

Onefancam is not directed at children. You must be at least 16 years old to use the Service and to provide personal data to us. If we learn that we have collected data from a person under 16 without parental consent, we will delete it as soon as possible. If you are a parent or guardian and believe your child has used the Service, contact contact@onefancam.com.

13. Cookies and analytics

We use cookies and similar technologies for the purposes below.

• Strictly necessary cookies — required to run the Service: keep you signed in, remember your generation state, protect against fraud. These do not require consent.
• Analytics and product cookies — via Microsoft Clarity. Clarity records anonymized session replays (clicks, scrolls, page paths) so we can find UX issues and improve the product. Clarity is configured to mask all user-typed input and any sensitive elements by default. We do not use Clarity for advertising. In jurisdictions that require prior consent for non-essential cookies, we will only set Clarity cookies after you accept them.
• No advertising cookies. We do not currently use advertising cookies and do not share data for cross-context behavioral advertising.

You can control cookies through your browser settings; blocking strictly necessary cookies may prevent the Service from working.

14. Security

We implement technical and organizational measures designed to protect your data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. These include HTTPS/TLS in transit, encryption at rest for stored photos and videos, role-based access control, principle of least privilege, production-secret rotation, vendor due diligence, and logging of sensitive operations.

No system on the internet is fully secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours and, where required by law, notify you without undue delay.

15. Changes to this Policy

We may update this Privacy Policy from time to time, for example when we add a new feature, change a sub-processor, or comply with new law. If we make material changes that affect your rights, we will notify you by email (if you have an account) and/or by a prominent in-app notice before the changes take effect. The "Last updated" date at the top of this page reflects the most recent version.

16. Contact and complaints

Questions about this Privacy Policy, requests to exercise your rights, or privacy concerns should be sent to contact@onefancam.com. We aim to respond within 7 business days for general questions and within the timelines required by law for formal rights requests.

If you are not satisfied with our response, you can lodge a complaint with the French data-protection authority (CNIL, www.cnil.fr), or with the supervisory authority of your EU/EEA country of residence.