Privacy Policy

This Privacy Policy explains how information is handled when you use Bicep Heart AI at bicep-heart.pro (the "Service"). It should be read with our Terms of Service.

Operator: Alex Reed, an independent developer operating Bicep Heart AI. For privacy, account, billing, or support requests, email support@bicep-heart.pro or use the support ticket system.

1. Information We Handle

• Account information: information such as your email address, name, password hash, profile details, and authentication records.
• Uploaded photos: the image you select for a bicep-heart video.
• Generation and result information: task identifiers and status, settings, timestamps, errors, and the video generated for your request.
• Orders and credits: purchase and payment status, credit grants, usage, balances, and subscription information where applicable. The payment provider handles payment credentials; the Service receives transaction information needed to fulfill and support an order.
• Support information: messages and attachments submitted in a support ticket.
• Technical information: information processed by the hosting and security systems when you make a request, which can include an IP address, browser or device details, and request or error logs.
• Cookies and similar storage: authentication, language, and other settings needed to operate the Service. Optional analytics may be used if enabled by the operator.

Please do not upload an image unless you have the rights and permission needed to use it. In particular, get the consent of any identifiable person shown in a photo. Do not upload intimate or otherwise sensitive images that you would not want accessible by anyone who obtains the image URL.

2. How Information Is Used

We use information to create and protect accounts, accept an uploaded photo, submit a video-generation request, show task status and results, administer credits and payments, provide support, prevent abuse, and meet legal obligations. If optional analytics are enabled, related information may also be used to understand Service usage.

The specific legal basis for processing depends on your location and the purpose. It may include providing the Service you requested, complying with law, legitimate interests such as security, or your consent where required.

3. Photos, AI Providers, and Storage

To generate a video, the Service sends a URL for your uploaded photo and a fixed generation instruction prepared by the Service to the AI video provider configured for the Service. The provider processes those materials to create and return the video. Which provider is configured may change. The provider's own terms, privacy notice, retention practices, and use of submitted content also apply; this project does not establish a blanket no-training or no-retention promise for every provider.

The Bicep Heart upload flow stores photos using the configured object-storage service and supplies the AI provider with a signed HTTPS URL that expires after one hour. The object key is randomly generated rather than derived from the photo's contents. The signed URL is a bearer link: anyone who obtains it may retrieve the photo until it expires. A random key and an expiring signed URL do not by themselves make the object private. If public reads are enabled on the storage bucket, the object may also be reachable without the signed URL for as long as it remains stored. The storage bucket must have public reads disabled before launch if photos are to be treated as private.

Generated videos and task records may also be stored so the Service can show your result and generation history. Do not assume that removing a task or closing an account removes copies already received by an AI provider or other service provider.

4. When Information Is Shared

Information is shared with service providers only as needed to operate the Service, including:

• The configured AI video provider, to process the photo URL and the Service-prepared generation instruction and return a video.
• The configured hosting, database, and storage providers, to run the Service and store account, task, photo, and result information.
• Authentication and email providers, when enabled, to sign you in or send service messages.
• Payment providers, to process purchases, subscriptions, refunds, and fraud checks.
• Analytics providers, if the operator enables analytics.
• Authorities or professional advisers where disclosure is required by law or reasonably necessary to protect legal rights and safety.

The operator should identify the actual providers and relevant processing locations in this notice before public launch. Provider configuration can change over time.

5. Retention and Deletion Requests

The Service stores account and task records in its database and may store uploaded photos and generated videos in configured object storage. This project does not define a fixed automatic deletion period for Bicep Heart photos, tasks, or generated videos. They may remain stored until removed by the operator or storage lifecycle configuration. A signed photo URL expires after one hour, but expiry does not delete the stored photo; public bucket access, if enabled, may still allow access to the object.

You may submit a deletion or privacy request through a support ticket. We may need to verify your identity. We will handle requests under applicable law and explain if information must be retained, such as transaction records. A request to the Service cannot by itself delete copies already held by an AI provider, payment provider, or other recipient; you may also need to contact that provider.

For privacy requests from people who cannot sign in, email support@bicep-heart.pro. The retention period for photos, tasks, and generated videos depends on storage configuration and is disclosed above.

6. Security

The Service uses account access controls and stores passwords as hashes. Bicep Heart photo URLs are signed and expire after one hour, but we do not represent photo storage as private unless public reads are disabled on the configured bucket. No online service can guarantee absolute security.

7. Cookies and Local Storage

The Service uses necessary browser storage for functions such as authentication, language preference, and application settings. If optional analytics are enabled, they may use additional storage or cookies. You can manage browser storage through your browser settings, although removing necessary cookies may sign you out or affect Service functions.

8. Your Privacy Rights

Depending on your location, applicable law may give you rights to access, correct, delete, restrict, object to, or receive a copy of personal information, or to withdraw consent. You may update some account details in account settings and submit other requests through a support ticket. We may ask for information needed to verify the request and will respond as required by law.

People who cannot access a support ticket can exercise their rights by emailing support@bicep-heart.pro.

9. Children

The Service is intended for adults aged 18 or older and is not directed to children. If you believe a child has provided personal information, contact support@bicep-heart.pro.

10. Changes

We may update this Policy as the Service or its providers change. The "Last updated" date above shows when this notice was last revised. Material changes will be communicated as required by law.

11. Contact

For privacy requests, email support@bicep-heart.pro or use the support ticket system.