Wowsmith Privacy Policy

Account data (your email and hashed authentication data), the photos and text you upload to create videos, your orders and their status, payment records (payments are processed by Stripe, so we never receive your full card number), support messages, and security and device logs such as IP address and timestamps.

If you upload photos of a person to create a custom performer (for example, an actor or, in Agent Tour, yourself), we process facial and likeness features from those images to generate a digital performer used only in your videos. We treat this as sensitive information.

• Purpose: solely to build and render the digital performer you requested.
• Consent: we require written consent from the person depicted (or their parent or legal guardian). You must not upload a person's likeness without their consent.
• No sale: we do not sell, rent, or trade likeness or biometric data, and we do not use it to train third-party models beyond producing your order.
• Retention and destruction: source likeness images and derived performer data are deleted when you delete the actor, when your account is deleted, or within our standard retention window (below), whichever comes first.

Residents of states with biometric-privacy laws (for example, Illinois BIPA, Texas CUBI, Washington HB 1493) have specific rights described under “Your rights” below.

Location metadata (EXIF/GPS) embedded in uploaded photos is stripped during ingest and is not used or shared, so your address does not travel with your files.

To create, review, and deliver your videos; to process payments and manage subscriptions; to provide support; to secure the service and prevent abuse; to send transactional messages about your account and orders; and to comply with law. We do not use your uploads to train third-party AI models beyond fulfilling your order.

Generating your video sends your photos, prompts, and (for custom performers) likeness images to third-party AI model providers for video, music, and text processing. We use providers under terms intended to limit their use of your content to serving your request, and we strip location metadata before processing. Provider practices can change; we maintain the current provider list below.

We do not sell your personal information for money. If you consent to advertising cookies, online identifiers may be shared with advertising platforms for ad measurement and remarketing, which some state laws treat as a “sale” or “sharing”; you can opt out through the “Your privacy choices” link (see Cookies above). We share data with service providers who help us run Wowsmith, under contracts that restrict their use of it:

• Hosting and database: Vercel, Supabase
• Media storage: Cloudflare R2; bot protection: Cloudflare Turnstile
• Payments: Stripe
• Transactional email: Resend
• AI generation: third-party video, music, and text model providers
• Analytics and advertising (only with your consent): Google (Analytics, Ads, Tag Manager), Meta (pixel)

We may also disclose information to comply with law, enforce our Terms, or protect rights and safety.

Uploads and deliverables are retained for 90 days after delivery and then deleted, unless you delete them sooner or the law requires longer retention (for example, payment records). You can request account deletion at any time, which removes your data and stored media, including source likeness images, on the schedule above.

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to opt out of the sale or sharing of personal information (we do not sell it), and to not be discriminated against for exercising these rights. Residents of the EU/UK have rights under the GDPR/UK GDPR, including access, rectification, erasure, portability, restriction, objection, the right to withdraw consent, and the right to complain to a supervisory authority. Residents covered by biometric-privacy laws may request information about, and deletion of, their biometric data. To exercise any right, email privacy@wowsmith.app; we respond within the timeframes required by law.

Wowsmith is not directed to children under 13 and we do not knowingly collect their personal information. You must not upload photos depicting a minor without verifiable parent or guardian consent, and we will delete such data if we learn it was collected without consent.

We send transactional emails (account, orders, security) that you cannot opt out of while you have an account. We send marketing emails only if you opt in, and every marketing email includes an unsubscribe link and our physical mailing address, consistent with CAN-SPAM. Unsubscribing from marketing does not stop transactional messages.

Strictly necessary cookies (your sign-in session, two-factor security, and Cloudflare Turnstile bot protection) are always on because the site cannot function without them. These do not require consent.

We also use, only with your consent, analytics cookies (to understand how the site is used) and advertising cookies (to measure and improve our advertising, through Google Analytics, Google Ads, and the Meta pixel, managed with Google Tag Manager). When these are active, a cookie banner asks for your choice on your first visit, non-essential cookies stay off until you accept, and we use Google Consent Mode so no analytics or advertising storage is used without consent. You can change your choice any time through the “Your privacy choices” link in our footer.

California and other US state residents: using advertising cookies can be treated as a “sale” or “sharing” of personal information for cross-context behavioral advertising under laws such as the CPRA. The “Your privacy choices” link is your opt-out, and we honor the Global Privacy Control (GPC) browser signal as a valid opt-out. EU/UK residents: we rely on your consent for analytics and advertising cookies and you may withdraw it any time through the same link.

We protect your data with encryption in transit and at rest, access controls scoped so one customer can never access another's data, and least-privilege infrastructure. No system is perfectly secure, but we work to keep your information safe. See our Security page for details.

We and our providers may process data in the United States and other countries. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for cross-border transfers.

If a breach affects your personal information, we will notify you and the relevant authorities as required by applicable law.

We may update this policy; for material changes we will provide notice and update the version date above. Continued use after changes take effect means you accept the updated policy.

Privacy questions and requests: privacy@wowsmith.app.