Last updated: August 18, 2026

Avatarly AI (“Avatarly AI,” “we,” “us,” or “our”) provides an online service that turns photos into AI-generated videos, including photo-to-video generation, face swap, hairstyle change, and body reshaping (the “Service”). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices and rights you have — including under the EU/UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA). By using the Service, you agree to the practices described here.

1. Information We Collect

We collect the following categories of information:

• Account information — Name, email address, password (hashed), profile photo, sign-in method (Google/Apple, if offered)
• User content — Photos, videos, and template selections you upload or generate using the Service
• Payment information — Billing details processed by our third-party payment processor (e.g. [Stripe / Razorpay / Paddle]) — we do not store full card numbers
• Usage data — Features used, generation history, session duration, clicks, in-app actions
• Device & log data — IP address, browser type, device identifiers, operating system, crash logs
• Communications — Messages you send to support, survey responses, feedback

2. Photos, Videos & Biometric Data

Our Service is built around your photos and face — this is sensitive information and we treat it with extra care.

• When you upload a photo or video to generate a face swap, hairstyle change, body reshape, or photo-to-video output, our systems detect and analyze facial landmarks and other visual attributes needed to produce the result. This may constitute “biometric data” or “special category data” under GDPR, and “sensitive personal information” under the CCPA/CPRA, as well as under biometric privacy laws such as Illinois’ BIPA and similar state laws.
• We only use this facial and body data to generate the output you requested (e.g., the swapped face, the new hairstyle, the reshaped body, or the generated video).
• We do not use your photos to identify you against outside databases, build a persistent biometric identity profile, or sell your facial data.
• By uploading a photo or video, you confirm that you have the right to use that image (e.g., it’s your own photo, or you have the depicted person’s permission) and you give us your explicit consent to process it as described in this section for the purpose of generating your requested output.

You can withdraw this consent at any time by deleting your account or content, or by contacting us at privacy@avatarlyai.com. Withdrawing consent won’t affect processing that already happened before your request.

3. How We Use Your Information

• To provide, operate, and maintain the Service, including generating your requested face swap, hairstyle change, body reshape, or photo-to-video output
• To create and manage your account, and process payments/subscriptions
• To improve and train quality/safety filters (e.g. detecting policy-violating uploads) — [confirm whether user content is also used to train/fine-tune AI models; if yes, this must be separately disclosed with opt-in consent]
• To communicate with you, including sending service updates, security alerts, and support responses
• To detect, investigate, and prevent fraud, abuse, and violations of our Terms of Service
• To comply with legal obligations and enforce our rights

4. Third-Party AI & Cloud Providers

To generate your outputs, we send your uploaded photos/videos to third-party AI model providers and cloud infrastructure/GPU providers that perform the underlying face-swap, hairstyle-change, body-reshape, and video-generation processing on our behalf (our “sub-processors”).

• These providers are contractually required to process your content only to deliver the requested output to us, and not to use it for their own independent purposes or to train their own models unless you’ve been separately informed and consented.
• We maintain a current list of our sub-processors and will update this policy or notify you when we add or change a provider that processes your content. [Link to current sub-processor list]
• Data sent to these providers is encrypted in transit.

5. Data Retention & Deletion

• Uploaded source photos/videos: automatically deleted from our processing systems shortly after your output has been generated (typically within [X hours]). We do not keep a permanent copy of your original uploads once processing is complete.
• Generated outputs (your face-swapped/reshaped video or image): stored in your account so you can access and download it, until you delete it or close your account.
• Account information: retained while your account is active, and for a limited period afterward as needed for legal, tax, or fraud-prevention purposes.
• Log/usage data: retained for up to [X months] for security and analytics, then deleted or anonymized.
• You can request early deletion of your content or account at any time (see Section 8, “Your Privacy Rights”).

6. Legal Basis for Processing (GDPR)

If you’re in the EEA, UK, or a similar jurisdiction, we rely on the following legal bases:

• Consent — for processing your photos/videos and any biometric/facial data, and for non-essential cookies
• Contract — to provide the Service you’ve signed up for and manage your account/subscription
• Legitimate interests — for fraud prevention, service security, and improving the Service, balanced against your rights
• Legal obligation — where we must retain or disclose information to comply with the law

7. How We Share Information

We do not sell your personal information or your photos/videos. We may share information with:

• Service providers/sub-processors — AI model providers, cloud hosting, payment processors, analytics, and customer support tools, solely to operate the Service
• Legal & safety — law enforcement or regulators where required by law, or to protect the rights, safety, or property of Avatarly AI, our users, or the public
• Business transfers — in connection with a merger, acquisition, or asset sale, subject to standard confidentiality protections
• With your direction — if you choose to share or export your generated content

8. Your Privacy Rights

If you’re in the EEA/UK (GDPR)

• Right to access, correct, or delete your personal data
• Right to restrict or object to processing
• Right to data portability
• Right to withdraw consent at any time
• Right to lodge a complaint with your local data protection authority

If you’re in California (CCPA/CPRA)

• Right to know what personal information (including sensitive personal information, such as facial/biometric data) we collect, use, and disclose
• Right to delete your personal information
• Right to correct inaccurate personal information
• Right to opt out of the “sale” or “sharing” of personal information (we do not currently sell or share personal information for cross-context behavioral advertising)
• Right to limit use of sensitive personal information
• Right to non-discrimination for exercising your privacy rights

How to exercise your rights

Email privacy@avatarlyai.com or use the in-app “Delete My Data” option in Account Settings. We’ll verify your request and respond within the timeframe required by applicable law (typically 30 days under GDPR, 45 days under CCPA).

9. Cookies & Tracking

We use cookies and similar technologies to:

• Keep you signed in and remember your preferences
• Understand how the Service is used, to improve performance (analytics)
• Measure the effectiveness of our marketing, where applicable

You can manage cookie preferences through our cookie banner/settings tool or your browser settings. Blocking some cookies may affect how the Service functions.

10. Data Security

We use industry-standard technical and organizational measures — including encryption in transit, access controls, and regular security reviews — to protect your information. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

11. International Data Transfers

We and our sub-processors may process your information in countries outside your own, including the [United States / India — specify]. Where we transfer personal data out of the EEA/UK, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) or an equivalent approved transfer mechanism.

12. Children’s Privacy

The Service is not directed to children under 13 (or under 16 in the EEA/UK), and we do not knowingly collect personal information, photos, or videos from children in that age range. If you believe a child has provided us with personal information, please contact us so we can delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we’ll notify you by email or an in-app notice before the changes take effect. The “Last updated” date at the top of this page reflects the most recent revision.

14. Contact Us

If you have questions about this Privacy Policy or want to exercise your privacy rights, contact us:

Avatarly AI Email: privacy@avatarlyai.com Address: [Company legal name & registered address]