Privacy policy

01Who is responsible

The data controller is NFP, which operates ezcrea.

For any question about your data, or to exercise your rights, write to support@ezcrea.com.

02What we collect

• Account data: email address, password (stored only as a one-way hash), name, and your Google account identifier if you sign in with Google.
• Older profile fields: we no longer ask for a username, profile photo, bio, pronouns or date of birth. Those an older account still holds are shown nowhere and are erased with the account.
• Your content: the source videos you send (a TikTok link or a file you upload), the photos of your characters, your settings (quality, format), the title of each source video in your list, and the videos created for you.
• Your rights confirmations: each time you tick “I have the right to use this video”, a record of it: your account id and email address at that time, the video (TikTok id and link, or the SHA-256 fingerprint of the file), the prepared video it was used for, the version of our terms, the date and time, and a hash of your IP address (see “Rights confirmations”).
• Purchases: plan, credit packs, promo codes, credit balance and history, the order details Link sends us (name, email, billing country or address, business tax ID if you give one, amounts and currency, taxes and payment status), and the consent you give on our order summary before paying (the wording you ticked, its language, the date and time, and the offer), which we keep with the order in our Stripe account and repeat in the confirmation email we send you. We never see or store your card number.
• Messages: the feedback and support messages you send us, with any attached screenshot.
• Technical data: session cookie, IP address and request logs kept by our host for security and troubleshooting.

03Why we use it

• To provide ezcrea: create your account, prepare your source videos, create your videos and keep them in My videos, manage credits, subscriptions and payments (performance of our contract with you).
• To reuse a video that was already prepared for anyone who submits the same video, so that preparation is instant and the same video isn't processed twice (our legitimate interest in a fast, efficient service; see “Prepared videos”).
• To prevent fraud and abuse, handle takedown requests, enforce our terms and secure accounts, and to keep your rights confirmation as proof (our legitimate interest in keeping ezcrea safe and lawful).
• To keep invoices and accounting records (our legal obligations), and the record of your consent at checkout, to show that you asked for your credits right away (our legitimate interest in being able to prove it).
• To send you tips, product news and offers, only if you turned on marketing emails (your consent, which you can withdraw at any time in Account).

Service emails (email confirmation, security alerts, order confirmations, the reminder before a yearly plan renews, important changes) are sent whatever your marketing choice. Receipts and invoices are sent by Link (see “Payments: Link and Stripe”).

04AI creation by third-party providers

To prepare a source video and create your video, the source video (or images taken from it), the photos of your characters and your settings are sent to the providers that run the AI models (currently fal.ai and Replicate), which run models made by other companies (such as Kuaishou or Google). They process this data to return the result, under their own terms and privacy policies, and may keep it for a limited time.

We don't sell your data and we don't use your uploads or creations to train AI models.

05Payments: Link and Stripe

Purchases are sold through Link: Sold through Link, LLC, a Stripe company, is the merchant of record, and Stripe processes the payment. At checkout, they collect your email, name, billing country or address, payment details and, if you buy as a business, your tax ID. They use this data to take the payment, prevent fraud, calculate and pay taxes, issue receipts and invoices, and handle order support.

For checkout, payment, fraud prevention, taxes, invoicing and order support, Stripe and Link act as independent controllers, under their own privacy policies (link.com/privacy and stripe.com/privacy). For the subscription management we set up (the customer portal) and the order records we keep in our Stripe account (such as your consent at checkout), Stripe acts on our behalf, as our processor. They share with us the order details listed under “Purchases” in “What we collect” (never your card number), and we use them under this policy. A Link account may be needed to manage a subscription.

To access or delete the data Link holds, contact Link (support.link.com). If you ask Link to delete it, Link may cancel your subscription and erase the related payment data in our Stripe account; the credits already on your ezcrea account stay there. Deleting your ezcrea account does not delete the data Link holds.

06Who receives it

• Vercel: website hosting and file storage.
• Turso: database hosting.
• Stripe and Link: checkout, payments, taxes, invoices and order support, as independent controllers; subscription management, the customer portal and our order records, with Stripe as our processor (see “Payments: Link and Stripe”).
• Resend: sending emails.
• Google: only if you use "Continue with Google".
• AI providers (fal.ai, Replicate and the makers of the models they run): only what preparing a video or creating yours needs.
• Public authorities, when the law requires it.

Each of these providers only receives what it needs for its task and acts on our instructions or under its own privacy policy.

07Transfers outside the EU

Some of these providers are based in the United States. These transfers rely on the EU–US Data Privacy Framework when the provider is certified, or on the European Commission's Standard Contractual Clauses. Stripe and Link may also process payment data in other countries, such as India, with the same kind of safeguards.

08How long we keep it

• Account and content: as long as your account exists. When you delete your account, they are deleted from our systems right away (backups are overwritten within 30 days). Some records are kept longer, as listed below.
• A video you delete from My videos is removed immediately, with its files. A source video you remove from your list is removed from your account right away (the record of your rights confirmation stays, see below); the prepared video itself follows the rules in “Prepared videos”.
• Invoices and purchase records: 10 years, as required by accounting law. Your receipts and invoices are issued and kept by Link (in some countries, the invoice is issued in our name); we keep our own record of your purchases.
• The record of your consent at checkout: 5 years after the purchase, so that we can prove it. It is kept with the order in our Stripe account (if Link erases your payment data at your request, it may go with it), and the confirmation email we sent you repeats it.
• The record of each rights confirmation: 5 years after it was given, even if you remove the video from your list or delete your account (see “Rights confirmations”).
• Security logs: up to 12 months.
• Feedback messages: up to 3 years, or until you delete your account.

09Prepared videos

When you paste a TikTok link, our server fetches the video from TikTok at your request; your account details aren't sent to TikTok. Before it can be cloned, a source video is prepared once. We keep a ready-to-use copy of it, a few frames taken from it, cut-outs of the people found in it and, for a TikTok video, its public TikTok details (video id, caption, author, length and link). We call this preparation a template.

A template is identified by its TikTok video id and/or by a SHA-256 fingerprint of the file (a short code computed from its content, from which the video can't be rebuilt). When another user submits the same TikTok video or an identical file, the template already prepared is reused for them: preparation is instant and the same video isn't processed twice.

Only the prepared source video is shared this way. Other users never see your account, the title of the video in your list, your photos or your creations, and a template is never shown publicly.

A template prepared from a file you uploaded is deleted, with its files, as soon as the last user who has it removes it from their list or deletes their account. A template prepared from a TikTok link is kept for up to 14 days after that, so that it can be reused, then deleted. When a video is taken down at a rights holder's request, its files are deleted for everyone, and we only keep a record of it (such as its TikTok id or its fingerprint) so that it can't be prepared again.

Your rights confirmations are kept apart from the template, for 5 years (see “Rights confirmations”).

10Rights confirmations

Each time you tick “I have the right to use this video”, we record: your account id and your account's email address at that time, the kind of source (TikTok link or uploaded file), the TikTok video id and link or the SHA-256 fingerprint of the file, the id of the prepared video, the version of our terms, the date and time, and a hash of your IP address computed with a secret key (we don't keep the address itself).

Why: to be able to prove who confirmed having the rights to a video, when and under which terms, if a rights holder makes a claim about a video used on ezcrea, and to defend ourselves against such a claim. Legal basis: our legitimate interest in establishing, exercising or defending legal claims (GDPR, art. 6(1)(f)).

How long: 5 years from each confirmation (the general limitation period under French law), then it is deleted automatically. It is kept even if you remove the video from your list or delete your account: the right to erasure doesn't apply to data needed to establish, exercise or defend legal claims (GDPR, art. 17(3)(e)). It is used for nothing else, is never shown to other users and is only disclosed, when a claim or the law requires it, to our advisers, a court or the competent authorities. You can ask for a copy at support@ezcrea.com.

11Cookies

We only use the cookies the service needs to work: your session (to keep you signed in), your language, your currency (euros or US dollars, kept for one year), and a short-lived cookie during Google sign-in. Stripe and Link set their own cookies on their payment and billing pages. We use no advertising or third-party analytics cookies, which is why there is no consent banner.

Prices are shown in euros in the European Economic Area, in Switzerland and in the other places that use the euro, and in US dollars elsewhere. To choose, we use the country of your connection, which our host works out from your IP address. We don't keep that country: we only remember the currency it gives, or the one you pick on the pricing page, in the currency cookie. If your account can only pay in one currency (because of a subscription in it), the pricing page switches to it for the rest of your visit only.

Your browser may also keep unsent drafts locally on your device.

12Your rights

Under the GDPR you can access your data, correct it, delete it, restrict or object to its use, receive it in a portable format, and withdraw your consent at any time.

You can change your name, remove your videos and delete your account yourself in Account and My videos. For anything else, write to support@ezcrea.com: we answer within one month.

You can also complain to your data protection authority (in France, the CNIL: www.cnil.fr).

13Security

Passwords are never stored as such: we keep only a salted hash made with scrypt, a deliberately slow one-way function. Your session cookie is valid for 30 days and is invalidated on our server when you log out; changing your password signs out your other devices, and you can sign out of all your other devices yourself in Account. Password reset links are valid for 1 hour and email confirmation links for 24 hours, and each works only once.

Connections are encrypted (HTTPS), files are stored at unguessable addresses and access to our systems is restricted. No system is perfectly secure: if a breach affects you, we'll inform you as the law requires.

14Age

ezcrea is for people aged 18 and over. We don't knowingly collect data about minors: if you think a minor has an account, tell us and we'll delete it.

15Changes

We may update this policy. For significant changes, we'll let you know by email or in the app before they apply. The date at the top shows the current version.