Privacy Policy | Heart Bicep AI

Who we are

Heart Bicep AI operates heartbicepai.com. This policy explains how we handle personal information when you use the service. For privacy questions or requests, email support@heartbicepai.com.

Information we collect

We collect the photo you upload and the previews and videos generated from it. We use a session cookie that works as an anonymous account so the service can associate your activity and credits with your session. An anonymous session is not a promise that your activity can never be linked to you: a photo or an order can contain identifying information.

We collect the email address you enter at checkout, the one you sign in with, and any you use to contact support. You do not need an account to buy: purchases made with an email join the account for that address once someone signs in with it, through a sign-in link we email to it or through Google. If you choose Google sign-in, Google shares your name, email address and profile picture with us. We keep order records needed to administer purchases, credits, refunds, and payment disputes. We also process your IP address to apply abuse limits. If you contact support, we receive the information you choose to include in your message.

The check before upload

The face and arms check runs in your browser on your device. It checks whether a face, both arms, and one person are in frame. Only a pass/fail summary of that check is sent to us. We do not create or store face templates.

This local check is separate from generation. When you submit the photo for a preview or video, the photo itself is uploaded and processed by the service providers described below. The local check does not mean that generation happens entirely on your device.

The automatic photo check

When you submit a photo, we first send it to Clef-flash, an AI model hosted on Cloudflare Workers AI. Every submitted photo goes there, including photos that end up refused. Clef-flash returns three scores: how likely the photo is to contain sexual or explicit content, how likely it is to show someone who looks under 18, and how likely it is to show a celebrity or public figure. These are automated estimates. We receive only the scores, never a name, and we do not create or store face templates.

If a score is too high, we refuse the photo immediately. We do not store a refused photo or pass it to the generation providers. If a photo passes, we keep its scores with the upload record to show that it was checked.

Cloudflare lists Clef-flash as a zero data retention model. Its Workers AI data usage page says that for standard requests like this one, it does not keep inputs or outputs once they are no longer needed to process the request and deliver the response, subject to limited safety, security, and legal exceptions. It also says it does not use them to train AI models, and that it may keep operational metadata that does not include the content itself, such as timestamps and request sizes.

For refused photos, we keep temporary service logs of the scores and the account involved. We also count refusals per account and per keyed hash of the IP address, for about two days, so that we can pause uploads until 00:00 UTC after repeated refusals.

If a photo scores high on both the sexual content check and the under-18 check, we also keep a lasting record so that we can enforce our rules and meet legal obligations. It contains the time, the account or anonymous session, the two scores, the model version, and the reason for the refusal. It does not contain the photo or a link to it.

How we use information

We use this information to generate and deliver previews and videos, maintain your session and credits, email you sign-in links, order confirmations and a notice when a video is ready, process orders and refunds, answer support requests, and limit abuse. We do not send marketing email. We may also use necessary records to meet legal obligations or respond to lawful requests.

Where laws such as GDPR require a legal basis, we rely on performance of the service agreement for generation and purchases, legitimate interests for proportionate abuse prevention and service administration, and legal obligations for required records or disclosures. Where consent is legally required, we rely on that consent for the relevant processing.

We do not use your photos to train AI models, and we do not sell them. This statement describes our own use. It does not make a promise about every AI provider’s independent practices.

Payments

Waffo, our payment partner and merchant of record, processes payments, taxes and refunds. We never see your card numbers. We receive order and payment-status information needed to provide credits and handle your purchase. Waffo handles the payment information you submit under its own privacy terms and obligations.

Service providers and international processing

We use service providers to operate the product:

• Cloudflare provides hosting and storage, sends our emails, and checks submitted photos with Clef-flash on Workers AI, as described above.
• Google handles Google sign-in, if you choose it.
• Waffo processes payments as merchant of record.
• kie.ai acts as the gateway for AI generation requests.
• Kuaishou’s Kling processes photos for video generation.
• ByteDance’s Seedream processes photos for preview-image generation.

The AI providers receive your photo and information needed to check it or produce the requested result. Cloudflare also receives photos that end up refused, for the check. Their systems may be outside your country, and their processing is subject to their own retention practices. Cloudflare and Waffo may also process information internationally.

These transfers may involve countries with different privacy laws. Where applicable law requires safeguards for international transfers, the relevant processing must use those safeguards. Our 30-day deletion policy for service files does not promise that every provider deletes its own processing records on the same schedule.

We may disclose necessary information to comply with law, respond to valid legal process, address abuse, or protect legal rights. If you publish a result elsewhere, that platform’s handling of it is separate from this policy.

Retention and deletion

Uploaded photos, generated previews, and generated videos are automatically deleted from our service after 30 days. Download files you want to keep before then. We never store a photo that the automatic check refuses. You may request earlier deletion by emailing support@heartbicepai.com.

The 30-day period applies to these media files, not necessarily to order records or support correspondence. We retain other information only as needed for its stated purpose, including administering credits, meeting legal recordkeeping requirements, handling disputes, and limiting abuse. That includes the lasting record described under the automatic photo check. Providers may have separate retention periods for their processing.

Cookies

We use only cookies needed for the service to work, including the session cookie used as your anonymous account. We do not use optional advertising cookies. Blocking or deleting a necessary cookie can affect access to the session and its associated activity. To get your purchases back, sign in with the email you used at checkout, or contact support if you need help locating a purchase.

Adults only

The service is not for anyone under 18. Photos of anyone under 18 are prohibited, even with parental permission. If you believe such a photo or a child’s personal information has been submitted, contact us so we can investigate, remove the information as appropriate, and address the violation.

Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, and to restrict or object to certain processing. Laws such as GDPR and CCPA may provide additional rights, including withdrawal of consent where processing relies on it, protections against discrimination for exercising rights, and the right to complain to a relevant privacy regulator.

Send requests to support@heartbicepai.com. Include enough information to locate the relevant session or order, but do not send card numbers. We may ask for proportionate verification before disclosing or deleting information. We respond within the periods required by applicable law and explain any lawful exception that prevents us from fulfilling a request in full.

Changes to this policy

We may revise this policy as the service changes. We will update the date on this page and provide additional notice or obtain consent when required by law. For rules on using the service, read our Terms of Service.