Privacy Policy

1. Data Controller

1.1. Identification and Contact. AI Video Check is operated by AI Video Check (Individual Entrepreneur registered in Ukraine). The Controller determines the purposes and means of processing your personal data. For any questions or requests relating to your personal data, you may contact us at: support@aivideocheck.net

1.2. Responsibilities. As Data Controller, we are responsible for:

• Implementing appropriate technical and organizational measures to safeguard your data;
• Processing data only on valid legal grounds and in strict accordance with this Privacy Policy;
• Responding to your rights requests (access, correction, deletion, portability, objection) within 30 calendar days.

2. Personal Data Collected

2.1. Registration Data. When you register for an account (free or paid), we collect your email address, store a hashed password (using industry-standard hashing algorithms such as bcrypt), and (optionally) your chosen display name or avatar. This information is used solely to identify you within the Service and to secure your access.

2.2. OAuth Data (Google Sign-In). If you sign in via Google, we receive from Google only the minimal profile information you expressly consent to share: your Google-registered email address, full name, and profile picture URL. We do not store additional Google account data (contacts, calendar, etc.).

2.3. Video-Related Data. Metadata: for every check — free, paid or anonymous — we record whether you submitted a file or a link, the size and the duration of the media, the domain of a source link (for free and anonymous checks the domain alone, not the full address), the date and time of submission, and the outcome of the analysis (probability score and verdict). Duration is recorded because it determines the price of the check in credits and the confidence level shown alongside the result. For paid accounts we additionally store the full source URL or original file name and per-check feature metrics, so that your history remains readable. Technical Fingerprint: the submitted video file itself is never stored beyond the moment of analysis. To speed up repeated checks and reduce load, for checks performed via a public link we may retain, for up to twenty-one (21) days, a compact technical fingerprint consisting of a cryptographic checksum (hash) of the media and a numeric feature vector (embedding) derived from it. This fingerprint cannot be used to reconstruct or view the original video and does not by itself identify you. Preview Images:

• Free users: a temporary Base64-encoded thumbnail is generated on-the-fly for immediate display and is not persisted on our servers.
• Paid users: a single frozen frame (JPEG/PNG) is stored securely on S3/MinIO for up to 30 days to allow viewing in your history.

Analysis Results: the probability score and verdict of every check are retained as described in Section 5. For paid accounts, the readable history (source URL or original file name, feature metrics) is persisted until you delete your account or request data removal.

2.4. Reporting a Wrong Result. If you press "report a wrong result" on a check you made from a public link, we store the address of that link alongside your report. We do this for one reason: without knowing which video we got wrong, a report tells us that we were wrong but not where, and we cannot fix anything. Nothing is stored for checks made by uploading a file, and nothing is stored unless you press the button — the report is yours to make or not. The stored address is used only to look into that report, is deleted after ninety (90) days, and is never used to train our models (see 5.1.1).

3. Purpose of Processing

3.1. Service Delivery. We process your registration, authentication data, and video submissions to perform the core functionality of the Service: uploading your video, running AI-based analysis, generating thumbnails, and returning results accurately and promptly.

3.2. Account Management & Security. Your email, password hash, OAuth tokens, and session cookies enable secure login, session continuity, and protection against unauthorized access. We also maintain a mapping of Fingerprint ID to user ID to detect and deter multi-account abuse, ensuring fair use of free-tier resources.

3.3. Fraud Prevention & Quality Assurance. We leverage technical identifiers (User-Agent, cookie, Fingerprint ID) and internal logs to identify suspicious patterns—such as repeated anonymous checks from the same device—and to investigate and prevent misuse, thereby safeguarding both the Service's integrity and user experience.

4. Legal Basis for Processing

4.1. Performance of a Contract. We process your registration details (email, password hash), video submissions, and history of checks in order to fulfil our Terms of Service and provide the core video-analysis functionality you have requested.

4.2. Essential Cookies & Session Technologies.

• Strictly Necessary Cookies (session cookie for Fingerprint ID; authentication cookies) are required for the Service to function and enforce fair-use limits. These are processed on the basis of contract performance and our legitimate interests, and do not require separate opt-in consent.
• Analytics & Advertising Cookies (Google Analytics; advertising networks, where advertising is enabled) are activated only after you have given explicit consent; you may withdraw such consent at any time via your browser settings or by contacting us.

4.3. Legitimate Interests. We process technical identifiers (Fingerprint ID, User-Agent, browser attributes) and internal logs on the basis of our legitimate interest in preventing fraud and multi-accounting, ensuring fair access to free-tier resources, and maintaining the security and integrity of the Service. On the same basis we keep the first-touch record described in 7.1, which tells us in aggregate how people find the Service. That measurement is first-party only: it stays on our own systems, is shared with nobody, and never follows you to another website.

5. Data Retention & Deletion

5.1. Ephemeral Files & Previews.

• Video files: automatically deleted immediately after analysis completion. For checks performed via a public link, a compact technical fingerprint (a checksum and a numeric feature vector, from which the video cannot be reconstructed) may be retained for up to twenty-one (21) days to accelerate repeated checks, after which it is deleted.
• Free-user previews: generated on-the-fly as Base64 and never stored.

5.1.1. Machine Learning. We do not use the videos, images or files you submit to train, retrain, fine-tune or evaluate our detection models, and we do not supply them to any third party for that purpose. Our models are trained on material we collect and label ourselves. The technical fingerprint described above serves one function only — recognising a repeated check of the same media — and is deleted after twenty-one (21) days.

One narrow exception, and only where you have asked us to look: when you report a wrong result on a check made from a public link, we may open that link and watch the video ourselves, in order to understand why our answer was wrong. That is the whole of it. The video does not enter a training set, an evaluation set or a benchmark, and it is not passed to anyone. What we take from it is an understanding of what our detector misses — and any improvement that follows is made with material we collect and label ourselves, as above.

5.2. Check Records & Paid-User Data.

• Check records and product events (the metadata listed in Section 2.3, together with the result): retained for every check — free, paid and anonymous alike — until you delete your account or explicitly request removal via dashboard or email. Records of anonymous checks are linked to a device identifier rather than to your name. That identifier is erased automatically twelve (12) months after the check; from then on the record is statistical data that no longer relates to you. While an anonymous record can still be connected to you, it is removed on the same request.
• Link addresses attached to a "wrong result" report (Section 2.4): deleted ninety (90) days after the report. Removal is automatic and does not depend on a request from you; you may still ask for it sooner.
• Single-frame previews (paid accounts): securely stored for up to 30 days to enable viewing in your history.
• Readable history — full source URL or original file name, and feature metrics (paid accounts): retained until you delete your account or request removal.

5.3. Account Data & Fingerprint ID.

• Account details (email, password hash, OAuth tokens) are retained until you delete your account.
• You may delete by yourself in the dashboard section or request full deletion of your personal data and history; such requests are completed within 7 business days.

5.4. Data Retention After Downgrade.

• When downgrading from a paid plan to the free tier, your analysis history is retained but is not accessible on the free tier.
• Access to the history is restored when a subscription is purchased again.
• You may delete your history at any time by deleting your account or by contacting support.

6. Data Sharing

6.1. Google Services.

• OAuth: only your Google-registered email, name and profile picture URL are shared with us during sign-in.
• Analytics & Ads: aggregate usage data is shared with Google Analytics under its terms; ad-performance metrics are shared with advertising networks only where advertising is enabled.
• Google Signals: where you have accepted optional cookies, Google Analytics also matches your visit against your own Google account, if you are signed in to one and have allowed Google to do so. This gives us aggregate age, gender and interest categories, and it means Google receives a signal about your visit that it may use for advertising on other sites — including at present, while we display no advertising ourselves. You can switch this off for every site at once in your Google account under Ads settings, and declining optional cookies on our banner prevents it here.

6.2. Google Advertising Integration.

• The Service may display third-party advertisements to Free-tier users; advertising is currently disabled.
• Google may use cookies and web beacons to personalize ads and measure performance.
• Where personalized advertising is enabled, you may opt out via your browser settings or the opt-out tools of the relevant advertising network.
• Advertisements and links to third-party sites are provided as a convenience. We do not endorse or control these third parties and are not responsible for their content or privacy practices.

6.3. Payment Processing.

• Payments are processed by our payment partners depending on your location — Monobank for customers in Ukraine, and Paddle.com Market Ltd (acting as Merchant of Record) for customers outside Ukraine. When you make a purchase, the data required to process the payment (e-mail address, amount, invoice identifiers) is handled by the applicable payment partner under its own terms and privacy policy. We never receive or store your full card details. We never sell or rent your personal data. Apart from the payment partners named above, the service providers listed in 6.5, and the legal requirements in 6.4, we do not disclose it to anyone.
• Everything else is processed by software we run ourselves (PostgreSQL, Redis, object storage and Celery workers), on infrastructure rented from the providers listed in 6.5.

6.4. Legal Requirements. We may disclose personal data if required by law or valid governmental request (e.g., court order), but only to the minimum extent necessary.

6.5. Service Providers (Sub-processors). Running the Service requires a small number of providers. Each of them processes personal data only on our instructions, only for the function named, and under its own data-processing terms. We do not sell or rent data to any of them.

• Vercel Inc. — hosts the website and its API routes, and supplies the built-in page-view analytics. It sees requests to the site, including your IP address and browser user-agent. Its analytics sets no cookies.
• Hetzner Online GmbH — provides the servers that run the analysis and the object storage beside them; these machines are located in Finland. They hold a submitted video for the duration of its analysis, the preview images described in 2.3, and encrypted backups of the database.
• Neon Inc. — provides the managed PostgreSQL database holding your account, your check history and your payment records.
• Microsoft Corporation — delivers our outgoing e-mail through smtp.office365.com: sign-up confirmations, password resets and purchase receipts. It sees the recipient address and the contents of the message.
• Google LLC — sign-in with Google, if you choose to use it, and Google Analytics. Both are described in 6.1.
• Monobank and Paddle.com Market Ltd — payments, as described in 6.3.

6.6. Public Sharing (optional).

• When you choose to share a result, we create a public page and preview image containing the analyzed video's thumbnail frame and the verdict. This page is accessible to anyone who has the link.
• Sharing is entirely optional and happens only when you click "Share" — no result is made public automatically.
• Shared content is automatically removed after 90 days, or when a registered user deletes their account, whichever comes first.

7. Cookies & Similar Technologies

7.1. Strictly Necessary Cookies.

• Session cookie for Fingerprint ID: required to identify anonymous users and enforce fair-use policies. Cannot be disabled without breaking core functionality.
• Authentication cookies: required for logged-in sessions and account security.
• Check ownership cookie (avc_owner): an opaque random value set when you start a check, so that only the browser which submitted a video can retrieve its result. It contains no information about you, is never used for analytics or advertising, and expires after 7 days.
• First-touch cookie (avc_ft): set on your first visit and kept for one year. It records how you arrived — the traffic source, the referring address (shortened to 200 characters), whether you are on a phone or a computer, the language of the page, and the same anonymous identifier described above. It serves two purposes: aggregate statistics on where our visitors come from, and, if you later create an account, sending your welcome e-mail in the language you were reading and connecting your earlier visit to that account. It is read only by us, is never shared with any third party, and is not used to follow you across other websites.

7.2. Analytical & Advertising Cookies. These are set only after you accept them. Until you do, the Google Analytics script is not loaded at all, so no analytics data can leave your browser.

• Google Analytics: collects anonymous usage metrics (page views, session duration) to help us improve the Service.
• Advertising cookies: used only where advertising is enabled, to serve and measure ads shown to free-tier users. Advertising is currently disabled.

7.3. Managing Cookies.

• On your first visit we ask whether to enable optional cookies. You may change that answer at any time through the "Cookie settings" link at the bottom of any page; declining or withdrawing is as immediate as accepting.
• The choice itself is stored in your browser's local storage under avc_consent, so that we do not have to ask again. It records nothing but the answer.
• You may also clear or block non-essential cookies via your browser settings or the opt-out tools provided by the relevant provider.
• Blocking strictly necessary cookies will prevent key Service features (anonymous checks, account sessions) from working correctly.

8. User Rights

8.1. Access & Portability. You may request a copy of all personal data we hold about you, in a structured, commonly used format.

8.2. Rectification & Erasure. You have the right to correct any inaccurate or incomplete personal data. You may request deletion of your personal data and analysis history; we will comply within 7 business days, except to the extent retention is required by law.

8.3. Withdrawal & Objection. You can withdraw consent for analytics/advertising cookies at any time. You may object to processing based on legitimate interests; we will review and, if appropriate, cease processing.

9. Data Security

9.1. Encryption & Transport Security. All data in transit is protected via TLS (HTTPS). Sensitive data (passwords) are stored hashed (bcrypt or equivalent).

9.2. Access Controls & Monitoring. Database and storage access is restricted by role and credentials. Audit logs record administrative access and changes to production systems.

9.3. Regular Audits & Updates. Dependencies and infrastructure components are patched promptly. Periodic security reviews ensure compliance with best practices.

10. Children's Privacy

10.1. Age Restriction. The Service is intended for users aged 18 and older.

10.2. No Minor Data Collection. We do not knowingly collect or process personal data of minors under 18.

10.3. Deletion of Inadvertent Data. If we become aware of any minor's data, we will delete it immediately upon discovery.

11. Account & Data Deletion

11.1. Self-Service Deletion. You may delete your account and all associated data directly in your dashboard.

11.2. Email Requests. Alternatively, send a deletion request to support@aivideocheck.net; we will confirm and complete deletion within 7 business days.

11.3. Post-Deletion. Upon deletion, all personal data (account details, history, previews) will be irreversibly removed from active storage; backups will be purged in accordance with our backup retention schedule.

12. Changes to This Policy

12.1. Amendments. We may update this Privacy Policy at any time to reflect changes in practices or legal requirements.

12.2. Notice of Changes. The "Effective Date" at the top will be revised, and significant amendments will be announced via email or website notice.

12.3. Continued Use. Your continued use of the Service after any update constitutes acceptance of the revised Policy.

13. Governing Law & Jurisdiction

13.1. Applicable Law. This Privacy Policy is governed by the laws of Ukraine, without regard to conflict-of-law principles.

13.2. Jurisdiction. Any disputes arising under or relating to this Privacy Policy shall be brought exclusively in the courts of Ukraine.

13.3. Severability. If any provision is held invalid or unenforceable, the remaining provisions will remain in full force and effect.

14. Contact Information

14.1. Email. For all data-related inquiries or requests, email: support@aivideocheck.net

14.2. Response Time. We aim to respond to all privacy-related requests within 30 calendar days.

14.3. Data Protection Officer. Currently, there is no separate DPO; privacy questions are handled directly by the Service operator.