Privacy policy
What data we process when you use MobyVid (web, API and MCP connector), why, and what rights you have. No tracking or ad cookies.
Development view: fields marked “To be published” don't appear in production. Fill them in before launch.
Who is responsible for your data
The data controller is the owner of MobyVid:
What data we process
- Account: email, name, password (we only store its hash), language, currency, country if you add it, the IP you signed up from and, if you turn it on, your two-step verification secret.
- Purchases: pack, amount, currency, order status and a record of your consent (the text you accepted, date and IP). Your card details are handled by the merchant of record, never by us.
- Content: the prompts you write, the files you upload (photos, video and audio), the results you generate and the products you save.
- Usage: takes, credits spent, API keys (we only keep a hashed fingerprint) and the limits you set.
- Technical data: IP address, browser and active sessions, to keep you signed in and protect your account.
- Support: whatever you tell us by email or WhatsApp.
Your files may show other people's faces or voices. Only upload them if you have those people's consent to use them in advertising.
Why we use it and on what legal basis
- To provide the service you signed up for: account, generation, studio, API, MCP, credits and support. Basis: performance of the contract (GDPR art. 6(1)(b)).
- To take payments, keep order records and meet tax and accounting duties. Basis: legal obligation (GDPR art. 6(1)(c)).
- To protect the service: prevent fraud, abuse, spam and unauthorized access, and block prohibited content. Basis: legitimate interest (GDPR art. 6(1)(f)).
- To send service emails: verification, security, receipts and important changes. Basis: performance of the contract.
- To send product news and offers, only if you opt in. Basis: consent (GDPR art. 6(1)(a)). You can withdraw it at any time.
We don't use your content to train AI models. We don't sell your data or build ad profiles.
We don't make automated decisions with legal effects on you. An automated filter may block a request; if you think that's a mistake, email us.
Who we share data with
Only the providers we need to run the service:
| Provider | Purpose | Location |
|---|---|---|
| kie.ai (NEXUSAI SERVICES LLC and INNOLEAP AI LLC) | Runs generation: receives your prompts and input files. | United States |
| Model providers reached through kie.ai, for example Google, Kuaishou (Kling), ByteDance (Seedance) and ElevenLabs | Run each image, video, voice or music model. | United States, China and other countries |
| Paddle.com Market Limited | Merchant of record: takes payment, invoices and applies taxes. Handles your payment data as an independent controller. | United Kingdom |
| Dodo Payments | Merchant of record: takes payment, invoices and applies taxes. Handles your payment data as an independent controller. | See its privacy policy |
| Resend, Inc. | Sends service emails. | United States |
| Railway Corporation | Hosts the server, database and files. | United States |
We also share data with authorities when the law requires it.
Transfers outside the EU
Several providers are outside the European Economic Area, mostly in the United States. To generate what you ask for, we have to send them your prompts and files.
These transfers rely on the European Commission's standard contractual clauses where the provider offers them, or on being necessary to perform the contract you asked for (GDPR art. 49(1)(b)). The United Kingdom has an EU adequacy decision.
How long we keep data
| Data | Kept for |
|---|---|
| Uploaded and generated files | 60 days from creation, then deleted automatically. You can delete them sooner. |
| Copy at kie.ai | According to its documentation, kie.ai deletes files after 14 days and its logs after 2 months. |
| Account and saved products | As long as you keep your account. When you delete it, we delete your files, sessions, keys and products. |
| Orders, credit history and consents | As long as tax and accounting laws require, even after you delete your account. |
| Database backups | One a day. Each backup is kept for 14 days. |
| Sessions | Until you sign out or they expire. |
Your rights
You can ask to access, correct, delete, restrict, port or object to the processing of your data, and you can withdraw consent at any time.
- From your account you can download a copy of your data as JSON and delete your account.
- For anything else, email us at To be published from your account's email address. We reply within the legal deadline of one month.
- If you think we've mishandled your data, you can complain to the Spanish Data Protection Agency (aepd.es) or the authority in your country.
If you live in Latin America, you also have the rights your local law gives you, such as ARCO rights in Mexico. Use the same email.
Cookies
We only use strictly necessary cookies and storage: session, language, currency, theme and your studio preferences. No analytics, ad or tracking cookies.
Security
We store passwords with PBKDF2 hashing and use HTTPS, optional two-step verification, signed expiring links for your files and daily backups. If a security breach affects your data, we'll tell you as the law requires.
Children
MobyVid is only for people 18 and over. We don't knowingly process data from minors.
Changes to this policy
If we change something important, we'll tell you by email or in the studio before it applies. The date at the top shows the current version.