Privacy Policy

Vivid Moments ("we", "our", "us") makes custom video gifts from photographs. Two groups of people appear in this policy:

• Customers — the people who order a video and send us photographs.
• People in the photographs — usually the recipient of the gift and their family, who never contacted us themselves. Section 3 is about you.

The short version: we use your data to make the video you ordered, we never train AI models on your photographs, we never sell your data, and you can have it all deleted by sending one email.

1.1 What you give us directly

Your order brief

Your name and email address, the occasion, who the video is for and their relationship to you, the date you need it, the feel you want, and any notes you add.

Photographs

The images you upload on the order form. They go straight from your browser into private storage. We then read each one back, check it is genuinely a JPEG or PNG, and strip its EXIF metadata — including any GPS coordinates — before it is used for anything.

Correspondence

The emails you exchange with us about your order, including any feedback on the finished video.

Google account information

Only if you sign in to our self-serve creation tool: your email address and display name. We never receive your Google password.

1.2 What we collect automatically

Usage analytics

We use PostHog to record events such as page views, order_started, and order_submitted. PostHog may collect your approximate location (country/region), browser and device type, and referring page. Events go to PostHog Cloud in the US.

Payment metadata

When you pay, Stripe gives us a transaction ID, the amount, and a timestamp. We never receive or store your card number, security code, or billing address.

Session cookie

A random identifier in an HttpOnly, Secure, SameSite=Strict cookie. Contains no personal information. Used only by the self-serve tool.

Server logs

IP address, request path, timestamp, and status code, for security and debugging. Kept for a maximum of 90 days.

1.3 What we never collect

• Card numbers, security codes, or billing addresses — these go straight to Stripe
• Passwords
• Your contacts, precise location, or anything from your device beyond browser type

• To make and deliver your video — processing your photographs and brief. Legal basis: performance of our contract with you.
• To talk to you about your order — confirming your date, asking questions, sending the finished video. Legal basis: performance of a contract.
• To take payment — via Stripe. Legal basis: performance of a contract and our legal obligations around financial records.
• To keep the service secure — spotting fraud and abuse. Legal basis: our legitimate interests.
• To understand how the site is used — aggregate analytics. Legal basis: our legitimate interests, or your consent where required.

We do not use your photographs, your video, or your brief to train AI models. We do not sell, rent, or share your personal data for advertising. We do not use your video to promote our business unless you separately and explicitly tell us we may — and agreeing to our Terms does not give us that permission.

This is the normal case for us. Our customer is usually giving the video as a gift to you, or making one about you, and you had no part in placing the order. You still have rights over your personal data and we take them seriously.

3.1 How we came to have your photograph

Our customer sent it to us. When they did, they confirmed to us that the photographs were theirs to use and that the people shown would be comfortable appearing in the video. We rely on that confirmation — we have no way to contact you independently before the work is done, because we do not know who you are or how to reach you.

3.2 What we do with it

We use it to produce the single video our customer ordered, and nothing else. Specifically, we do not:

• Use facial recognition to identify you or match you against any other image
• Create or keep a faceprint, biometric template, or any other biometric identifier for the purpose of identifying you
• Build a database of faces, or link your image to any profile
• Train AI models on your image
• Share your image with anyone except the processors listed in Section 4
• Use your image to advertise our business

3.3 How to have it removed

Email support@vivid-moments.video and tell us you appear in photographs sent to us. You do not need an order reference, and you do not need to know who placed the order — describe what you can and we will find it.

We will delete the photographs, usually the same day, and we will tell the customer that we have done so. We may need to ask you something to locate the right order, and we will ask for as little as possible.

We share data only with the processors below, only for the purpose stated. All transfers use TLS.

Evolink

Generates the video transitions. Receives your photographs. Video generation is performed on their infrastructure.

fal.ai

Runs the image preparation steps — upscaling, reframing, and quality checks — before generation. Receives your photographs.

Anthropic

Assists our team in writing the creative direction for each transition. May receive your photographs and elements of your brief.

Cloudflare

Stores your photographs and finished video in a private bucket, reachable only through a signed, time-limited URL.

Railway

Hosts our database and the software that runs production jobs.

Vercel

Hosts our website and handles incoming web requests.

Stripe, Inc.

Processes your payment. Handles card data entirely — we never see it.

Resend

Delivers our emails to you. Receives your email address and the message contents.

PostHog

Product analytics. Receives usage events, not your photographs.

Google LLC

Provides sign-in for the self-serve creation tool only. Not involved in gift orders.

We do not share your personal data with anyone outside this list. We require every processor to maintain appropriate security measures, and we will disclose data to authorities only where legally compelled.

Your photographs

Kept while we make your video and for 30 days after delivery so changes remain possible, then deleted. Ask us and we will delete them sooner.

Your finished video

Available at your private link for 90 days after delivery, then deleted. Download it — your copy is yours permanently.

Your order record and correspondence

Kept for 2 years, so we can help if you come back or something goes wrong.

Payment records

Kept 7 years, as tax and accounting law requires.

Server logs

Maximum 90 days.

Analytics

Kept by PostHog for 12 months.

• In transit: HTTPS/TLS everywhere, including every request to the processors in Section 4.
• At rest: files live in private buckets that are not publicly reachable, accessible only through cryptographically signed, expiring URLs.
• File handling: uploads are validated by inspecting their actual bytes, renamed, and stripped of EXIF metadata including GPS coordinates.
• Secrets: API keys live in encrypted platform vaults, never in source control and never exposed to the browser.
• Sessions: HttpOnly, Secure, SameSite=Strict cookies with cryptographically random identifiers.

No security measure is perfect. If a breach affects your personal data we will notify you and the relevant supervisory authority as the law requires.

We use one strictly necessary session cookie, which carries no personal information and is required for the self-serve tool to work at all.

PostHog sets analytics cookies and uses localStorage to distinguish sessions. These are not strictly necessary; you can block them with your browser's cookie controls or by browsing privately.

We use no advertising, retargeting, or third-party tracking cookies.

You must be 18 to place an order. We do not knowingly collect personal data from children as customers.

Children do appear in photographs — a video of someone's first year is a common order. We treat those images exactly as described in Section 3, and our Terms require the customer to be the child's parent or guardian, or to have that person's permission. A parent or guardian who wants a child's photographs deleted should email us and we will do it immediately.

Wherever you live, you may ask us to:

• Show you what personal data we hold about you
• Delete it — though some records, such as payment history, must be kept by law
• Correct it if it is wrong
• Withdraw consent where our processing relies on it

9.1 EEA and UK

You additionally have the right to data portability, to object to processing based on legitimate interests, to have processing restricted while a complaint is reviewed, and to complain to your national supervisory authority — the ICO in the UK, or the authority listed at edpb.europa.eu in the EEA.

9.2 California

You have the right to know what we collect, to have it deleted, to correct it, and not to be treated differently for asking. We do not sell or share personal information as those terms are defined by the CCPA/CPRA.

9.3 How to ask

Email support@vivid-moments.video with "Privacy Request" in the subject line. We reply within 30 days, usually much sooner. This route is open to people in the photographs as much as to customers.

We operate from the United States, and the processors in Section 4 operate in the US and elsewhere. If you are outside the US, your data will be transferred there.

Where we transfer personal data out of the EEA or UK to a country without an adequacy decision, we rely on Standard Contractual Clauses or another lawful transfer mechanism.

We may update this policy. Material changes will be reflected in the "Last Updated" date above, and we will email you if a change materially affects an order you have placed.

Email: support@vivid-moments.video

A person reads it. If you are writing because you appear in a photograph someone else sent us, say so and we will prioritise it.