Data controller
SyncAgency LLC, 1209 Mountain Rd Pl NE Ste H, Albuquerque, NM 87110, United States, a company registered in New Mexico under number 0008090888. Contact: contact@xelvid.com.
Data processed
- Account: your email, your language, when you were last active, and a hash of your password. The password itself is never stored.
- Purchases: the pack, its price, the date and your waiver of the withdrawal period. Stripe handles your card, and its details never reach us.
- Creations: the photos and videos you upload, the results, your edit instructions, your characters and your history. We store them on our servers, tied to your account.
- Age check: each blocked file is kept aside, never shown, as a security alert, with the date, the reason, your account ID, your IP address and the browser in use. Your account also keeps the number of warnings and their dates.
- Help: the messages you write to us, with the page you were on, your browser and your language at that moment. An automated assistant may draft a reply using these messages and your account details (balance, generations, purchases).
- Reports: the reason chosen, your description or link, your email if you give it, plus the IP address and browser of your connection.
- Technical data: the IP address and browser in use, to protect the service and slow down abusive attempts.
Why we process data, and on what legal basis
- To perform the contract (Article 6(1)(b) GDPR): opening and running your account, selling packs and adding their credits, carrying out your generations and edits, replying when you ask for help, and emailing you about your account and purchases.
- To meet our legal duties (Article 6(1)(c)): keeping accounting proof of purchases, and alerting the authorities to suspected child sexual abuse material.
- For our legitimate interest (Article 6(1)(f)): protecting the service (age check, attempt limits, fighting fraud and payment abuse) and handling reports.
Who receives your data
The Xelvid team and our processors can access your data, each only for what their job needs. We never sell it.
- Cloudflare: hosts the site, the database and the files, and takes stills from videos for the age check.
- Stripe: processes payments.
- kie.ai: generates the videos and edits the photos.
- Resend: delivers emails.
- Google: lets you sign in with your Google account, if you pick that option.
- Anthropic: checks apparent age on images and powers the help assistant.
Data sent outside the EU
Some of our processors work on data outside the European Union, mainly in the United States. Depending on what each one offers, these transfers rely on standard contractual clauses adopted by the European Commission, or on the Data Privacy Framework agreed between the EU and the US.
How long we keep data
- Account: kept for as long as you keep it. When you delete it, we erase your email, password, creations and help messages right away, then the files on our servers within 30 days at most. Only the accounting records and the security alerts below remain.
- At kie.ai, our generation provider: it deletes uploaded files on its own after 24 h, and results after 14 days.
- Files you send (photos and videos): deleted from our servers 30 days after the generation or edit ends. The photo of a character you save stays with it.
- Results and characters: kept while your account exists.
- Purchases: kept for 10 years, the legal period for accounting records, but without your email.
- Security alerts and reports received through the form: kept for 1 year, then deleted once reviewed, even if the account was deleted.
- Connection data (IP address, browser): 1 year.
- Help requests: deleted 1 year after they are closed.
Protection of minors
Xelvid is for adults only and blocks any image that seems to show a minor. If we suspect child sexual abuse material, we suspend or close the account, and we may pass the alert to PHAROS (France) and NCMEC (United States), as the law requires.
Your rights
Write to contact@xelvid.com to see, correct, erase or take a copy of your data, to restrict how it is processed, or to object to processing that relies on our legitimate interest.
Deleting your account is also something you can do yourself, from your settings. If it is suspended or under review, write to us instead.
If you feel your rights are not respected, you can complain to the CNIL (cnil.fr) or to your country's data protection authority.
Security
Traffic with the site is encrypted (HTTPS), passwords are stored as hashes and access to data is limited to the people who need it.