Privacy Policy

Who we are

Tiny Desk AI (tinydeskai.ink) is operated by Novalia, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, USA ("we", "us"). Novalia, LLC is the controller of the personal data described here. Questions about this policy: support@tinydeskai.ink.

What we collect

1. Account details. Your name, email address and sign-in information (a securely hashed password if you sign up with email, or your Google sign-in), plus your profile picture if Google provides one.
2. The photos you upload. The one to five photos you upload, one for each band spot you choose to swap (left, center or right singer, lead singer, saxophone). Your browser makes them smaller before sending them. So you don't have to pick them again after signing in or checkout, your browser keeps the photos you picked on your own device for up to an hour, only for the account that picked them, and deletes them when you sign out; this copy is never sent to us. We receive the photos when you start a video.
3. Photos of other people. A photo may show someone other than you. We receive it from you, not from that person, so you must have their agreement (see "Your photos and consent" in the Terms of Service).
4. What we make from them. AI-made still frames that start your video, and the finished video, without sound.
5. Orders and payments. Which pack you bought, when, and the amount. Card details go straight to Stripe; we never see or store your card number.
6. Technical data. IP address, browser type and request logs, used to keep the service secure, stop abuse and fix errors.
7. Usage data, only if you accept cookies. Which pages you visit, which steps of making a video you reach (for example "photo selected" or "checkout started"), clicks and scrolling, and device type. Session recordings in Microsoft Clarity hide text you type and the photos and videos on the page. We never send your photos, videos, email or name to these tools.
8. Messages you send us. Support requests and anything you attach.

Why we use it (legal bases)

• To provide the service you asked for (contract): your account, your orders and payments, making and delivering your videos, answering your messages.
• To keep the service safe and working (legitimate interests): security, preventing abuse and fraud, and fixing errors.
• Photos of other people (legitimate interests): you and the person in the photo want the video made, and they agreed to it. That person can object at any time by emailing us, and we will delete the copies we hold.
• To meet legal duties (legal obligation): for example tax and accounting records, and answering lawful requests.
• To count visits without cookies (legitimate interests): Plausible Analytics counts page views, where visitors come from and how many reach each step of making a video (for example "photo selected" or "checkout started"), without cookies and without storing your IP address. The numbers are anonymous and only shown to us in total.
• To understand how the site is used (your consent): Google Analytics and Microsoft Clarity, only after you click "Accept All" in the cookie banner. You can withdraw consent at any time under Cookie settings in the footer.

How we use your photos

Your photos are used only to make your video. We do not show them publicly, sell them, or use them to train AI models. Every person who appears in a photo must have agreed to this, and photos of children or public figures are not allowed.

Before a photo is used, it is checked automatically for nudity, violence and hate symbols, for a single clear face, and for an estimate of whether that person is an adult. A photo that does not pass is not stored and no credits are used. We only count, anonymously, how many photos did not pass and the general reason (for example "age"); we do not keep any face measurements or scores. We do not use face recognition to identify who is in a photo.

Who processes your data

We use a small number of service providers, each only for the job below:

• Cloudflare: hosting, database and private file storage. Receives everything the service stores.
• Kie.ai and the AI model providers it routes to (OpenAI GPT Image for the first frames and ByteDance Seedance for the video): generate the still frames and the video. Receive your photos and the generated frames through short-lived private links. Kie.ai states that it keeps media files for 14 days and logs for 2 months.
• Amazon Web Services (Amazon Rekognition, United States): checks each photo before it is used, as described above. Receives the photo only for this check and returns the result; the photo is not stored there, and our AWS account is set so that AWS does not use it to improve its services.
• Stripe and Link, LLC (part of Stripe): run checkout and payments. Link sells your purchase as the merchant of record and collects transaction data (such as your payment details, billing country and email) for payments, tax and fraud prevention under Stripe's privacy policy.
• Google: sign-in with Google.
• Resend: sends account emails such as sign-up confirmation and password reset. Receives your email address.
• Plausible Analytics (Plausible Insights OÜ, EU): anonymous visit and step counts on every page. Receives the page address, the referring site, browser, device type, country and the name of the step reached (never your photos, email or name); your IP address is only used to make a daily-changing anonymous count and is not stored. Sets no cookies.
• Google Analytics (Google) and Microsoft Clarity (Microsoft): only if you accept cookies. Receive the usage data described above, your IP address and device information, and set their own cookies.

TikTok: only if you click to watch the original meme clip, your browser loads it from TikTok, which then receives normal technical data and may set its own cookies under TikTok's privacy policy. Nothing loads from TikTok until you click.

These providers process data under their own terms and privacy policies. Several of them, and we, are in the United States, so your data is transferred to and processed in the US and possibly other countries, which may not have the same data protection laws as yours.

How long we keep it

• Photos and still frames: we delete our copies as soon as your video is finished or has failed, or when an order is refused before it starts. Anything left behind is deleted automatically by our storage within 14 days.
• Videos: kept for 30 days in My videos so you can download them, then deleted automatically.
• Account and order records: kept while your account exists, and deleted when you delete your account. Stripe keeps its own payment records as the law requires.
• Technical logs: kept only for a short time by our hosting provider.

Cookies

We always use the cookies needed to keep you signed in and remember your settings, including your cookie choice. Plausible Analytics, which we use to count visits, sets no cookies.

If you click "Accept All" in the cookie banner, we also load Google Analytics and Microsoft Clarity, which set their own cookies to measure visits and how the site is used. If you click "Reject All" or ignore the banner, they are not loaded at all. You can change your choice at any time under Cookie settings in the footer. We do not use advertising cookies.

Your rights

You can ask us to see, correct, export or delete your personal data, or delete your account, by emailing support@tinydeskai.ink from the address on your account. Depending on where you live (for example under the GDPR in the EU and UK, or the CCPA in California) you may also object to or ask us to restrict some processing, and you may complain to your local data protection authority. We do not sell your personal information or share it for advertising.

If you appear in a video someone else made without your permission, email us. After checking the report we will delete the copies we hold; we cannot remove copies someone has already downloaded.

Children

Tiny Desk AI is for people aged 18 and over. Photos of children must not be uploaded.

Changes

If we change this policy, we will update the date above. For significant changes we will notify you by email or on the site.