Privacy Policy

What this policy covers

This Privacy Policy explains what personal data ImgVid collects, why, and how it's handled when you use ImgVid, an AI image-to-video generator at imgvid.net.

ImgVid is operated by a company registered in England and Wales, and is the "controller" of your personal data. That means ImgVid decides what data is collected and why, and is responsible for looking after it under the UK GDPR and the Data Protection Act 2018.

Information ImgVid collects

Account information. When you sign in with Google, ImgVid receives your name and email address, and creates an account identifier for you.

Uploaded images. You upload photos to generate videos from. These images may show identifiable people, including you, friends, family, or pets. This is the most sensitive information ImgVid handles, and you are responsible for having the right to upload any image you submit — including the consent of any identifiable person shown in it.

Generated videos. ImgVid creates and stores the video output derived from your uploads.

Usage and technical data. Like most web services, ImgVid's servers log information such as your IP address, browser and device information, and pages you visit.

Billing records. ImgVid keeps a record of your purchases and credit balance. Full card numbers are handled directly by our payment processors and are not stored by ImgVid.

Why ImgVid processes your data

ImgVid processes your data on these legal bases:

To perform our contract with you — creating your account, generating videos from your uploads, and managing your credits and subscription.
For ImgVid's legitimate interests — keeping the service secure, preventing abuse, and understanding usage through server logs.
With your consent — for optional communications, such as a newsletter you choose to sign up for.

Your images are sent to AI model providers

To generate a video, your uploaded image (and any prompt you provide) is transmitted to third-party AI model providers, who perform the actual generation. This is a core part of how ImgVid works — ImgVid does not run these models itself. Only what's needed to generate your video is sent, and it is sent for that purpose only.

Who ImgVid shares data with

ImgVid uses the following categories of service providers to operate:

Cloudflare — for hosting, our database, file storage of your uploads and generated videos, and, in some cases, sending transactional email.
AI model providers — to generate video from your uploaded images, as described above.
Payment processors (such as Stripe or Creem) — to process your purchases. They receive your payment details directly; ImgVid does not store full card numbers.
Resend — to send transactional emails, such as account or billing notices. If you opt into a newsletter, Resend or Beehiiv may also be used to send it.
Google — to authenticate your sign-in.

ImgVid does not sell your personal data, and does not share your uploaded images or generated videos with advertisers or data brokers.

Sending data outside the UK

Some of these providers process data outside the UK, including in the United States. When personal data leaves the UK, ImgVid relies on one of the transfer mechanisms UK data protection law allows: either the country has been judged by the UK government to offer adequate protection, or the transfer is covered by the UK's International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses), together with checks appropriate to the transfer.

If you would like more detail about the safeguards used for a particular provider, contact us.

How long ImgVid keeps your data

ImgVid keeps your account, uploads, and generated videos for as long as your account is active and as needed to provide the service. Uploaded and generated assets are removed automatically once they are no longer needed for the service to function.

Reward fairness records. If you take part in the daily or invitation reward programme, we keep limited records needed to apply its eligibility and anti-abuse rules. These can include purpose-separated irreversible keyed hashes derived from your email address, network address, or a random browser identifier; the reward decision and reason; and anonymous invitation-graph nodes used to prevent invitation loops. We do not store the raw email address, network address, or device characteristics in these reward records. Most signals expire within 90 days. Short-lived invitee network and repeated-attempt signals expire after 24 hours. An inviter's random browser anchor remains while the invitation is active, because removing it earlier would disable the self-invitation check; it is removed after the invitation is completed, revoked, or detached and the 90-day retention window has passed.

Limited records that survive account deletion: up to 90 days. When you delete your account, we retain a purpose-separated irreversible hash of your email address to stop immediate re-registration for sign-up or invitation rewards. We may also retain purpose-separated network and random-browser-identifier hashes from prior reward decisions so deleting and recreating an account does not reset shared anti-abuse limits. These records contain no account ID, name, raw email address, raw network address, or device characteristics; they cannot be used to contact you, and they are automatically deleted when the 90-day period ends. The email hash used for deletion cooldown is cryptographically separated from the email hash used for invitation checks, so those two datasets cannot be joined by equality.

If you delete your account, ImgVid removes your stored data, including your uploaded images and generated videos, through an automated cleanup process. That process is designed to fail closed — if any required step does not complete successfully, your account is not marked as deleted. The limited, time-bound reward fairness records described above are deliberate exceptions. Reward eligibility rows that contain your account ID are deleted; financial ledger and lot records are retained only in anonymised form where required for balance integrity and audit.

Your rights

Under the UK GDPR you have the right to:

Access the personal data ImgVid holds about you, and get a copy of it.
Correct data that is wrong or incomplete.
Erase your data ("right to be forgotten") — you can do this yourself by deleting your account. One narrow exception applies: as described above, an irreversible hash of your email address is retained for up to 90 days to prevent immediate re-registration for rewards. ImgVid relies on its legitimate interest in preventing fraudulent claims for this; it expires automatically and cannot be used to identify or contact you.
Restrict or object to processing based on legitimate interests.
Port your data — receive it in a portable format, or have it sent to another provider.
Withdraw consent at any time, where processing is based on consent (such as a newsletter).

To exercise any of these rights, contact us. ImgVid will respond within one month. Using these rights is free, and ImgVid will not treat you differently for doing so.

Complaining to the ICO

If you think ImgVid has mishandled your personal data, please contact us first so it can be put right. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk or on 0303 123 1113. Complaining to ImgVid first is not a precondition — you can go to the ICO directly.

Children's privacy

ImgVid is not intended for anyone under 13. Under UK data protection law, 13 is the youngest age at which someone can consent to an online service on their own. Anyone under 18 should use ImgVid only with a parent or guardian's permission, and purchases must be made by an adult (see our Terms of Service). ImgVid does not knowingly collect personal data from children under 13 — if you believe a child has created an account or uploaded images, please contact us so it can be removed.