Privacy Policy

1. Information We Collect

1.1 Information You Provide Directly

When you create an account or use our services, we collect:

1.2 Content You Upload

• Photos/Images: Images you upload to create videos
• Audio Files: Music or audio files you use in your videos
• Created Videos: Final videos generated by our service

Important: Your uploaded content and created videos remain your property. We do not claim ownership or use them for any purpose other than providing our service to you.

1.3 Automatically Collected Information

• Usage Data: Features you use, videos created, subscription status
• Device Information: Browser type, operating system, device type
• IP Address: For security, fraud prevention, and rate limiting
• Cookies & Session Data: To keep you logged in and remember preferences
• Security Logs: Login attempts, failed authentication, account lockouts

2. How We Use Your Information

We use your information for the following purposes:

2.1 Service Delivery

• Creating and managing your account
• Processing your video creation requests
• Storing your uploaded content and created videos
• Managing your subscription and billing
• Sending service-related notifications (e.g., "Your video is ready")

2.2 Security & Fraud Prevention

• Authenticating your identity
• Detecting and preventing unauthorized access
• Implementing rate limiting and account lockouts
• Monitoring for suspicious activity
• Maintaining security logs for incident response

2.3 Service Improvement

• Analyzing usage patterns to improve features
• Troubleshooting technical issues
• Understanding which features are most popular
• Optimizing video processing performance

2.4 Legal Compliance

• Complying with applicable laws and regulations
• Responding to legal requests (subpoenas, court orders)
• Enforcing our Terms of Use
• Protecting our rights and property

3. How We Share Your Information

We respect your privacy and limit data sharing to essential service providers:

3.1 Service Providers

• Payment Processing: Stripe (for subscription payments) - Stripe Privacy Policy
• Cloud Hosting: Microsoft Azure (for application hosting and storage) - Azure Privacy
• Email Services: SMTP providers (for account notifications)

These providers are bound by strict confidentiality agreements and may only use your data to provide services to us.

3.2 We DO NOT Share Your Information With:

• ❌ Advertisers or marketing companies
• ❌ Data brokers or aggregators
• ❌ Social media platforms (unless you explicitly connect them)
• ❌ Third parties for their own marketing purposes

3.3 Legal Requirements

We may disclose your information if required by law, court order, or government request, or to protect our legal rights, prevent fraud, or ensure user safety.

4. Data Storage and Security

4.1 Where Your Data is Stored

• Location: Microsoft Azure data centers (United States - East US 2 region)
• Storage Type: Secure cloud storage with encryption at rest
• Backup: Regular automated backups for data protection

4.2 Security Measures

We implement industry-standard security practices to protect your data:

• Encryption: HTTPS/TLS encryption for all data in transit
• Password Security: Bcrypt hashing with salts (passwords are never stored in plain text)
• Authentication: Secure session management with HTTP-only cookies
• Rate Limiting: 5 login attempts per minute to prevent brute-force attacks
• Account Lockout: Automatic 15-minute lockout after 5 failed login attempts
• Security Headers: Content Security Policy, X-Frame-Options, X-Content-Type-Options
• Input Validation: Sanitization of all user inputs to prevent injection attacks
• Access Controls: Strict file permissions and isolated user data storage

5. Data Retention

We retain your information for as long as necessary to provide our services and comply with legal obligations:

After Account Deletion: Your personal data will be permanently deleted within 30 days, except for information we must retain for legal or regulatory compliance (e.g., payment records for tax purposes).

6. Your Privacy Rights

You have the following rights regarding your personal information:

6.1 Rights Under GDPR (European Users)

• Right to Access: Request a copy of all personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data
• Right to Restriction: Request limitation of how we process your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing of your personal data
• Right to Withdraw Consent: Withdraw consent at any time (without affecting prior processing)
• Right to Lodge a Complaint: File a complaint with your local data protection authority

6.2 Rights Under CCPA (California Users)

• Right to Know: What personal information we collect, use, and share
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Opt-out of the sale of personal information (we do not sell your data)
• Right to Non-Discrimination: Equal service regardless of privacy rights exercise

6.3 How to Exercise Your Rights

7. Cookies and Tracking Technologies

7.1 Cookies We Use

We use cookies and similar technologies to enhance your experience:

7.2 Third-Party Cookies

• Stripe: Payment processing (strictly necessary)

7.3 Managing Cookies

You can control cookies through your browser settings. Note that disabling cookies may affect functionality (e.g., staying logged in).

8. Children's Privacy

Our service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at privacy@happyvideocreation.com, and we will delete the information within 48 hours.

9. International Data Transfers

Our servers are located in the United States (Microsoft Azure - East US 2 region). If you are accessing our service from outside the United States, your information will be transferred to, stored, and processed in the United States.

For European Users: We comply with GDPR requirements for international data transfers. Microsoft Azure (our hosting provider) is certified under the EU-U.S. Data Privacy Framework and provides appropriate safeguards for your data.

10. Third-Party Links

Our service may contain links to third-party websites or services (e.g., payment providers). We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies before providing any information.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make significant changes, we will:

• Update the "Last Updated" date at the top of this policy
• Notify you via email (if you have an account)
• Display a prominent notice on our website
• Require you to accept the new policy on your next login (for material changes)

Your continued use of our service after changes are posted constitutes acceptance of the updated Privacy Policy.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

13. Your California Privacy Rights (Shine the Light Law)

California residents may request information about our disclosure of personal information to third parties for their direct marketing purposes. However, we do not share your personal information with third parties for their direct marketing purposes.