Privacy Policy

1. Who is responsible

The data controller is Cendro Labs Pty Ltd (ABN 84 697 743 598), an Australian company based in Melbourne, Australia. Contact for privacy questions and requests: support@bopframe.com.

We handle personal information in line with the Australian Privacy Act 1988 and the Australian Privacy Principles, and with the privacy laws of the other places where we offer the Service.

PayPal processes our payments. It is a separate, independent controller of the payment, account and fraud-prevention data it collects when you pay, and its own privacy statement applies to that data.

2. Data we collect

You give us

• Account data: email address, name and profile picture from Google, which is how you sign in. If you use the Service as a guest, we create a temporary profile without any of these.
• Photos: the photos you upload, which show you or other people.
• Your other inputs: template and occasion choices, topics, names or lyrics you type, and the lyrics, audio and videos generated for you.
• Communications: emails, support requests, reports and feedback.

From PayPal

• Your name, email, country, PayPal payer and subscription IDs, the pack or plan purchased, amount, currency, transaction ID, and payment, refund and dispute status.
• We never receive or store your full card number, card security code or PayPal password.

Collected automatically

• Technical data: IP address, browser, device type, operating system and time zone.
• Usage data: pages and features used, generation requests, credit usage, errors and performance logs.
• Safety data: results of automated moderation of photos and text, and records of reports and enforcement decisions.

3. Photos, faces and biometric information

To animate a photo, the AI video model analyzes the face in it, for example where the eyes and mouth are, so it can move them in time with the vocals. This analysis happens only while your video is being made, only for that purpose, and only on photos you chose to upload.

• We do not create or keep face templates, faceprints or other identifiers that could recognize a person, and we do not use photos to identify anyone, match faces across uploads or build profiles.
• Automated moderation checks photos for prohibited content, such as nudity. It does not identify who is in the photo.
• We never sell, lease or trade photos or any information derived from faces, and we do not use them to train AI models.
• Photos are shared only with the AI model providers that generate your video, under contracts that prohibit them from using the photos for any other purpose.

Retention and deletion

• Uploaded photos are permanently deleted 30 days after upload, whether or not you made a video with them, or earlier if you delete them.
• Videos are kept until you delete them or your account.
• Photos blocked by moderation are not saved. We keep only the moderation result (the categories and scores, not the photo), at most 12 months.

Anyone shown in a Bopframe video, including people who are not our users, can ask us to delete it by writing to support@bopframe.com.

If you upload a photo of another person, you confirm that you have their permission and that you have told them how their photo will be used, as required by our Terms.

4. How we use it

We do not make decisions about you that have legal or similarly significant effects based solely on automated processing.

5. Cookies

We use only strictly necessary cookies and similar storage, for example to keep you signed in, to keep your guest uploads and to protect forms against abuse. We do not use advertising cookies. If we add analytics or marketing cookies, we will update this policy first and ask for your consent where the law requires it.

6. Who we share it with

We share personal data only with service providers that help us run the Service, under contracts that limit their use of it to providing their service to us:

• Cloudflare: hosting, content delivery, storage and security.
• AI model providers: your photos, topic and lyrics are sent to the providers of the models listed in our Terms, only to generate your video.
• OpenAI: to check photos and text against our content rules. Photos are sent as a reduced copy and are not used to train OpenAI’s models.
• Google: to sign you in. Google tells us your email address, name and profile picture; we don’t get your Google password.
• PayPal: payment processing, refunds and fraud prevention, as described in Section 1.
• Email delivery providers: to send receipts and support emails.

We may also disclose data when required by law or a valid legal request, to report child sexual abuse material or other serious harm to the competent authorities, to protect the rights and safety of users and the public, or as part of a merger or acquisition (with notice to you). We do not sell or share your personal data for cross-context behavioral advertising, as those terms are defined under the CCPA.

7. How we protect it

• All traffic to the Service, including checkout, is encrypted with TLS (HTTPS).
• Photos and videos are stored in private storage. They are not publicly listed, and the links we give you to view them expire.
• Payment details are entered directly on PayPal’s PCI-DSS compliant pages and never pass through our servers.
• Access to production data is limited to people who need it to run the Service.

If a data breach is likely to affect your rights, we will notify you and the relevant authorities as required by law, generally within 72 hours of becoming aware of it.

8. How long we keep other data

9. Your rights

Depending on where you live (including under the Australian Privacy Act, the GDPR, UK GDPR, California law and state biometric privacy laws), you can ask us to:

• tell you what personal data we hold and give you a copy;
• correct inaccurate data;
• delete your photos, videos, data and account;
• give you your data in a portable, machine-readable format;
• restrict or object to processing based on legitimate interests;
• stop marketing emails, or withdraw any consent you gave.

Email support@bopframe.com from your account email. We respond within 30 days and will not treat you differently for exercising your rights. If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or to your local data protection authority.

10. International transfers

We are based in Australia, and we and our providers process data in several countries, including the United States, through Cloudflare’s global network. Before we disclose personal information overseas, we take reasonable steps to make sure the recipient protects it as the Australian Privacy Principles require. Where we transfer personal data out of the EU, the UK or Switzerland, we rely on safeguards such as the European Commission’s Standard Contractual Clauses in our providers’ data processing agreements.

11. Children

Accounts are for adults aged 18 and over, and we do not knowingly collect personal data from children. Parents and family members may upload photos of their own children for family-friendly videos, as our Acceptable Use Policy allows; those photos are used only to make the video and are deleted on the schedule above. If you believe a photo or video of a child is on the Service without a parent’s agreement, contact us and we will delete it.

12. Changes

We will update the date at the top of this page when this policy changes, and email account holders at least 14 days before any material change takes effect.

13. Contact

Privacy requests and questions: support@bopframe.com. Operator: Cendro Labs Pty Ltd (ABN 84 697 743 598), an Australian company based in Melbourne, Australia.