Privacy Policy

Last updated: 2026/10/24

The personal data Rap AI collects, why we need it and how we handle it — including the photos you upload and the AI providers that turn them into videos

Effective date: 2026-10-24.

Scope of this policy

This Privacy Policy describes the personal data Rap AI collects when you use https://rapaivideogenerator.com, what we use it for and how we look after it. Rap AI lets you upload photos and turn them into short rap and song meme videos.

Rap AI ("we", "us") is the "controller" of your personal data. In plain terms, we decide what data is collected and why, and we are responsible for protecting it.

The data we collect

Your account. You sign in with Google. Google shares your name and email address with us, and we create an account ID for you.

Photos you upload. Each template asks for one or two photos. They often show real people, such as you, your friends, your partner or your family, and sometimes pets. This is the most sensitive data we handle. You must have the right to upload every photo you use, including the consent of each identifiable person in it.

Text you add. Some templates let you add a short note. We store it with the request and pass it to the model as part of that generation.

Videos we make for you. We create and store the videos generated from your photos and the template you chose.

Your asset library. Photos you upload are also kept in a private library so you can reuse them later. Only you can see it.

Content you decide to make public. If we offer public sharing and you use it, we store what you shared and the outcome of our review (see "Public sharing" below).

Usage and technical data. Like most websites, our servers log details such as your IP address, browser and device type, and the pages you open.

Billing records. We keep a record of your purchases, renewals, cancellations, refunds and disputes, along with your credit balance and how you spent it. We need these to apply the 7-day refund rule, which looks at the date of each payment and the credits used since. Stripe handles full card numbers; we never store them.

Emails you send us. If you write to support, for example with the subject "Refund Request", we keep your address, your message and any attachments, such as an invoice number or details of a generation. We use them to reply, to check your request against your account and to record what we decided.

Why we use your data

Our legal bases are:

Our contract with you. We need your data to create your account, turn your photos into videos, manage your credits and plan, and deal with cancellations, refund requests and support emails.
Our legitimate interests. We keep the service secure, stop abuse and understand how it is used through server logs and, if enabled, analytics.
Your consent. Where we rely on consent, such as for anything you choose to make public or optional updates you sign up for, you can withdraw it at any time as described below.

AI providers that generate your videos

To make a video, we send your photos, any text you added and the template's reference material to a third-party AI model provider. Today that is KIE, and every current template runs on its MiniMax model. The provider does the actual generation; we do not run these models ourselves. We only send what the chosen template needs. Safety checks are covered in the next section.

Content safety checks and reports

What we check and why

We check your photos, any text you add and the finished videos against our content rules. To do this we send the material that is needed to outside content safety services, which helps us prevent abuse and keep to our Terms. A request that fails is stopped before generation, and a result that fails is not delivered. If a check cannot finish, the request or result is not treated as approved. These checks never make your private content public.

Our content rules

We do not allow adult pornography, sexual content involving minors, intimate content made without consent, graphic violence, hate or harassment, help with self-harm, fraud or other malicious use. Our Terms of Service set out the full rules and their context. Safety checks can get things wrong and cannot catch every breach.

Records and provider processing

For safety, reliability, abuse prevention and legal duties, we keep limited records: safety decisions, provider request IDs, content fingerprints, timing and usage. A fingerprint is not a copy of your photo or text. Deleting a file or your account does not instantly erase every safety record we need or reset abuse limits.

Safety providers handle and keep submitted material under their own data terms. Where they support it, we ask them to delete temporary copies and chase any deletion they have not confirmed. Deleting your own file does not by itself remove a provider's copy, and we cannot promise that every provider copy or log is deleted at once.

Reports, reviews and your rights

You can report content you think breaks our rules, or ask us to look again at a safety decision you think is wrong. We use what you send us to look into it and reply. Contact us to make a report, ask for a review, ask about this processing or use your data rights.

We rely on these providers to run Rap AI:

Cloudflare — hosting, our database, storage for your uploads, asset library and generated videos, and sending service emails.
KIE and the AI models it provides — generating videos from your photos and the selected template.
Content safety providers — SeeAPI and Google check the photos, text and results that are needed, as described above.
Stripe — processing payments. Stripe collects your payment details directly, and we do not keep full card numbers.
Google — signing you in, and content safety checks as noted above.
Analytics providers, if enabled — if we switch on Google Analytics or Microsoft Clarity, they process usage data on our behalf. Our Cookie Policy explains this and how to turn it off.

We do not sell your personal data, and we never share your photos or videos with advertisers or data brokers.

Your videos are private by default. If we offer a public sharing option, a video only becomes public when you choose to share it.

We review every shared video before it appears. We may turn down any video, for example one that shows someone who may not have agreed, a minor, or explicit content.
What others can see: the video itself, plus any nickname or details you chose to show. Your name, email address and account details stay hidden.
Public means anyone can watch and save it. While a video is shared, any visitor can view it, and their browser or other tools can keep a copy.
Taking it down: you can withdraw a shared video at any time, and we remove it straight away. Copies cached by browsers or our delivery network can take up to 5 minutes to clear. We cannot recall copies that visitors saved while it was public.
How long it stays: we keep a shared video as its own public copy, outside the automatic clean-up of generated videos described below. It stays until you take it down, we decline or remove it, or your account is deleted.

Transfers to other countries

Some of our providers process data in other countries, including the United States. When personal data moves across borders, we rely on the safeguards that applicable data protection law allows, such as standard contractual clauses, with checks suited to the transfer.

How long we keep your data

We keep your account, uploads and videos while your account is active and for as long as we need them to run the service. Uploads and generated videos are removed automatically once the service no longer needs them.

Asset library. A photo in your library is deleted 90 days after you last used it, when you delete it yourself, or when your library goes past 200 photos, in which case the one you used least recently goes first.

Generated outputs. Your generated videos, their preview images, and the text and settings saved with each request (including requests that did not finish) are deleted automatically 60 days after the request ends. Download anything you want to keep before then. Videos you shared publicly are kept separately, as described above.

Payment, refund and support records. We keep records of payments, refunds and disputes, and the support emails linked to them, for as long as we need them to manage your account, respond to disputes and meet accounting and tax duties.

Reward fairness records. If we run a referral or reward programme and you take part, we keep limited records to apply its eligibility and anti-abuse rules. These may include purpose-separated irreversible keyed hashes made from your email address, your network address or a random browser identifier; the reward decision and the reason for it; and anonymous nodes in an invitation graph that stop invitation loops. These records never hold your raw email address, raw network address or device characteristics. Most of these signals expire within 90 days, and short-lived invitee network and repeat-attempt signals expire after 24 hours. One exception: an inviter's random browser anchor remains while the invitation is active, because deleting it sooner would break the check against inviting yourself. It is removed once the invitation is completed, revoked or detached and the 90-day window has passed.

What survives account deletion, for up to 90 days. When you delete your account, we keep a purpose-separated irreversible hash of your email address so the same address cannot sign up again straight away just to collect reward credits, plus any de-identified invitation-graph node needed to stop reward loops. Sign-up eligibility records and their network or random-browser-identifier hashes are deleted with the account, at the same time as everything else. What we keep contains no account ID, name, raw email address, raw network address or device characteristics. It cannot be used to contact you, and it is deleted automatically when the 90 days end. The email hash used for this cooldown is cryptographically separated from the email hash used for invitation checks, so the two sets of data cannot be matched against each other.

When you delete your account, an automated clean-up removes your stored data, including uploads, your asset library, generated videos and anything you shared publicly. The process fails closed: if any required step does not finish, your account is not marked as deleted. The short-lived reward fairness records above are a deliberate exception. Necessary safety records and copies held by providers follow the limits set out under Content safety checks and reports. Reward eligibility rows that include your account ID are deleted, and financial ledger and lot records are kept only in anonymised form where we need them for balance integrity and audit.

Your rights

Depending on where you live, you can:

Access the personal data we hold about you and get a copy.
Correct data that is wrong or incomplete.
Erase your data, often called the "right to be forgotten". You can do this yourself by deleting your account. The retention limits and exceptions above still apply, including those under Content safety checks and reports. As explained above, an irreversible hash of your email address may be kept for up to 90 days to stop instant re-registration for rewards. We rely on our legitimate interest in preventing fraudulent claims for this; the hash expires on its own and cannot be used to identify or contact you.
Restrict or object to processing that is based on our legitimate interests.
Port your data, meaning get it in a portable format or have it sent to another provider.
Withdraw consent at any time where we rely on consent.

To use any of these rights, contact us. We will reply within one month. It costs nothing, and we will not treat you any differently for asking.

Complaints

If you think we have mishandled your personal data, please contact us first so we can try to fix it. Depending on where you live, you may also have the right to complain to your local data protection authority.

Children

Rap AI is not meant for anyone under 13. Anyone under 18 should use Rap AI only with a parent or guardian's permission, and an adult must make any purchase (see our Terms of Service). We do not knowingly collect personal data from children under 13. If you think a child has made an account or uploaded photos, please contact us and we will remove it.