Darts Bullseye

Privacy Policy

Last updated 2 November 2026. Version 2026-11-02.2. Draft, not yet reviewed by a lawyer.

Demo status: this site is running in demo mode. Video generation is simulated, no card is charged, and uploaded photos are not sent to any AI provider yet. This policy also describes what will happen once live generation is switched on, and says so where it differs.

Who we are

Operator and data controller: zeng, an individual based in China. The operator may access the data described here from China. Contact: zyj555358zyj@gmail.com. Website: https://darts-bullseye.pages.dev.

What we process, why, and our lawful basis (UK GDPR)

  • Your uploaded photo, to make your clip. Basis: performance of a contract (Art. 6(1)(b)). For a photo of a person, your explicit consent (Art. 9(2)(a)) given by ticking the biometric consent box.
  • Your payment email, which we receive from our payment provider (or from the form, if you type it), to send your download link and to tie your credits to you. We keep it on your order for 30 days. With your credit balance we keep only a salted hash of it, for as long as you have credits, so you can restore them on a new device. If you ask to restore credits, we email a one-time link that expires after 15 minutes. Basis: contract.
  • A consent record: time, a salted SHA-256 hash of your IP address (not the IP itself), the terms version you accepted, whether you gave biometric consent, and a random session id. Basis: legal obligation and legitimate interests (proving consent). Kept for 3 years.
  • Abuse prevention: a salted hash of your IP address and of a random device id stored in your browser's local storage (key db_dev), used for rate limiting and to allow one free preview per person. Basis: legitimate interests (preventing abuse and fraud). Rate-limit counters expire after minutes; free-preview markers after 12 months.
  • Bot check: the upload form loads Cloudflare Turnstile, which processes your IP address and browser signals on Cloudflare's servers. Basis: legitimate interests. In demo mode Turnstile runs with Cloudflare's test key, so it does not block bots yet.
  • Usage statistics (see Cookies below). Basis: legitimate interests.

Biometric notice (Illinois BIPA, Texas CUBI and similar laws)

A photo of your face can contain biometric identifiers (face geometry). We process it only for two purposes: an automated safety check of the upload, and generating the clip you asked for. We do not use it to identify you, we do not build face templates or a face database, and we do not use it to train models.

Retention: the uploaded photo, and anything derived from it, is permanently deleted within 7 days of upload. We never sell, lease, trade or otherwise profit from biometric data, and we only disclose it to the processors listed below to do the job you asked for. We collect it only after you give written consent by ticking the separate biometric consent box; the upload is rejected by our server without it.

Safety checks

Before generation, each photo goes through an automated vision check. For people, it rejects photos that seem to show a minor, nudity, a public figure, or more than one face. For pets, it requires an animal and rejects photos with people or nudity. We cannot truly verify that a photo shows you; we rely on your confirmation plus these checks. In demo mode the check is simulated and lets every photo through.

Processors and international transfers

  • Cloudflare (hosting, storage, bot check), global network.
  • fal.ai (United States): once live generation is on, your photo is sent to fal for the safety check, background removal (to make your free preview image) and video generation. This is a transfer outside the UK/EU; we will rely on the UK International Data Transfer Addendum, EU Standard Contractual Clauses or the UK-US Data Bridge, as applicable. In demo mode no photo is sent to fal.

Applicable law

This policy is governed by the laws of the People's Republic of China (see the Terms). This does not take away any right you have under the mandatory privacy and consumer laws where you live, including the UK GDPR, the EU GDPR and the CCPA/CPRA.

Retention

Uploaded photos, and the preview image made from them, are deleted within 7 days. Generated videos are deleted within 30 days. Download links expire 24 hours after they are issued. Your payment email is kept on the order for 30 days; a salted hash of it is kept with your credit balance for as long as you have credits, so you can restore them. Deletion is enforced by automatic expiry on our storage, plus a daily cleanup job.

Cookies and analytics

We use no tracking cookies and no advertising pixels. We collect anonymous order-funnel events (photo uploaded, preview viewed, pricing viewed, pack chosen, purchase completed) tagged with a random per-visit session id kept in your browser's session storage, plus the traffic source (UTM tags or referring site). These events contain no email, IP address, browser fingerprint or photo. Your browser's local storage also holds the random device id described above. We do not currently use any third-party web analytics; if we add one we will list it here first.

Your rights

UK users: you can ask for access, correction, deletion, restriction, portability, or object to processing, and you can withdraw consent at any time (this stops future processing). You can complain to the Information Commissioner's Office (ICO), ico.org.uk, 0303 123 1113. We would appreciate the chance to help first.

California users (CCPA/CPRA): you have the right to know what personal information we collect and how we use it, to delete it, to correct it, to opt out of its sale or sharing, and to limit use of sensitive personal information. We do not sell or share personal information for cross-context behavioural advertising, and we use sensitive data (your face photo) only to provide the service. We will not discriminate against you for using these rights.

To use any right, email zyj555358zyj@gmail.com. We reply within one month (UK) or 45 days (California).

Children

The service is for adults 18+. We do not knowingly process photos of children.

Changes

We will change the "Last updated" date and version above, and ask you to accept new terms before your next upload.