Privacy Policy
Last updated: October 27, 2026
This policy explains how AI Dunk collects, uses, discloses, and retains personal information when you visit aidunk.net, create an account, upload media, generate content, make a purchase, or contact us. AI Dunk is the service name. In this policy, “AI Dunk,” “we,” “us,” and “our” mean the legal operator that provides the service and acts as controller for the processing described here. Contact us at support@aidunk.net.
Information we collect
- Account and sign-in information: name, email address, profile image, Google account identifier, authentication method, account and session identifiers, and email verification records. Email verification codes are stored as hashes together with attempt counts and expiry information.
- Photos, settings, and generated media: photos you select or submit, play, scene, quality and other generation choices, prompts, task identifiers, generated videos and thumbnails, and technical metadata needed to process and retrieve them.
- Purchases and credits: package, amount, currency, PayPal order, capture and refund identifiers, payment status, credit ledger entries, checkout and generation immediate-performance requests, withdrawal acknowledgments, policy version, confirmation delivery status, and related fraud or dispute records. We do not receive your full payment-card number from PayPal.
- Device, security, and usage information: IP address, browser and device information, user agent, session records, page path, referrer, country code supplied by our hosting network, and service logs.
- Consent and attribution information: cookie and analytics choices, consent time and version, UTM parameters, first and last non-direct attribution, marketing-consent source and time, and unsubscribe or suppression status.
- Communications: support requests, email address, message content, and attachments you send us.
Photos and generated media
Before submission, a selected photo may be kept as a draft in your browser so it can survive sign-in. Selecting or saving a setup alone does not send the photo to a generation provider. When you expressly submit a pre-generation setup, the photo is uploaded through a time-limited URL to private object storage. When you expressly submit a generation, the necessary inputs are sent for processing.
If you upload a photo of another person, the photo is obtained from you rather than directly from the person shown. You must show that person this policy and obtain all permissions required for the AI-related use before uploading. A person shown in uploaded media may contact us to request information, restriction, or deletion.
How and why we use information
- To create and secure your account, authenticate you, save your choices, process requested generations, deliver results, manage purchases and credits, and provide support. We rely on performance of our contract with you or steps you request before entering a contract.
- To prevent abuse and fraud, manage sessions, diagnose failures, protect users and the service, and establish or defend legal claims. We rely on our legitimate interests in operating a safe and reliable service, except where those interests are overridden by your rights.
- To keep transaction records, respond to lawful requests, and meet accounting, tax, consumer-protection, and other legal duties. We rely on applicable legal obligations.
- To run optional analytics and send a reminder or other marketing email you requested. We rely on your consent, which you may withdraw at any time without affecting earlier lawful processing.
Service providers and international transfers
We use the providers below for specific parts of the service and seek to limit disclosures to information reasonably needed for each stated role. Where a provider acts as our processor, it processes information under our instructions and applicable agreements. Some providers may also process limited information as independent controllers under their own terms.
- Google: Google OAuth and One Tap sign-in; Google Analytics 4 for optional analytics when configured and consented to.
- Brevo: email verification and transactional email; reminder or marketing email only after the relevant consent.
- Neon: database hosting for account, session, consent, upload, generation, credit, and transaction records.
- Cloudflare: private R2 object storage and, when generation is active, the Runner, Container, and related network infrastructure used to coordinate generation and media processing.
- Vercel: website hosting and request processing; optional Vercel Analytics and Speed Insights when configured and consented to.
- Microsoft Clarity: optional usage analytics and interaction measurement when configured and consented to.
- Plausible: optional website analytics when configured and consented to.
- PayPal: checkout, payment capture, refunds, fraud prevention, and payment disputes when you make a purchase.
- KIE: the primary AI-generation provider when you submit a generation.
- APIMart: a backup AI-generation provider that may be used only when that fallback is enabled for the requested generation.
These providers may process information in the United States and other countries. Where applicable law restricts such a transfer, the transfer must be covered by a lawful mechanism appropriate to the provider and transfer, such as an adequacy decision, contractual safeguards, or another permitted basis. Contact us to ask which safeguard applies to a particular transfer. We may also disclose information when required by law, to protect rights and safety, or in connection with a corporate transaction subject to appropriate protections.
Publication and AI training
AI Dunk does not publish uploaded photos or generated media unless you separately authorize publication. Sharing a result yourself or granting publication permission does not make the underlying private uploads public.
AI Dunk does not use your photos or generated media to train or fine-tune its own models. Generation providers handle submitted inputs and outputs under their own service terms and retention practices; this policy does not promise that every provider applies the same training or retention rules.
Retention and deletion
| Data | Retention and removal |
|---|---|
| Browser drafts | Drafts older than 24 hours are treated as expired and removed when the site next checks them. They may remain on your device until that check occurs or you clear the site's browser storage. |
| Pre-submission setup records and uploads | Assigned an expiry 24 hours after creation. After expiry, an automated cleanup process attempts to delete the private-storage objects and database record. Expiry marks eligibility for cleanup; deletion may occur later if an attempt must be retried. |
| Email verification codes | Stored as a hash, expire after five minutes, and are removed after successful use or expiry validation. |
| Generation inputs | Our cleanup process attempts to remove submitted inputs and character references about 48 hours after a generation completes or fails. Provider copies are subject to the provider's retention process. |
| Generated videos and thumbnails | Kept in private storage for your account until you delete the generation or request deletion, subject to limited backup, security, and legal retention. |
| Other records | Account, session, security, consent, support, credit, payment, and contract-confirmation records are kept while needed to provide the service, respect your choices, prevent fraud, resolve disputes, enforce agreements, and meet accounting, tax, and other legal duties. They are then deleted or de-identified where appropriate. |
Deletion may be delayed where information is required for security, fraud prevention, a dispute, a legal obligation, or a valid legal claim. Email support@aidunk.net to request deletion or help with provider-held copies.
Cookies, analytics, sale, and sharing
Necessary cookies and browser storage support sign-in, security, locale, consent records, and saved setup behavior. The privacy-choice cookie lasts up to 180 days. If you allow analytics, the first-touch attribution cookie lasts up to 400 days and the last non-direct attribution cookie lasts up to 30 days.
Optional Google Analytics 4, Microsoft Clarity, Plausible, Vercel Analytics, and Vercel Speed Insights load only when configured and after you allow analytics. Google advertising storage, advertising user data, and ad personalization remain disabled. AI Dunk does not receive money in exchange for personal information or configure these tools for cross-context behavioral advertising. If applicable law treats a configured provider disclosure as a sale or sharing, you may opt out through the privacy settings or Global Privacy Control.
We treat a detected browser Global Privacy Control signal as an instruction to disable optional analytics. Withdrawing analytics consent prevents optional analytics from loading on future page views and removes analytics cookies that AI Dunk can remove from its own domain. It may not delete information already retained by an analytics provider; you may separately exercise applicable deletion rights.
Your choices and rights
Depending on applicable law, you may have the right to request access, correction, deletion, restriction, objection, or portability; withdraw consent; opt out of certain sale or sharing; and complain to a competent data-protection authority. You may unsubscribe from marketing email using the link in the message.
Submit a request to support@aidunk.net. We may request information reasonably necessary to verify your identity and authority, and will respond within the period required by applicable law. We will not discriminate against you for exercising an applicable privacy right.
Children and photo permissions
The service is not for children under 13. Users aged 13–17 need parent or guardian permission. Everyone shown must be at least 13. If someone shown is aged 13–17, you must have that person's permission and permission from their parent or guardian. Contact us if you believe we have received information in violation of these rules.
Security
We use measures designed to protect information, including access controls, private object storage, time-limited upload URLs, transport encryption, and restricted server-side credentials. No online service can guarantee absolute security.
Changes
We may update this policy as the service or applicable requirements change. We will update the date above and provide any additional notice required by law.
Contact
For privacy questions, rights requests, or deletion requests, email support@aidunk.net.
