Privacy Policy
What TocToc AI collects when you make a toc toc dance video, why, who processes it and how long it is kept.
Last updated
This policy explains how TocToc AI ("we", "us"), operator of toctocai.org, handles personal data. The short version: we use your photo to make your video, we keep your photo and videos so you can find them in History until you delete your account, and we never sell your data or use your face to train AI models.
The data we handle
| What | Examples | Why we need it |
|---|---|---|
| Account data | Name, email, password hash or Google account ID, profile picture | Sign-in, account security, service emails |
| Your photo | The person or pet photo you upload | To generate your video |
| Generated videos | The finished MP4 and its status | To show it in History and let you download it |
| Credits and purchases | Credit balance and history, plan, order amounts, Waffo order IDs | To charge for videos, honour plans and handle refunds |
| Messages | Contact form and email messages, including content reports | To answer you and enforce our Acceptable Use Policy |
| Technical data | IP address, browser type, pages visited, how you arrived (referrer and UTM tags) | Security, fraud prevention, fixing problems and understanding which channels bring visitors |
Card details are entered on Waffo's checkout page and never reach our servers.
Photos of people and pets
- A photo is used only to create the video you asked for, to moderate content under our Acceptable Use Policy and to keep you and others safe.
- Faces are processed by AI video models to place the same person or pet in the dance. We do not build face templates, run facial recognition or use your photos or videos to train AI models.
- Photos and videos are stored in private storage under random, unguessable addresses. Anyone you give a video link to can open it, so share links with care.
- If you upload someone else's photo, you must have their permission (see our Terms). If your image was uploaded without your consent, report it and we will remove it.
Who processes data for us
We use a small number of service providers, each bound to use the data only to provide their service:
- Cloudflare – hosting, database and file storage for the website, photos and videos.
- AI video providers (kie.ai and/or Replicate, running ByteDance Seedance models) – receive your photo and return the generated video. They apply their own safety filters.
- Waffo – our Merchant of Record: checkout, payment processing, taxes, invoices and subscriptions.
- Resend – sends account and service emails such as verification and password reset.
- Google – optional "Sign in with Google".
- Analytics tools (such as Plausible, Google Analytics or Microsoft Clarity, when enabled) – aggregate statistics about how the site is used. See the Cookie Policy.
Some providers are located outside your country, including in the United States. Where required, transfers are covered by standard contractual clauses or equivalent safeguards.
How long we keep it
- Photos and videos: until you delete your account, so they remain available in History. Deleting your account removes them from our storage.
- Account data: for as long as your account exists.
- Purchase records: as long as tax and accounting law requires (usually up to 10 years), even after account deletion.
- Content reports and enforcement records: as long as needed to protect users and comply with the law.
- Technical logs: for a short period, typically no more than 30 days.
Generated files on our AI providers' side are temporary and expire within about 24 hours.
Your rights
Depending on where you live (for example under the GDPR, UK GDPR or US state privacy laws) you may have the right to access, correct, delete or export your data, to object to or restrict processing, and to withdraw consent. You can delete your account yourself in Settings. For anything else, use the contact page with the "Privacy request" topic or email support@toctocai.org. We answer within 30 days. You can also complain to your local data protection authority.
Our legal bases are: performing our contract with you (making videos, accounts, payments), our legitimate interests (security, fraud prevention, moderation, improving the service), your consent (optional analytics cookies), and legal obligations (tax records, responding to authorities).
Children
TocToc AI is not for anyone under 18, and we do not knowingly collect data from children. A parent or legal guardian may upload a photo of their own child for a wholesome video, under the rules in our Acceptable Use Policy.
Security
We use encrypted connections (HTTPS), hashed passwords, access controls and private storage. No system is perfectly secure, so please use a strong, unique password.
Changes
We will post any update here with a new date and tell you about significant changes by email or on the site.
Contact
Privacy questions: support@toctocai.org or the contact page.