Privacy

What we keep

• From your sign-in: your email. If you sign in with Google, also your name and profile photo.
• What you create: the character's choices and text, and the images and videos generated.
• The photos and videos you upload, including the originals when we need to resize or crop a video.
• Attempts that fail or are refused: the files go to a private record with the reason, the reviewed image and the related generation, when there is one.
• Purchases: the pack, the amount and the payment status. Card details stay with Stripe, never with us. If you choose to save your card at checkout, Stripe keeps it for your next purchases. You can remove it on the payment page.
• From the visit: a device identifier in a cookie, the page, the ad or the referral link you came from, the country, and a code derived from your network address (we do not keep the address itself).
• Usage events: the steps you went through, to measure whether the product works. We also measure clicks on buttons, sections viewed and scroll depth on the home page. In creation, we measure which cast characters you chose, whether you edited the description, selected photos, started an upload or hit an error. These events are analyzed in Cloudflare Basin. This measurement does not include your text or photos. Only for those who ticked the additional option, we also keep the prompts sent and generated and private references to the media for up to 90 days. We do not capture passwords, sign-in codes or anything you did not submit.

What we use it for

• To generate and deliver your characters and videos.
• To charge you, return credits and issue receipts.
• To limit abuse of free use.
• To know which ads bring customers and to improve the service.
• To analyze usage, investigate failures and review automatic decisions. These records are not automatically published to the trend library.
• To email you the sign-in code, the notice that a preview is ready and the receipt for a purchase.

Who we share it with

• fal.ai, which runs the image and video models: it receives the text and images of each generation, including the photos and videos you uploaded for it.
• OpenRouter, which runs the text model that suggests names and writes instructions: it receives what you typed.
• Stripe, which processes payments.
• Cloudflare, where the service and the files are hosted and where requests are reviewed by safety models. Basin organizes the analytics history and R2 keeps the private content records.
• Google, only if you choose to sign in with your Google account.
• Meta (Facebook and Instagram), to measure our ads, as explained under Cookies.

We do not sell your data. We share data with Meta to measure our ads, as explained under Cookies, and you can turn that off there.

Cookies

Necessary cookies, which we always use:

• The session, which keeps you signed in after you sign in.
• The device identifier (duble_visit), so you can pick up where you left off before signing in. Tied to it, we also record which ad or whose link brought the visit, so we can count what each one brings.
• Your choice about measurement and marketing (duble_consent), kept for up to one year.

Measurement and marketing cookies, on for everyone and which you can turn off here:

We use Meta's cookies (_fbp and _fbc) and send it the pages you see on the public site and the events account created, character created, preview ready, payment started and purchase, with the network address and browser used, and your hashed email (a scrambled version of it, which does not show the address). They serve to measure our ads and show them to people who may be interested. We do not show a cookie notice: they are on from the first visit. When you turn them off, none of this is sent from this browser and Meta's cookies are deleted.

Deleting your data

Deleting a character removes its photos and related files. Deleting a video or a photo removes what was generated; the file you uploaded stays in what you sent, to use again, until you remove it there.

In Account, "Delete my account and my data" immediately removes your characters, videos, credits, history and the private analytics content tied to you, including uploads from attempts that failed or were refused. The identifiers of those visits stop appearing in the Basin dashboard after the deletion is processed. The data lake's technical history may remain in files and snapshots until their maintenance; it does not contain the prompts or the photos. Payment records stay with Stripe for the period the law requires.

Your rights (LGPD)

You can ask for access, correction, portability or deletion of your data and ask questions about how it is handled by writing to support@dubleia.com.