AI RAP Privacy Policy

How AI RAP handles accounts, photos, generated videos, payments and emails, and your privacy choices.

Last updated: 2026-10-27

Version: 1.1 · Revised: October 27, 2026

1. Scope and responsibility

This Policy explains how the operator of AI RAP (“we”) processes personal information when you use ai-rap.org. The operator of AI RAP determines the purposes and means of the site's processing described here. Contact us at support@ai-rap.org about privacy.

Our Terms of Service govern service use; our Refund Policy covers payment refunds. This Policy provides information about processing. Reading it or using the service does not itself constitute consent to every optional use of information.

2. Information we process

Accounts, authentication and security

When you register or manage an account, we process your name, email, profile image if provided, password-verification information, email-verification records and sessions. If enabled and selected by you, Google, Microsoft or GitHub authentication also involves authorized profile details, platform identifiers and credentials needed for login or account linking. Passwords are stored as hashes.

To protect the service and understand signup sources, we may record IP addresses, browser and device technical information, request times, referrers, campaign tags, language and a country or region inferred from network information. This does not mean we access your device's precise location.

Creations, orders and support

We process submitted photos, text or rap topics, generation settings, task status, output videos, media metadata and credit records. Local-only drafts or audio previews are different from real cloud submissions. Selecting a local file does not by itself establish that it has been submitted to a model for generation.

Paid features involve order references, amounts, currencies, payment and refund status, subscription periods, credit allowances and payment-provider transaction references. Waffo Pancake and its payment institutions handle payment card details; AI RAP does not store full card numbers.

Support requests, tickets and requested emails involve the contact information, messages, attachments and order or task references you provide, along with sending status and necessary delivery records. Do not send support your password, full card number or unrelated private material.

3. Photos, videos and result emails

When phone uploads are enabled, you can scan a code on your computer and send photos without signing in on your phone. The creation form also allows guests to use this feature. Photos pass through private temporary storage before reaching the computer draft or upload form; this transfer does not send them to a generation provider or submit the form. Links expire after 10 minutes. Files become inaccessible after receipt, cancellation or expiry and enter scheduled deletion, with retries if deletion fails. Profile, article and support images subsequently follow their existing upload and saving flows.

Drafts remain in your current browser. Submitting a generation uploads your photos to private R2 storage. The provider used for the task (Fal or SeeAPI) receives time-limited read links to process them; if the task switches to a configured backup, that provider also receives the materials needed for processing. Completed videos are saved in our private storage. Project pages, photos and ordinary account downloads verify account ownership. A provider’s output link may be accessible to anyone holding it while the provider retains it.

You can request a result email for an individual project, or send and resend one after generation ends. Emails go only to your verified account email and include the work's theme, your rap topic, requested settings, credits charged and generation result. Failure messages reflect the recorded refund status. Email snapshots used for retries are encrypted; email logs do not retain message bodies containing download credentials.

Successful-result email links allow anyone holding the complete link to download without signing in, so forward them carefully. Each link expires 30 days after it is first prepared for sending; automatic retries do not extend it. A manual resend creates a new link, while older links keep their original expiry. Expiry does not delete your work. Deleting the work immediately disables all associated email links. Work pages, source photos and ordinary account downloads still require the owning account to sign in.

Original photos and generated videos remain with their project. Deleting a finished project schedules deletion of files no longer referenced by another project. Unattached temporary uploads become eligible for cleanup after 24 hours. Deleting a project here does not establish deletion of data held by the provider, whose processing is subject to its own privacy rules. Existing drafts and history remain in browser storage and can be cleared through your browser’s site data settings. This does not delete projects in your account.

4. Purposes and legal grounds

Where applicable law requires a legal ground for processing, we use the following grounds for the relevant purpose:

Performing our service agreement: creating accounts, authenticating users, generating and storing requested videos, delivering results, managing credits and subscriptions, reconciling payments and handling refunds.
Performance of the agreement or legitimate interests: answering support requests and sending requested result emails, billing, security and service-status notices.
Legitimate interests: preventing fraud and abuse, troubleshooting and maintaining the service, within reasonable expectations and without overriding legally protected rights.
Consent or another ground permitted by applicable law: optional analytics, cookies requiring consent or future voluntary marketing subscriptions. Where consent is required, it must be obtained first.
Legal obligations: keeping required financial records, responding to lawful regulatory requests and handling legal disputes.

Accepting our Terms does not grant blanket consent to train models on your inputs. Third-party processing purposes and restrictions must also be assessed under the provider's applicable terms. Aggregation does not automatically make data anonymous if people can still be identified.

5. Providers and sharing

We do not sell your personal information. We share information as needed for the purposes above with the following providers. Listing an optional service does not mean every visit activates all of them:

Fal and SeeAPI (video generation): The provider handling an attempt receives generation text, settings and time-limited photo read links, and returns task status and outputs. Providers may retain inputs, outputs and request records under their applicable rules. See the Fal Privacy Policy, SeeAPI Privacy Policy and SeeAPI API Data Handling & Privacy for their processing, retention and deletion practices.
Cloudflare R2: stores private media objects, including photos and videos used in real creations.
Waffo Pancake: handles checkout, payments, subscriptions and approved refunds, exchanging the information necessary to reconcile orders and benefits with AI RAP.
Google, Microsoft and GitHub: provide identity services when their login or account-linking feature is enabled and you choose to use it.
Resend or Cloudflare email services: send verification, security or result emails according to the enabled configuration, processing recipient addresses, email content and delivery information.
Analytics and customer-service providers: the analytics tools in section 7 may be enabled. If Crisp or tawk.to live support is enabled, that service processes messages you send and necessary technical information.

We may also disclose necessary information to authorities as required by law, or as needed to address disputes and protect people and the service. If a business transfer involves personal information, we will provide applicable notices and require corresponding protection from the recipient. We will seek separate consent for other purposes where legally required.

6. Retention and deletion

Local data: drafts, historical previews and locally selected media remain in browser storage until removed using product or browser controls, or reclaimed by the browser. Switching devices, clearing site data or browser failure may make them unrecoverable.
Cloud media: original photos and outputs remain with their project. Deleting a finished project schedules cleanup of media no longer referenced by other projects. Cleanup must actually run and may be retried after a failure. Unattached uploads become eligible after 24 hours.
Result emails: download links are valid for 30 days from their first preparation for sending; expiry does not delete projects. Sending and delivery records may remain for retries, support and security checks. Email copies already delivered to your mailbox are managed by you and your email provider.
Accounts and other business records: retained as needed to maintain accounts, reconcile credits and payments, address support, fraud or disputes, and meet financial or other legal duties. These records do not all follow the media or link-expiry periods. We delete or de-identify information when retention is no longer necessary.

Project controls allow deletion of eligible projects. Contact support to request account deletion, copies of information or other deletion. Deleting a project does not mean all task, payment or security records have been erased, or that a third party has deleted its copies. We explain necessary retention when handling a request. Subscription cancellation, clearing local storage and deleting cloud data are separate operations.

7. Cookies, local storage and analytics

Necessary cookies support authentication, sessions and security. Language preferences, cookie choices and browser storage also support preferences and local creations. When cookie choices are offered, an acceptance or rejection can be saved for 365 days. Browser controls can delete or limit cookies and site storage; blocking necessary cookies may prevent sign-in.

Depending on the enabled configuration, analytics providers may receive page views, outgoing-link clicks, interaction events, campaign tags and device or network technical information. Potential tools and their privacy notices are:

Where a cookie choice is displayed, you can accept or reject the optional storage and scripts governed by that choice. Browser settings or cookie rejection may not prevent every cookieless measurement or request needed for the service. If Google AdSense is enabled, Google may also process information for ad delivery under its privacy policy, a purpose separate from the creation you request. Contact support about the current configuration or privacy choices.

8. Service emails and marketing

Verification codes, security notices, billing messages and project results that you schedule or send are service communications. Result emails are not marketing subscriptions, and using the service does not automatically authorize marketing.

If marketing subscriptions are offered later, we will obtain a separate choice where required and provide an unsubscribe method. Opting out of marketing does not stop necessary service communications. Forward emails containing project information or download links carefully.

9. Rights and requests

Depending on applicable law, you may have rights to information, access and copies, correction, deletion, restriction, portability, objection and withdrawal of consent. Withdrawal does not affect the lawfulness of processing before it. You may also complain to a data-protection authority with jurisdiction.

Email support@ai-rap.org with the requested action and your account email or necessary task or order reference. We may reasonably verify your identity and will respond within one month of receiving the request. If a lawful extension is needed, we will explain the reason and expected timing within that month. Mandatory retention or other people's rights may limit some requests; we will explain where this applies.

10. Security and incident notices

We use account-ownership checks, access controls, private storage, restricted access credentials and encrypted email retry snapshots to protect information. Safeguards cannot guarantee absolute security of internet transmission or storage. Protect your account and download links.

If a personal-information security incident occurs, we will take necessary response measures and notify relevant authorities and affected people under the conditions and deadlines required by applicable law.

11. International processing

Providers may process information outside your country or region, where data-protection rules may differ. For processing that requires cross-border safeguards, we will take measures required by applicable law. Contact support for information about the processing locations and safeguards relevant to your data. A provider's commitments do not automatically establish that AI RAP has every identical measure in place.

12. Minors

AI RAP accounts are intended for people aged 18 or older. We do not knowingly collect registration information from people under 18. Adults uploading photos involving minors must still have a lawful basis and necessary guardian permission, and must not upload content harmful to minors. Contact us if you suspect information involving minors is being handled contrary to this Policy so we can investigate and respond.

13. Updates

We publish revisions, version numbers and update dates on this page. Material changes will normally be announced on the site or by account email at least 15 days in advance. Legal or urgent security requirements may require earlier changes, with notice as applicable. Continued use does not replace fresh consent where that consent is required.

14. Contact

Contact the operator of AI RAP about accounts, privacy rights, data security or this Policy at support@ai-rap.org.

Related pages: Terms of Service · Refund Policy.