Privacy Policy

• Account data — name, email address, hashed password, language preference. If you sign in with Google, the profile data that provider returns (name, email, profile picture).
• Content you submit — source video links, uploaded photographs and videos, avatar images, prompts and text edits, and the videos generated from them.
• Billing data — purchase history, credit balance and ledger, subscription status, and an identifier from our payment provider. We never see or store your full card number.
• Consent records — which version of our Terms, Privacy Policy, and Refund Policy you accepted, when, from which IP address and browser. We are required to be able to prove this, and it is our defence if a payment is disputed.
• Usage and device data — pages viewed, features used, generation history, IP address, browser and device type, and error diagnostics.
• Acquisition data — the referrer, campaign parameters, and landing page of your first visit, kept so we know which marketing actually works.
• Instagram profile data — if you connect or monitor a public profile, the public information about it that we fetch.

Under the GDPR and equivalent laws, each purpose has a legal basis:

• Providing the Service — running analysis and generation, keeping your balance, delivering output. Basis: performance of our contract with you.
• Processing facial images — see section 3. Basis: your explicit consent.
• Payments and receipts — basis: contract and our legal obligations.
• Consent, fraud, and dispute records — basis: our legitimate interest in proving what was agreed and delivered, and in preventing abuse of promotional offers, and our legal obligations.
• Transactional email — verification, password reset, receipts, generation notifications, expiry reminders. Basis: contract.
• Product analytics and improvement — basis: legitimate interest, using the least identifying data that answers the question.

The core feature of AutoHustle places your face into a generated video. To do that we process photographs and video frames containing faces. Depending on where you live, this can be biometric data — a special category under the GDPR, and regulated in several US states.

Concretely:

• we store the avatar photographs you upload, and reference frames derived from them, so generation can run and re-run;
• we compute a numeric facial-similarity score between a generated frame and your reference photo, as a quality check. It is used to decide whether a generation is good enough to deliver;
• we send your reference image to the third-party AI model that performs the generation (section 5);
• we do not use facial data to identify you, do not build a face database for identification, do not sell it, and do not use it to train our own or anyone else's models.

We process this data on the basis of your explicit consent, given when you upload an avatar and when you accept these documents. You can withdraw that consent at any time by deleting the avatar or your account; deleting an avatar removes the stored photographs and derived reference images. Withdrawal does not affect videos already generated.

If you upload an image of someone other than yourself, you must have that person's permission, and you are responsible for giving them any notice their local law requires. Do not upload images of minors.

Avatar images and derived reference frames are deleted when you delete the avatar, and in any case within 30 days of account deletion.

Videos generated using credits obtained through activation offers — the promotional first purchase, surveys, referrals, or share rewards — may be shown in the public AutoHustle gallery alongside the source video, as described in the Terms of Service. Those pages are public and can be indexed by search engines.

You can hide any of your generations from the gallery at any time from your account, and we will remove it from the public pages. Content generated on a paid subscription is private by default. Everything in the gallery is checked automatically before publication for inappropriate material and recognisable third parties, and you can report anything to abuse@autohustle.me.

We do not sell personal data. We share it with the processors we need to run the Service, each bound by a data-processing agreement:

• AI model providers — receive your prompts, source frames, and reference images to perform generation. Providers are selected per request and change over time as we improve quality and cost.
• Payment provider — handles cards and subscriptions; we receive only identifiers and the outcome.
• Hosting, storage, and database providers — run the application and store your content and account data.
• Email provider — delivers transactional email.
• Analytics and advertising — product analytics, and conversion measurement for advertising platforms where you have consented to it.

We also disclose data where legally required, and to defend a payment dispute — in which case the payment network receives the consent record, credit ledger, and delivery URLs for the account in question.

Some of these providers are outside the EEA, principally in the United States. Those transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision.

• Account data — while your account exists, then deleted within 30 days.
• Avatar photographs and reference frames — until you delete the avatar, or within 30 days of account deletion.
• Generated videos and storyboards — while your account exists, unless you delete them earlier.
• Billing records and receipts — up to 7 years, as tax and accounting law requires.
• Consent records — for as long as needed to defend a claim relating to the transaction, and no less than the billing retention period.
• Analytics — in aggregated or pseudonymised form, which may outlive the account.

Passwords are hashed with bcrypt. Data is stored in PostgreSQL with encrypted connections; traffic is TLS-encrypted end to end. Access tokens for third-party integrations are encrypted at rest with AES-256-GCM. Administrative access is restricted and audited. No system is perfect; if a breach affects your data and the law requires it, we will notify you and the relevant authority.

We use cookies that are strictly necessary for sign-in and session management, and cookies that record referral and campaign attribution for up to 90 days. Analytics and advertising measurement run only where you have consented. We do not use third-party advertising cookies to build profiles about you across other websites.

Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to processing, port it to another service, or withdraw a consent you gave. You can delete your account and its data yourself from account settings.

Write to privacy@autohustle.me and we will respond within 30 days. We do not discriminate against you for exercising a right. If you are in the EEA or the UK, you may also complain to your local data-protection authority.

The Service is not for anyone under 16. We do not knowingly collect data from children, and we do not permit avatars or face replacement involving minors. If you believe a child has given us data, write to privacy@autohustle.me and we will delete it.

We may update this policy; each version carries the date above. A material change requires your acceptance before your next generation, and that acceptance is recorded. Minor corrections are published without re-prompting.

Privacy questions and rights requests: privacy@autohustle.me
Everything else: support@autohustle.me