Privacy Policy

We collect the following categories of information: Account Information (collected by our backend): • Email address — for account identification and communications • Password hash (Argon2id) — for authentication; stored irreversibly • Display name (optional) — for personalization • Device UUID and device name — for device binding management • Task input metadata — prompts, document paths/links, intermediate output paths/URLs • Task logs — for execution status tracking Payment Information (processed by Stripe): • We only store your Stripe customer ID and payment method type (card/alipay/wechat_pay) • We do NOT access or store credit card numbers or sensitive payment details Analytics Data (Google Analytics on the Web Portal, when configured and allowed by your analytics consent): • Page views, session duration, traffic sources, device/browser data, approximate location, and similar analytics data • Collected via the Google Analytics SDK and subject to Google's privacy policy Desktop Client Local Data (NOT uploaded to our servers): • Video files (generated output) • Intermediate production files (scripts, audio, images) • Configuration files and rendering temporary files

We use your information for the following purposes: 1. Core Service Delivery — authentication, task scheduling, and video production pipeline 2. Account Management — subscription billing, device limits, and quota tracking 3. Security — abuse prevention and anomaly detection 4. Communications — email verification, password resets, and service notifications 5. Website Analytics — understanding Portal usage patterns via Google Analytics when configured and allowed by your analytics consent What we do NOT do: • ❌ We do NOT sell your data to any third party • ❌ We do NOT use your input content to train or improve AI models • ❌ We do NOT serve advertisements or conduct ad targeting • ❌ We do NOT make automated decisions that affect your rights

Your data may be shared with third-party services in two distinct categories: Client-Side (executed on your local device): The Desktop Client interacts with third-party AI content generation, speech synthesis, and related services directly from your device using your own accounts. The browser automation session itself is local to your device and is governed by your agreements with the respective third-party providers. To provide task orchestration, progress recovery, usage metering, and user-facing status, AiMediaCraft may receive and store necessary task inputs, prompts, file paths/URLs, step outputs, generated JSON or summaries, intermediate output paths/URLs, task status, and task logs. Video files and intermediate production files themselves remain on your local device unless you separately choose to share them. Server-Side: • Stripe — for payment processing • SMTP Service — for email delivery (verification, password resets) • Google Analytics — for website usage analytics (Portal only, when configured and allowed by your analytics consent) Current third-party service providers are listed in the Third-Party Services section of our Terms of Service.

• Server Location: Japan • Server-side storage includes: user account information, task input metadata (prompts, document paths/URLs), intermediate output paths/URLs, and task logs • Server-side does NOT store: video files or intermediate production files themselves • Encryption: passwords are hashed with Argon2id; all data transmission uses HTTPS encryption • Access Control: JWT-based authentication with role-based permissions

• You may request account deletion at any time by contacting our support team via email. • Upon receiving your request, we will permanently delete your data within 30 days. • Deletion scope: Your user account and all associated records (devices, subscriptions, render history) will be permanently removed. Task data will be anonymized (input content cleared, ownership unlinked). • Local data (videos, intermediate files) stored on your device is managed by you and is not affected by account deletion.

You have the following rights regarding your personal data: • Right of Access: View your personal information and task records through the Platform console. • Right of Rectification: Modify your display name through the Platform console. • Right of Erasure: Request account deletion by contacting our support team via email. • Right to Withdraw Consent: Unsubscribe from notification emails at any time.

• Essential Storage: access and refresh tokens are stored in browser localStorage for authentication; language preferences are stored in localStorage and a language cookie. • Analytics Cookies: Google Analytics — used on the Web Portal only when configured and allowed by your analytics consent. • Advertising Tracking: None. We do not use any advertising trackers.

• All video files and intermediate production outputs are stored exclusively on your local device. • A device UUID is used for device binding and is transmitted to our server. • Browser automation sessions between the Desktop Client and third-party AI services occur locally on your device. • We currently do not collect crash reports or usage statistics from the Desktop Client. If we enable such features in the future, we will update this Privacy Policy and notify you accordingly.

Our servers are located in Japan. The Service is available to users worldwide. By registering for the Service, you consent to the storage and processing of your data on servers located in Japan. We use GDPR-level standards as our baseline for data protection, applicable to users in all regions. This Privacy Policy is drafted in English. In the event of any discrepancy between the English version and any translation, the English version shall prevail. We may update this Privacy Policy from time to time. Material changes will be communicated at least 30 days in advance via email and platform notification.