Privacy

1. Data controller

The data controller within the meaning of article 4 of the GDPR is the publisher of Incarn, a sole trader registered in France: their identity, SIRET number and postal address are given in the legal notice. For any request about your personal data, write to [email protected]. We reply within 30 days at most.

1a. Summary of processing

Here is a summary of the processing carried out by Incarn. The following sections explain each line.

2. Data we collect

We only collect the data needed to run the Service:

• Email address: when you create your account (sign-in with a code sent by email).
• Uploaded photos: images you send to be animated. Trial content (not purchased): removed from your account after 45 days, then permanently erased from our servers no later than 60 days after that removal. Content linked to a purchase: kept while your account is active. Content refused by moderation: deleted within a few days.
• Generated videos: animation video files. Same retention as the photos above (trial removed from the account at 45 days then erased within 60 days, purchased content kept while the account is active).
• Family films: title, dedication, chosen animations, music, format and look, the film itself and its secret sharing link. The link opens the film to anyone who has it; the page is never indexed by search engines.
• Payment data: processed exclusively by Stripe. We never see or store your card details. We keep Stripe identifiers and transaction records for invoicing and legal compliance.
• Gift cards: the buyer's account, the code, the redemption date and the account that redeems it.
• Withdrawals: the email and, if you give it, the name of the person withdrawing, the order number, the statement, the date and time, the IP address, and the waiver box ticked before payment with the version of its text.
• Usage logs: technical logs (IP address, timestamps, actions) for security, abuse prevention and debugging. They are never used for advertising or profiling.
• Moderation data: reason and fingerprint (hash) of refused photos, error messages, internal refusal counter per account (visible only to the administrator). The refused image itself is not kept. See section 4b.
• Identity verification (KYC) data: if Incarn asks you to verify your identity (18+ procedure, see Terms section 6b): surname, first name, date of birth and, where applicable, a photograph of an official identity document. This data is stored encrypted and is accessible only to the administrator of the Service.

3. How we use data

• Sign-in: your email is used to send sign-in codes and to identify your account.
• Creating animations: your photo first goes through an automated moderation filter (Sightengine), then it is sent to our AI provider (BytePlus/Seedance), which checks that it is suitable for animation and creates the animated video. See section 5 for details.
• Family films: our servers edit your animations into a film; the "film ready" email gives you the link.
• Invoicing: your email and payment data are used to manage purchases through Stripe. An internal notification (Slack) tells us about each sale, with your email and the amount.
• Withdrawal: your data is used to handle your request, refund you and keep proof of the request and of any waiver.
• Emails: we write to you about your account and your purchases, and we may tell you about what is new at Incarn (for example a reminder if you have not finished an animation). You can object at any time (section 6).
• Security: usage logs help us detect and prevent abuse, fraud and unauthorised access.
• Analytics and advertising: when you consent through our cookie banner, we enable the Meta pixel, Google Analytics and Google Ads, Microsoft Advertising (UET), PostHog and Microsoft Clarity. They receive browsing and conversion events (pages visited, actions taken, technical identifiers) that may be matched with your account on those services if you have one. None of these trackers fires until you accept the matching category ("Analytics" or "Advertising") in our consent banner.
• Video labelling: every video Incarn produces (animation, preview, film) carries signed technical metadata (the C2PA “Content Credentials” standard and XMP) stating that it was generated by artificial intelligence, as required by the EU AI Act. This metadata contains no personal data: not your name, email address, film title or dedication; only the name Incarn, the type of content and the signing date.

4. How long we keep data

• Trial photos and videos (not purchased): removed from your account after 45 days, then permanently erased from our servers no later than 60 days after that removal. The first period lets us contact you again if you have not finished; the second is a technical margin before irreversible erasure.
• Photos refused by moderation: the file is deleted within a few days (~7 days); we do not host problematic content. Only metadata (fingerprint/hash, reason for refusal, timestamp) is kept for up to 12 months (see section 4b).
• Content linked to a purchase, family films included: kept while your account is active, then deleted within 30 days at most after the account is closed, unless the law requires otherwise (dispute, ongoing investigation, request from a competent authority).
• Account data (email, credit balance, history): kept until you ask for deletion. You can delete your account directly from your gallery.
• Payment data: kept in accordance with tax and accounting obligations (10 years, French Commercial Code).
• Withdrawals and proof of waiver: 5 years. If you delete your account, the request is kept as proof, but your email and name are replaced by a fingerprint.
• News emails: sent until you object, and at most 3 years after your last contact with us.
• Usage logs: kept for up to 12 months, in accordance with the French LCEN (article 6-II).
• Moderation metadata (fingerprint/hash of the refused photo, reason, timestamp, never the image itself): kept for up to 12 months to prevent repeat attempts and cooperate with the authorities (legitimate interest, art. 6.1.f GDPR).
• Internal refusal counter: kept until the account is deleted.
• KYC data (surname, first name, date of birth, identity document): kept for up to 5 years after the last sign-in or the closing of the account, in line with the limitation period for civil liability and the duty to cooperate with judicial authorities.
• Data kept under a judicial request: kept for as long as the investigation requires, regardless of the periods above.

4a. Legal bases

Each processing relies on one of the following bases:

• Performance of the contract (art. 6.1.b GDPR): sign-in, creating animations, family films, gift cards, invoicing.
• Legal obligation (art. 6.1.c GDPR): keeping usage logs for 12 months (LCEN), keeping accounting records (Commercial Code), handling withdrawals, disclosure to authorities on request.
• Legitimate interest (art. 6.1.f GDPR): anti-abuse moderation, fraud prevention, counting refusals, identity verification when abuse is suspected, protecting minors, proof of withdrawals and waivers, news emails to customers, outreach to professionals.
• Consent (art. 6.1.a GDPR): analytics and advertising cookies and trackers, Showcase.

4b. Abuse prevention and reporting of unlawful content

We may process certain usage data, content sent to the Service, account information, IP addresses, timestamps, technical logs and moderation results in order to detect, prevent and document use that is clearly unlawful or contrary to our Terms of Service, in particular attempts to generate content involving minors, non-consensual images, or violent or hateful content, or content that infringes the rights of others.

Where necessary, proportionate and legally justified, this information may be kept as evidence and passed to the competent authorities, to legally authorised reporting platforms (in particular the French PHAROS platform, under article 434-3 of the French Criminal Code) or to bodies specialised in protecting victims and children or fighting online abuse.

Legal basis. This processing relies on our legitimate interest in keeping the Service safe, preventing abuse, protecting users and third parties, and cooperating with the competent authorities (art. 6.1.f GDPR). The data concerned is strictly limited to what is needed to analyse, prove and report the suspected abuse.

How moderation works. Uploaded photos are analysed automatically by a nudity filter (Sightengine), then by the classifiers of our AI processors (BytePlus/Seedance, MiniMax/Hailuo). No human operator views the photos. A refused photo is not animated, the credit is returned, and its file is deleted within a few days. A human review may only take place exceptionally, following a report by a third party or a request from an authority. An internal counter keeps track of refusals per account.

Targeted identity verification (KYC). No identity verification is requested by default. It may be required case by case, only when an account shows serious signs of abuse (repeated moderation refusals, suspicious content, third-party report, account recovery request). The possible levels are:

• Level 1: surname, first name, date of birth, provided through a secure form.
• Level 2: level 1, plus a photograph of an official identity document, checked manually by the administrator of the Service.

Security of and access to KYC data. KYC data is stored in a private space on Cloudflare R2, under a path with a high-entropy random identifier. No public URL is ever generated for identity documents. The administrator of the Service accesses them only through a short-lived signed URL (5 minutes), and each access is recorded in our internal logs. No automated biometric processing takes place: it is a visual document check, with no extraction of biometric templates and no facial recognition.

Data linked to abuse or reports. Where unlawful use is seriously suspected, the data strictly needed to document the abuse may be kept for up to 12 months, or longer if needed to handle a dispute, an investigation, a request from a competent authority or a legal obligation.

Reports by third parties. To report unlawful content, write to [email protected]. Reports are examined as quickly as possible; where required, a reasoned decision is sent to the person who made the report.

5. Processors and third parties

We use the following providers, each bound by its own privacy policy and, where applicable, its GDPR commitments:

• Stripe: payment and refund processing. Stripe privacy policy
• Cloudflare R2: cloud storage of photos, videos, films and KYC documents.
• Hetzner (self-hosted PostgreSQL, Germany): database holding account data, animation history, films, purchases, credit balances and moderation data.
• Sightengine: automated nudity filter that analyses each uploaded photo before animation.
• BytePlus / Seedance API: AI provider that analyses your photo (face, quality) and processes it to create the animation. Your photo is sent to its API for this purpose only and also goes through its own moderation filter.
• MiniMax / Hailuo API: fallback AI provider used when BytePlus refuses a photo. Same processing and moderation conditions.
• Resend: sending sign-in emails, transactional emails (receipts, film ready, acknowledgements), news emails and, from a dedicated account, outreach emails to professionals.
• Slack: Incarn's internal messaging. Our notifications about sales, withdrawals and incidents may contain the customer's email and the amount; never your photos.
• Hetzner (application hosting, Germany): hosting of the website and the API.
• PostHog (EU): session recording only, to debug user journeys. Input fields are masked. If you are signed in, the session is linked to your identifier and email.
• Microsoft Clarity: session recording and heatmaps, to understand areas of interest and friction. If you are signed in, the session is linked to your email.
• Google (Google Analytics 4, Google Ads): audience measurement and advertising campaign measurement.
• Microsoft Advertising (UET): Bing advertising campaign measurement; on a purchase, your email is sent to match the conversion.
• Meta (Facebook): advertising tracking pixel to measure campaign performance. Pseudonymised data.
• French and European judicial and administrative authorities: recipients in case of a request or a spontaneous report of a clear offence.

We do not sell your data. Advertising trackers (Meta, Google Ads, Microsoft Advertising) only work with your consent.

About the AI processors. Your photos are sent to our AI processors (BytePlus/Seedance and, where applicable, MiniMax/Hailuo) for the sole purpose of creating the requested animation. These processors operate from jurisdictions outside the European Union (Singapore for BytePlus, China for MiniMax). The BytePlus Data Authorization Agreement offers an option allowing the content sent to be used to train and improve its models; we have configured our account to switch it off. Your photos are therefore not used to train BytePlus's artificial intelligence models and serve only to produce the requested animation. For MiniMax/Hailuo, used only as a fallback when BytePlus refuses a photo, the photo is sent for the sole purpose of creating the animation; please see that provider's privacy policy for processing under its own responsibility. The transfer is governed by the standard contractual clauses adopted by the European Commission; it nevertheless remains subject to a legal framework different from EU law.

6. Your rights (GDPR)

Under the General Data Protection Regulation (GDPR) and the French Data Protection Act, you have the following rights:

• Right of access: obtain a copy of your personal data.
• Right to rectification: ask for inaccurate data to be corrected.
• Right to erasure: ask for your account and all associated data to be deleted.
• Right to data portability: receive your data in a machine-readable format.
• Right to object: object to the processing of your data in certain circumstances, and at any time, without giving a reason, to news and outreach emails: use the unsubscribe link in those emails or write to [email protected].
• Right to restriction: ask for the processing of your data to be restricted.
• Right to withdraw consent: at any time (cookie banner, Showcase), without affecting the lawfulness of processing based on consent given before.

You can delete your account and all your data directly from your gallery ("Delete my account" button). Deletion is immediate and irreversible. For any other right, write to [email protected]. We will reply within 30 days. You may lodge a complaint with the French data protection authority, the CNIL, or with the authority of your country.

Limits to the exercise of your rights. Under article 23 of the GDPR and articles 116 and following of the French Data Protection Act, the exercise of your rights may be restricted for data needed for:

• the prevention, investigation, detection and prosecution of criminal offences,
• mandatory retention under the French LCEN (at least 12 months for usage logs and identification data),
• cooperation with the authorities on request,
• protecting minors and fighting unlawful use of the Service,
• proof of withdrawals and waivers (5 years).

In practice, a request to erase data kept on these grounds may be refused until the applicable legal periods expire.

7. Cookies

We use the following cookies:

Strictly necessary cookies (no consent needed)

• Session cookie (httpOnly): keeps you signed in. Contains your authentication token. Not accessible to JavaScript.
• NEXT_LOCALE: stores your language preference. No personal data.
• Cookie banner choice: remembers your consent preferences.
• Visit source (incarn_lp, incarn_utm): internal measurement, no third party involved. Keeps only the name of the site you came from (for example google.com, never the full page address), the link's campaign parameters (utm) and the first page you viewed on Incarn. Used only to learn which sources bring visitors; never used for advertising or shared. Lifetime: 90 days (incarn_lp), 30 days (incarn_utm).

Analytics (with "Analytics" consent)

• Google Analytics 4: measures visits and purchases.
• PostHog (session recording): sets cookies to rebuild the browsing path for debugging. EU hosting, inputs masked.
• Microsoft Clarity: sets cookies to record sessions and build heatmaps.

Advertising (with "Advertising" consent)

• Meta pixel (Facebook): set by Meta to measure how well our advertising campaigns work. It collects pseudonymised browsing data (pages visited, conversions). Lifetime: up to 90 days. You can switch off Meta ad tracking in your Facebook settings or through Your Online Choices.
• Google Ads: measures conversions from our Google campaigns.
• Microsoft Advertising (UET): measures conversions from our Bing campaigns.

These trackers are only set after you consent through our cookie banner, category by category. You can change your mind at any time with the "Cookie preferences" link at the bottom of the page.

8. Transfers outside the EU

Some processing involves transferring your data outside the European Union. Details by provider:

The standard contractual clauses (SCCs) used are those adopted by the European Commission on 4 June 2021 (Implementing Decision 2021/914). You can obtain a copy on request at [email protected]. In line with the "Schrems II" judgment of the Court of Justice of the European Union, please note that these clauses only offer partial protection against possible access to data by the authorities of the third country concerned.

9. Security

We apply appropriate technical and organisational measures to protect your data: encryption in transit (TLS), httpOnly cookies, cryptographic identifiers, strict access control to systems.

Documents sent for KYC (identity documents) are stored in a private space on Cloudflare R2, with a randomly generated access key, and are only accessible through a temporarily signed URL at the administrator's request. Each access to a KYC document is recorded with a timestamp in our internal logs.

9a. YouTube API Services

To publish our own videos on our own YouTube channel (@Incarn-Animation-Photo), Incarn uses the YouTube API Services. Incarn is therefore bound by the YouTube Terms of Service. Data processing by Google is governed by the Google Privacy Policy.

Data concerned. This integration is used only to upload our content (AI-animated videos we produce) to our single channel. We do not read, display, aggregate or store any YouTube data of other users, and we do not use any YouTube data for advertising. Authorisation is granted once by the channel owner through OAuth 2.0; the access token is stored encrypted on the server and is used only for this upload.

Revocation and deletion. The channel owner can remove Incarn's access at any time from the security settings of their Google account. Revocation immediately invalidates our access token, which we then delete from our systems.

10. Contact

For any question about this privacy policy or your personal data: [email protected]