Introduction
HESONGTING ("we", "us" or "our") respects your privacy. This Privacy Policy explains how we collect, use, store and share personal information when you use Hotel Lobby AI at https://hotellobbyaidesign.com (the "Service"), and the rights you have. By using the Service you acknowledge this Policy. We will notify you of material changes by email or an on-site notice.
1. Data Controller
- Controller: HESONGTING
- Privacy contact: [email protected]
- Data Protection Officer: not appointed (not required for our processing activities).
2. Information We Collect
2.1 Information you provide
- Account information: your name, email address and password (stored only as a salted hash).
- Photos and creative inputs: the portrait photos you select are combined in your browser into a single composited source frame. Only that composited frame is uploaded to our servers — the original photo files are not. We also store your selected stage, quality tier, duration and aspect ratio.
- Generated content: the status of each generation request and the URL of the resulting video.
- Credit and purchase records: credit balance and movements, purchased plan or pack, transaction amount and payment status. We do not receive or store full card numbers — card data is handled by our payment processor (see Section 5).
- Communications: emails, support requests, content reports and appeals you send us. When we act on a report under our Acceptable Use Policy, we keep a record of the report, the content concerned and the action taken.
2.2 Information collected automatically
- Session data: IP address and browser user agent recorded with each sign-in session, used for security and fraud prevention.
- Log data: request times, error logs and performance data generated by our hosting provider.
2.3 Face images
Photos you upload contain faces. We use them only to generate the video you request. We do not create face templates, biometric identifiers or facial-recognition profiles, and we do not use your photos to identify you.
3. How We Use Your Information
| Purpose | Legal basis |
|---|---|
| Creating your account and signing you in | Contract performance |
| Generating, storing and displaying your videos | Contract performance |
| Billing, credits and payment processing | Contract performance |
| Customer support | Contract performance / legitimate interests |
| Service notices (billing, security, policy updates) | Legitimate interests |
| Security, abuse and fraud prevention | Legitimate interests |
| Improving the Service using aggregated statistics | Legitimate interests |
| Complying with legal obligations | Legal obligation |
We may aggregate or de-identify data for statistics; such data cannot identify you. We do not use your photos or videos to train AI models, and we do not publish them as examples without your explicit consent.
4. Cookies & Tracking
| Type | Purpose | Can be disabled |
|---|---|---|
| Strictly necessary | Keeping you signed in (session cookie) and core security features | No |
We currently use only strictly necessary cookies. We do not use third-party analytics, advertising or tracking cookies. If we add any, we will update this Policy and, where required, ask for your consent first.
5. Sharing & Disclosure
We do not sell your personal information, including "selling" as defined by laws such as the CCPA. We share information only in the following cases:
Service providers
| Provider | Purpose | Data shared |
|---|---|---|
| Cloudflare | Hosting, database (D1) and file storage (R2) | All data stored by the Service |
| fal.ai | AI video generation (Seedance models) | Composited source frame and generation prompt; the generated video is delivered from its servers |
| Creem or Waffo Pancake | Merchant of record and payment processing | Email, purchased item, amount and payment details you enter at checkout |
| Resend | Transactional email | Email address and message content |
Providers receive only the data needed for their function and are bound by confidentiality and data-processing terms. Payment card data is processed exclusively by the PCI-DSS compliant payment processor you choose at checkout (Creem or Waffo Pancake) and is never stored on our servers.
Other disclosures
- Legal and regulatory requirements: when required by law, court order or a lawful request from a competent authority.
- Business transfers: in a merger, acquisition or similar transaction, with prior notice and continued protection of your data.
- With your consent: for any other purpose you explicitly agree to.
6. Data Security
- Encryption in transit: all traffic uses TLS / HTTPS.
- Secure storage: passwords are hashed; provider API keys are kept server-side only.
- Access control: least-privilege access to production systems.
- Uploaded frames are stored under random, unguessable file names.
If a security incident affects your rights, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of it, where required by law. Please keep your credentials safe and do not share them. No Internet service can guarantee absolute security.
7. Data Retention
| Data | Retention period | Then |
|---|---|---|
| Account information | While your account is open; 90 days after deletion | Deleted or anonymized |
| Composited source frames and generation records | Until you delete the video or your account | Deleted within 30 days |
| Generated video files | Hosted by fal.ai under its retention rules; the link is removed from your account when you delete the video | Deleted per provider policy |
| Transaction and credit records | 7 years (tax and accounting obligations) | Deleted |
| Support emails | 2 years | Securely deleted |
| Content reports and enforcement records | 2 years after the case is closed, longer if needed for a legal claim or a request from authorities | Securely deleted |
| Session and security logs | 12 months | Securely deleted |
8. Your Rights
To exercise any of these rights, email [email protected] from your account email. We respond within 30 calendar days.
| Right | What it means |
|---|---|
| Information | Know what data we collect and how we use it |
| Access | Get a copy of your personal data |
| Rectification | Correct inaccurate or incomplete data |
| Erasure | Ask us to delete your data, subject to legal retention duties |
| Restriction | Ask us to pause processing in certain cases |
| Portability | Receive your data in a machine-readable format |
| Objection | Object to processing based on legitimate interests |
| Withdraw consent | Withdraw any consent you have given, at any time |
You can also delete individual videos at any time from My videos. If you believe we have not handled your data properly, you may complain to your local data protection authority.
9. Marketing Communications
We do not currently send marketing emails. If we do in the future, we will only do so with your consent, every message will include an unsubscribe link, and you will be able to opt out in your account or by contacting us. Opting out does not affect essential service notices such as receipts and security alerts.
10. International Data Transfers
Our providers operate globally, including in the United States and the European Union, so your data may be processed outside your country. Where data leaves the EEA, UK or Switzerland, we rely on safeguards such as the European Commission’s Standard Contractual Clauses (SCCs) in our providers’ data-processing agreements, or adequacy decisions.
11. Children
The Service is intended for users aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, contact [email protected] and we will delete it promptly.
12. Third-Party Links & Services
The Service may link to or integrate third-party services, such as the checkout page of our payment processor. This Policy covers only data we collect directly; please review the privacy policies of those third parties.
13. Changes to This Policy
We will notify you of material changes at least 15 days in advance by email or an on-site notice and update the "Last updated" date above. Continued use after the effective date means you accept the updated Policy.
14. Contact Us
- Privacy requests: [email protected]
- Customer support: [email protected]
- Controller: HESONGTING
- Support hours: Monday–Friday, 09:00–18:00 (UTC+8)
See also our Terms of Service and Refund Policy.