Website and privacy contact
The official website for Zombie Couple AI is https://zombie.pictures. For privacy questions or requests, contact [email protected]. This policy describes our website and hosted video creator, including the tutorial and payment flow.
What we process, and why
Photos, prompts and films
Selecting a JPG, PNG or WebP photo previews it in your browser. When you click Create, the two uploaded photos and your prompt are sent through our server to Kie.ai as references for generating a new AI video. We use them to carry out your requested scene and deliver the result. We do not automatically publish your uploads or films in a gallery. Upload only adult portraits you have permission to use.
Credits and generation records
We store a randomly assigned wallet ID, a hashed access credential, your credit balance, credit changes, order references and film job records. Job records include status, provider references, timestamps and error information. This lets us associate purchases with the correct browser, prevent duplicate charges and recover interrupted generations.
Payments
Waffo Pancake hosts checkout and processes the payment-card and billing information requested there. Our application does not receive or store full card numbers or card security codes. We receive order and payment status, amounts, currency and refund information needed to issue or adjust credits.
Browser storage and security
An essential, HTTP-only wallet cookie keeps this browser connected to its credits. Its configured lifetime is one year, and you can clear it earlier. Browser storage also remembers the latest film, an unfinished checkout and temporary creator choices. We do not currently install advertising trackers or analytics scripts. Hosting and service providers may process IP addresses, browser information and request logs to deliver and secure the service. Our application uses a hashed IP address for short-lived rate limits.
Support messages
If you email us, we use your email address, message, attachments and relevant order or film references to answer your request and investigate the issue. Do not send card details, API keys or a wallet recovery code. An order or film ID is a better starting point.
Our creator does not require a name, email address, password or social-login account. It does not request device location, camera or microphone access. Information supplied separately to checkout or support is handled as described above.
Why we use this information
Where data protection law requires a legal basis, the following purposes apply to the information needed for each task.
| Purpose and information | Basis where required |
|---|---|
| Create and deliver the requested film using portraits, prompts and job records. | Performing the service contract with you. |
| Confirm an order, maintain credits and handle a requested refund. | Contract performance; legal obligations for required financial records. |
| Answer your support request and resolve delivery problems. | Contract performance and our legitimate interest in resolving issues. |
| Prevent unauthorized access, repeated submissions, fraud and abuse using limited technical records. | Our legitimate interest in keeping the service secure and reliable. |
| Investigate content reports and appeals, enforce content rules and protect affected people using relevant report and job records. | Our legitimate interest in preventing misuse and resolving complaints; legal obligations where applicable. |
| Comply with a legally binding request or applicable recordkeeping obligation. | The relevant legal obligation. |
We do not send promotional mailing campaigns or use advertising pixels on this site. If we introduce an optional use that requires consent, we will explain that use and obtain consent first. Withdrawing consent does not affect processing that was lawful before withdrawal.
We do not use your submitted portraits or prompts to train our own AI models. Generating a film requires processing by Kie.ai and its model providers; this statement does not replace or guarantee their separate data practices.
Security and incident reporting
Our hosted service uses HTTPS. Wallet access credentials are stored as hashes; the wallet cookie is HTTP-only and secure on HTTPS. Films are stored in a private bucket and our application checks wallet ownership before returning a video. Generation and payment keys stay in server-side secrets, outside the public website. These measures reduce risk but cannot eliminate every security threat.
Report suspected misuse or a data incident to [email protected]. If a breach requires notification under applicable law, we will notify the relevant authority and affected people within the required timeframes. Where the GDPR or UK GDPR applies, this includes notifying the authority without undue delay and, where feasible, within 72 hours of awareness of a reportable breach; individuals facing a high risk are notified without undue delay. This is not a promise to notify every visitor of every technical incident.
Content reports, human review and appeals
When you report content or appeal a decision, we process your contact details, report, relevant film or job references, limited supporting evidence, correspondence and decision notes. The site operator uses this information to assess the report, apply our Acceptable Use Policy, restrict or remove content where appropriate, and explain the outcome. Reports are reviewed by a person; technical upload checks are not comprehensive content moderation and we do not currently automatically classify every input or output for safety.
Review may require access to the relevant stored film and available provider records. Access is limited to what is needed for the case. We may ask for proportionate evidence of ownership or authorization, but never request your full card details, API key or wallet recovery code. Do not send suspected CSAM as an attachment. We do not routinely disclose a reporter’s identity to the reported user. Limited information may be shared with Cloudflare, the generation provider or competent authorities when necessary and lawful to handle a report or legal obligation.
Report correspondence and decision notes are handled in our support records, including Gmail. We keep them only as long as reasonably necessary to resolve the case, handle appeals or disputes, prevent repeated misuse, and meet applicable legal obligations. We review continued need when closing a case and delete unnecessary supporting material. A report does not automatically extend the normal 7-day film retention period; an expired film may no longer be available to review. Any preservation required by law is limited to what that obligation requires. These records are not used to train our own AI models or for advertising.
Use [email protected] for a report, appeal or a privacy request about these records. The reporting instructions explain what to include and the review timelines.
How long we keep information
Download it promptly. At expiry, our application blocks access and automated cleanup removes our stored copy. This does not erase a copy you downloaded or shared.
We do not retain a separate portrait file in our film bucket. Reference photos are uploaded to the generation provider; their deletion and any provider-side job records follow that provider’s policies. Deleting our stored film does not delete provider records.
| Record | Current retention and handling |
|---|---|
| Our stored finished video | 7 days after completion; access is blocked at expiry and automated cleanup removes the object. |
| Upload-reference records in our database | Records older than 24 hours are removed by the scheduled cleanup. These records are links and ownership metadata, not a separate copy of the portrait. |
| Application rate-limit counters | Removed after the limit window plus 1 hour, at the next cleanup. Current windows are at most 1 hour, so retention is approximately 2 hours or less, plus cleanup delay. |
| Wallet cookie in your browser | Configured for 365 days, unless removed earlier by you or the browser. This is separate from server record retention. |
| Saved film and checkout references in your browser | Session references expire with the browser session; saved film references remain until replaced or cleared. You can clear browser storage yourself. |
The 7-day film window does not mean that credits, financial records or support messages are deleted after 7 days. We retain wallet and credit records while needed to provide access and reconcile activity. Order, refund and relevant support records may be retained for payment disputes, accounting and applicable legal obligations. The duration depends on those purposes and the requirements that apply; contact us about a specific record.
Your choices and rights
You can remove a selected portrait before creating, choose not to submit it, and download a completed film during its availability window. Closing the browser does not cancel a job already submitted to the provider. Clearing browser data removes your local access but does not itself delete server or provider records. Save your private recovery code before changing browsers if you want to keep access to your credits.
Depending on applicable law, you may have rights to be informed, access, correct or delete your information, obtain a portable copy, restrict or object to processing, and withdraw consent where processing depends on it. Contact [email protected] with your request. We may ask for proportionate proof of ownership and may need to keep records required by law or for unresolved disputes. We respond within the deadline required by applicable law. Where the GDPR or UK GDPR applies, this is normally within one month; we explain any lawful extension within that initial period. Exercising a privacy right will not result in discriminatory treatment. You may also complain to the data protection authority where you live, work or believe an infringement occurred.
This service is intended for adults aged 18 or older. Child portraits and child characters are not permitted in the creator. If a child’s image or information was submitted, contact us so we can investigate and take appropriate action. Material changes will be explained in a dated notice on this website; when required by law, we will provide advance notice or obtain fresh consent. We do not have an email address for every anonymous wallet. If you have contacted support, we may also use that contact channel for a necessary privacy or security notice.