Privacy Policy

Last updated: October 15, 2026

This Privacy Policy explains what personal data GoldTwin (https://goldtwin.app) collects, why, and what you can do about it. The data controller is GoldTwin. Contact: @behaltensie on Telegram.

What we collect

Account data: your email address and name. If you sign in with Google, we also receive your Google account ID and profile picture. We never get your Google password.
Your content: videos and photos you upload, descriptions and edits you type, and the images and videos the Service generates for you.
Payment data: payments are handled by Stripe. We receive the amount, date, pack and payment status — not your full card number.
Technical data: IP address, browser type, and logs of actions such as sign-ins and generations. We use them to keep the Service secure, prevent abuse and fix errors.
Emails with us: if you write to us, we keep the conversation to help you.

Cookies

We use one essential cookie to keep you signed in, and a short-lived one to protect Google sign-in. We don't use advertising or tracking cookies, and we don't run third-party analytics. Our pages load fonts from Google Fonts, which means your browser connects to Google's servers.

How we use it

to run the Service: create your account, generate your images and videos, show your history and balance;
to process purchases and refunds;
to send service emails: sign-in links, “your video is ready”, and important account notices (no marketing emails without your consent);
to keep the Service safe: prevent fraud, abuse and violations of our Terms;
to comply with legal obligations, such as tax and accounting rules.

For users in the EU/EEA and UK, our legal bases are: performing our contract with you; our legitimate interest in keeping the Service secure and improving it; your consent where we ask for it; and legal obligations.

Who we share it with

We don't sell your personal data and we don't share it for targeted advertising. We share data only with service providers that help us run GoldTwin, under contracts that protect it:

AI generation providers (Higgsfield for video, OpenAI for images) — receive the images, videos and text needed to create your result;
Stripe — payments;
Google — sign-in, if you choose it;
Resend — delivery of our emails;
hosting and file storage providers — store the Service and your files.

We may also disclose data if the law requires it, to protect people's safety, or as part of a sale or merger of the business (you'd be told). We don't use your content to train our own AI models.

International transfers

Our providers may process data in the United States and other countries. Where data leaves the EU/EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

How long we keep it

Videos you upload are deleted automatically after 30 days.
Your account, AI influencers and generated videos are kept while your account is open. When you ask us to delete your account, we delete them within 30 days.
Payment records are kept as long as tax and accounting laws require.
Security logs are kept for a limited time and then deleted.

Your rights

Depending on where you live, you can ask to access, correct, delete or get a copy of your data, object to or restrict some processing, and withdraw consent at any time. Contact us at @behaltensie on Telegram with the email linked to your account and we'll respond within 30 days. We won't treat you differently for using these rights. If you're in the EU/EEA or UK, you can also complain to your local data protection authority.

California residents: under the CCPA/CPRA you have the right to know what personal information we collect, use and disclose, to delete and correct it, and to opt out of its sale or sharing. We do not sell or share personal information as those terms are defined, and we don't use sensitive personal information to infer characteristics about you. The categories we collect are listed above, from the sources described, for the purposes described.

Children

GoldTwin is for people 18 and older. We don't knowingly collect data from children. If you believe a child has given us personal data, contact us and we'll delete it.

Security

We use encryption in transit (HTTPS), signed session cookies, and access controls to protect your data. No system is perfectly secure, so please keep your email and Google account safe.

Changes

We'll update this policy as the Service changes. If the changes are significant, we'll tell you by email or in the app.