FRAMEVIVA
Privacy Policy
How photos, orders and service providers are handled.
Version 2026-10-16.2 · Last Updated: October 16, 2026 · Effective: October 16, 2026.
1. Data controller and current scope
Frameviva is operated by LIU DONGBAO, an individual operating in China, at https://frameviva.com/. LIU DONGBAO is the data controller for Frameviva’s collection and use of personal information. Contact delivery@frameviva.com for privacy and security requests.
This policy distinguishes the public information website, the separate restricted synthetic technical preview and the planned paid service. Public uploads, purchases and live AI generation remain closed. The private preview has independent Cloudflare resources and does not send photos to APIMart. We do not offer accounts, passwords, subscriptions or marketing sign-ups.
2. Information processed
- Visits: Cloudflare processes IP addresses, request times, browser/device and network information and necessary security, error and operational logs to deliver and protect pages. This is different from an advertising profile.
- Submitted orders, when enabled: two uploaded photos, permission confirmation and its time/version, email address, template, order reference, price/amount/currency and payment status, generation task identifiers and states, generated video, expiry and deletion status, and necessary delivery and security records. The restricted preview accepts synthetic images and test orders only.
- Support and refunds: your email address, message, order reference, issue description, content-safety reports, relevant supporting information, review decisions, correspondence and necessary review/refund records. Do not include full card numbers or CVV codes.
Photos stay in your browser until submission. In the implemented test flow, images are decoded and re-encoded to remove metadata before upload. That does not remove visible personal information from an image.
3. Purposes and applicable legal bases
Where applicable law requires a legal basis, necessary order, generation, payment and delivery processing relies on performance of a contract or steps requested before it. Support relies on that basis and/or legitimate interests in responding to requests. Website operation, necessary service notices, abuse prevention and security rely on legitimate interests in providing and protecting the service. Legally required tax, accounting and regulatory records rely on legal obligations. Where consent is required for photo/likeness processing or a new purpose, we obtain it before processing; authorization from both adults is required. These bases apply only where permitted by the law relevant to the processing.
4. Cookies and analytics
Our website code loads no Google Analytics, advertising pixels or marketing cookies. The restricted preview uses an eight-hour signed Secure, HttpOnly, SameSite cookie for access; this is not a registered user account. Its browser storage retains private order-recovery information until replaced or cleared; clear site storage on a shared device. No cookie-consent center or marketing preference account is offered. Necessary hosting/security processing is separate from analytics. We have not enabled a site analytics service for these public review pages. Hosting security and operational processing still apply.
5. Providers and data flows
- Cloudflare: hosts/protects public pages. In the restricted technical preview, a private R2 bucket holds synthetic photos and test videos, and D1 holds order, task, consent, delivery and safety records. These are Frameviva-managed records; Cloudflare also processes its own operational data. See Cloudflare’s Privacy Policy.
- APIMart / Seedance 2.0 Fast Face: the two internal tests and fixed integration use the underlying Seedance 2.0 Fast Face video model (API identifier
seedance-2.0-fast-face) through APIMart. This process is intended to synthesize real adults’ likenesses into fictional dance or performance actions, not record an actual event. The model disclosure names the observed model; it is not a claim of payment-provider approval or that all upstream processing entities or retention arrangements are verified. Public live generation is disabled and the Mock preview uses no AI model. The intended future flow would involve APIMart and the upstream model service receiving authorized photos or photo URLs and the necessary template request, returning a task and video. The previously tested official upload route produces publicly accessible image URLs described as valid for 72 hours. A URL expiring does not establish deletion of all stored copies. The restricted Mock preview sends no photos there. See APIMart’s Privacy Policy and Terms. - Waffo Pancake: intended to process one-time payments. It handles payment-card data under its own policies; Frameviva does not receive or save complete card numbers or CVV codes. Necessary order references, amounts, status and checkout information support confirmation, refunds and records. Real checkout is closed. See Waffo’s Privacy Policy.
- Resend: sends transaction notifications to the order email, receiving necessary order details and a private download link, without a video attachment. It has been used for explicitly authorized technical test recipients; its processing is real even when the video and payment are simulated. Frameviva delivery replies are routed through Cloudflare Email Routing to the operator’s Tencent QQ Mail support inbox, which receives sender information and message contents. See Tencent’s privacy information. See Resend’s Privacy Policy.
We do not sell personal information or share it for targeted advertising. We disclose information where legally required or where necessary to protect rights and service security, limited to the circumstances and applicable law. Provider policies do not replace Frameviva’s responsibilities.
6. Retention and deletion
- Frameviva media in the implemented test system: source images are scheduled for deletion 24 hours after video completion; unpaid uploads expire after 24 hours. The download window and generated video expire seven days after completion. Cleanup runs periodically, so physical deletion depends on the Worker and scheduled cleanup operating successfully. These are Frameviva storage limits, not APIMart promises.
- Earlier deletion: the private order page can revoke access and request removal of its media. Revocation and storage cleanup are separate steps. Deleting media does not refund an order or erase necessary records.
- Orders and necessary financial records: retained for up to seven years where needed for tax, accounting, fraud prevention or legal compliance, subject to applicable mandatory obligations.
- Support, refund and content-safety correspondence: up to 24 months after the last interaction, unless continued retention is legally required. Records are deleted or anonymized at the end of their applicable period. Record cleanup needs operator follow-through; the current scheduled media cleanup does not automatically erase D1 order records or support emails.
- Frameviva rate limits: salted, hashed IP/action counters expire after two hours and are removed by periodic cleanup. This does not set the retention of Cloudflare request/security logs.
Exact retention for Cloudflare operational logs/backups, Resend delivery records and APIMart/upstream photos, outputs and logs has not been fully verified. APIMart’s full upstream deletion coverage and training restrictions are also unverified. We cannot promise all upstream copies are erased on our schedule or that all upstream models refrain from training. Public real-person uploads and live generation remain closed pending resolution; a successful R2 deletion alone is not proof of third-party deletion.
7. International processing
The operator is in China. Cloudflare uses global infrastructure; the verified Frameviva Resend domain uses North Virginia, United States. APIMart and its upstream providers may process outside your country; their full processing locations and applicable transfer arrangements remain unverified. Implemented technical protections include HTTPS, private media storage and restricted access. These do not by themselves establish a lawful cross-border transfer mechanism. We do not claim that specific SCCs, BCRs or other transfer agreements have been signed for this service. Applicable transfer requirements must be resolved before public live processing.
8. Security and incidents
The implemented preview uses HTTPS, private R2 storage, hashed access tokens, expiring order/download access, signed preview sessions and request limits. Anyone with a valid private capability link may access its order; keep it confidential. No system is risk-free. Report a suspected incident to delivery@frameviva.com. We will assess it and notify affected people and regulators as required by applicable law. We do not claim ISO 27001, SOC 2 certification or a universal 72-hour notification commitment.
9. Your rights and requests
Depending on applicable law, you may have rights to be informed, access/copy, correct, delete, restrict processing, obtain portable data, object and withdraw consent. Withdrawal does not invalidate prior lawful processing. Email delivery@frameviva.com; we may request the minimum information necessary to verify identity and locate the records. Requests are handled within applicable legal deadlines, with any lawful exceptions or required explanation. Necessary financial/legal records may have to be retained. We can handle our records and seek provider assistance, but cannot certify unverified upstream deletion. You may complain to a competent data protection authority.
10. Adults only and communications
Users and both depicted people must be 18 or older. We do not knowingly accept children’s photos or information. Contact us if you believe a child’s information has been submitted so we can investigate and remove it where appropriate. The consent checkbox is not an automated age-verification system.
We do not send marketing campaigns or operate a newsletter. Order, support, safety and required policy notices are service communications.
11. Updates and contact
We publish revisions here with the version, effective date and Last Updated date. We announce material changes on the website before they take effect and provide additional notice or seek consent when applicable law requires. Provider links explain those services’ practices; this policy remains the description of Frameviva’s processing. Privacy, support and security contact: delivery@frameviva.com.
Related policies: Terms of Service · Privacy Policy · Refund Policy · Contact.