Volver al inicio

Imagine Dance Privacy Policy

How Imagine Dance collects, uses, discloses, and protects your personal information when you use the Seedance AI video platform.

Última actualización: 2026-09-25

Imagine Dance Privacy Policy

Last Updated: September 25, 2026

Imagine Dance ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy ("Policy") explains how we collect, use, store, and share your personal information when you use the Imagine Dance AI video generation platform available at https://imaginedance.io and https://www.imaginedance.io (the "Service"), and the rights available to you.

Please read this Policy carefully before using the Service. By using the Service, you agree to this Policy. We may update this Policy periodically and will notify you of material changes via in-product notice or email to your registered address.

1. Data Controller

The data controller for this Service is:

  • Operating Name: Imagine Dance
  • Primary Website: https://imaginedance.io
  • Privacy Contact Email: privacy@imaginedance.io
  • Support Email: support@imaginedance.io
  • Data Protection Officer (DPO): Not applicable (we do not conduct large-scale processing of sensitive data requiring a DPO under GDPR / UK GDPR)

2. Personal Information We Collect

2.1 Information You Provide Directly

  • Account Info: Name, registered email address, authentication-provider account ID (for social sign-in), and basic account-profile fields you submit. If you use Google sign-in, we also receive your Google profile display name and verified Google email address. Passwords are handled through Better Auth and stored only as secure credential hashes — never in plaintext.
  • Payment Info: Transaction amounts, order IDs, subscription status, credit pack purchase records, and payment status. Full card numbers, CVV, and payment card authentication values are NEVER stored, processed, or seen by our servers. Payment card data is handled exclusively by our PCI-DSS certified payment processor, Waffo Pancake (Pancake / Waffo). Waffo Pancake also processes Stripe and PayPal payment methods on our behalf.
  • User-Generated Creative Content ("Assets"): Text prompts, reference images, reference videos, reference audio files, first-frame / last-frame uploads, generated videos, generated audio, generated images, and any other assets you upload or generate using the Service. These are stored encrypted on our Cloudflare R2 object-storage buckets in your private user prefix.
  • Communications: Emails, in-app support tickets, and feedback you send us.

2.2 Information We Collect Automatically

  • Device & Network: Anonymised IP address (truncated after 72 hours), user agent, device model, operating system, browser type, language / locale setting, and approximate time zone.
  • Usage Data: Pages visited, feature usage (model chosen, resolution, fps, duration, reference mode, Generate button events), activity logs, session duration, navigation paths, and credit consumption events.
  • Analytics Telemetry: Anonymous aggregated session, interaction, and heatmap data collected via Microsoft Clarity (Project ID: ymcfljlxy0) for product-quality and UX-improvement purposes. See Section 4 for details and the Microsoft Clarity opt-out link.
  • Log Data: Request timestamps, server error logs, SSRF / abuse-protection events (see Security section), WebSocket connection events, AI job dispatch / status-poll events, and performance metrics.

2.3 Data We Do NOT Collect

We do not collect plaintext passwords, payment card numbers, CVV codes, phone numbers, physical mailing addresses (billing or shipping), KYC documents, or government-issued ID numbers. The OAuth sign-in flow only accesses the minimum Google OpenID Connect profile scopes (openid profile email).

3. How We Use Your Information

| Purpose | Legal Basis (GDPR / CCPA) | |---|---| | Service delivery, AI job dispatch, generated-content retrieval, and core platform maintenance | Contract performance | | Billing, payment processing, subscription renewal, credit-pack purchase, and order confirmation | Contract performance | | Customer support, ticket triage, and credit-refund investigation | Contract / Legitimate interests | | Essential service notices: billing receipts, security alerts, breach notifications, AI-job completion status, and policy updates | Legitimate interests | | Platform security, abuse detection, SSRF-allowlist enforcement, rate limiting, fraud prevention, and unauthorised-account-use detection | Legitimate interests | | Aggregated product analytics, UX A/B measurement, and quality / reliability improvement | Legitimate interests | | Compliance with legal, tax, card-network, and regulatory obligations | Legal obligation | | Newsletter / marketing communication about new features / promotions (currently NOT sent by default — we only send if you explicitly opt in at a later time) | Your explicit consent |

We may aggregate or anonymise data for internal statistical or reliability purposes. Such data cannot be re-identified or linked back to any individual.

4. Cookies, Local Storage, Session Tokens, and Tracking Technologies

| Type / Mechanism | Purpose | Disableable? | |---|---|---| | Strictly necessary cookies / signed session tokens (Better Auth) | Maintaining your authenticated sign-in session, CSRF protection, account-state sync, core permission checks, and RBAC role enforcement | No (required for login / protected pages) | | Functional — PARAGLIDE_LOCALE cookie | Remembering your chosen UI language (English / Chinese) between visits | Yes | | Functional — LocalStorage keys | Remembering collapsed-sidebars and non-authenticated UI preference state (e.g. sidebar width, model dropdown last selection) | Yes | | Analytics — Microsoft Clarity first-party session / heatmap | Anonymous UX quality measurement, click-heatmaps, dead-click reporting, session-replay (masked, no text or inputs captured) for product improvement | Yes — you can opt out directly via Microsoft Clarity at https://clarity.microsoft.com/insights/optout or by enabling "Do Not Track" in your browser | | Analytics — standard HTTP request logs (server-side only) | Reliability, abuse detection, and error debugging | No |

Analytics tools in use (each linked to its own privacy policy):

  • Microsoft Clarity (heatmap / session-replay): https://privacy.microsoft.com/en-US/privacystatement
  • Cloudflare Workers (request logs / DDoS protection): https://www.cloudflare.com/privacypolicy/
  • Better Auth (session tokens only — no third-party tracking): https://www.better-auth.com/privacy

You can manage general cookie preferences via your browser settings or your OS-level tracker-protection controls.

5. Sharing, Disclosure, and Third-Party Processors

We do NOT sell your personal information, including as defined under the CCPA / CPRA. We never share, rent, license, or broker your personal data to advertisers, data brokers, or ad networks. We share your information only in the following strictly limited circumstances:

  • Authorised Service Providers (data processors bound by confidentiality and DPA terms):
    • Cloudflare, Inc. — Serverless compute (Workers Unbound / Pages Functions), D1 relational database, R2 object storage for user-uploaded assets and AI outputs, Zero Trust bindings, and DDoS / WAF protection. Your data stays in Cloudflare storage with encryption at rest and TLS in transit.
    • Waffo Pancake (Pancake / Waffo Labs) — PCI-DSS certified payment processing, subscription lifecycle management, credit pack billing, invoicing, refund, and dispute handling on our behalf. All payment card data touches only Waffo Pancake's PCI environment — never our servers.
    • Stripe / PayPal (via Waffo Pancake) — Secondary card / wallet payment rails, sub-processors inside the Waffo Pancake billing environment.
    • Kie Labs, Pte. Ltd. (Kie AI) — Third-party AI inference provider that powers our Seedance 2.0 / Seedance 2.0-fast / Seedance 2.5 / future model generations. When you click Generate, we send only the payload needed to create your AI job (prompt, reference-asset R2 URLs, resolution, fps, duration, model ID, aspect ratio, sound toggles) to Kie's api.kie.ai endpoint. We have a data-processing agreement and a strict, pinned SSRF allowlist in place so that only Kie-issued asset callbacks are accepted.
    • Resend, Inc. — Transactional / essential-service email delivery (receipts, passwordless recovery if later enabled, AI-job completion notices, policy updates). Marketing email is not sent and not configured at this time.
  • Legal Requirements: Where required by law, valid court order, or a lawful written regulatory request from a competent authority (e.g. tax authority, data-protection supervisory authority, law enforcement with valid legal process). We will use reasonable efforts to provide you with prior notice of any such demand whenever legally permitted.
  • Business Transactions: In the event of a merger, acquisition, financing round, asset sale, insolvency proceeding, or similar corporate transaction where customer data is transferred as part of the deal, with advance notice posted on the homepage and data-protection terms carried forward.
  • With Your Explicit Prior Consent: For any purpose not already listed above, we will ask for your written or click-through explicit opt-in consent before sharing.

Your creative assets (reference uploads, generated videos, prompt text) are never shared with any of the service providers above except: (a) Kie AI strictly for the lifetime of the single AI job you triggered, and (b) Cloudflare R2 strictly for your own storage and retrieval under your authenticated user prefix. Kie AI does not retain, store, train on, or reuse your uploaded reference assets or generated outputs after job completion + status-poll cache TTL.

6. Data Security

  • Encryption in transit: Full TLS 1.3 on all public endpoints, with HSTS headers pinned via Cloudflare Strict-Transport-Security; all internal service-to-service traffic runs over mTLS / private Cloudflare network only.
  • Encryption at rest: AES-256-GCM for database column-level encrypted fields (admin panel secrets, AI provider credentials stored via the config table encrypted with CONFIG_ENCRYPTION_KEY env var when set); SSE-C + bucket-level encryption on Cloudflare R2; signed time-limited URLs for asset access (never raw long-lived URLs).
  • SSRF protection: A strict pinned allowlist of exactly three domains only is enforced on every outbound-asset URL referenced in /api/ai/generate — private IPs, RFC1918 CIDRs, localhost, and any other third-party origins are rejected with a 400 error before any outbound fetch ever happens.
  • Access controls: Least-privilege RBAC (super_admin / admin / user roles with permission-matrix matching); no production shell access to DB / storage; staff who ever touch production data sign confidentiality agreements.
  • Rate limiting & abuse protection: Minimum-interval rate limiting both per IP and per authenticated user on AI generate, asset upload, payment checkout, invite-code redemption, and AI callback endpoints; regex input sanitisation; strict enum validation on Generate payload fields; magic-number / file-header validation on image uploads (SVG hard-rejected).
  • Security & vulnerability reviews: We run the built-in TRAE security-scan skill (secrets leak, injection, XSS, SSRF, regex-DoS, enum) before every production code push, and we publish a public security.txt via /.well-known/ for researchers.

Breach-notification timeframe: In the event of a confirmed security incident that creates a material risk to your personal-data rights (unauthorised access, loss, exfiltration, or corruption), we will: (a) notify affected users via the registered email within 72 hours of confirmed discovery; (b) notify the relevant competent supervisory authority within the window required by applicable law; and (c) publish a high-level incident summary on https://imaginedance.io with mitigation steps taken.

Please keep your Google account credentials secure and do not share your active authenticated session with any third party.

7. Data Retention

| Data Type | Retention Period | Action Upon Expiry | |---|---|---| | User account row + profile (name, email, OAuth sub) | While account is active; 90 days after you request account deletion or send a written erasure request to privacy@imaginedance.io | Secure hard delete from D1, R2, and all associated logs / tables | | Order / transaction / billing records | Per accounting / tax / card-network regulations, typically 6 full calendar years from the transaction date | Secure archive then hard delete after retention window | | Credit ledger rows (granted / consumed / revoked / expired) | While account is active; 90 days after account closure for audit trail | Hard delete + aggregate anonymise for internal revenue reporting | | AI task / job records + references (prompt text, asset URLs, final output R2 URLs) | While account is active; 90 days after job completion (shorter if you manually delete the output first) | Delete generated output assets from R2; null out prompt text and reference URL columns; keep only the non-PII audit columns (model ID, credits consumed, status, timestamp) for 90 days then aggregate | | R2 bucket assets (reference uploads + generated outputs) | While you retain them, or max 365 days from upload date (whichever comes first) | You can delete via the generated-result × UI button at any time before the 365-day window; otherwise lifecycle rule hard-deletes automatically | | Support tickets + inbound email correspondence | 2 full calendar years after the ticket is marked Closed | Secure hard delete | | Security audit logs, rate-limit logs, SSRF block logs, abuse-detection logs | 12 calendar months from log generation date | Hard delete | | Session cookies / Better Auth session rows | Default: 30 days max, plus sliding extension on activity; 24h idle timeout enforced via session expiry | Automatically invalidated on server + browser cookie cleared |

8. Your Data Rights

GDPR / UK GDPR / CCPA / ePrivacy and similar laws grant you specific rights over your personal data. To exercise any right below, email privacy@imaginedance.io from your registered account email with the subject line Data Rights Request: [RIGHT NAME] — [YOUR EMAIL]. We respond to substantiated requests within 30 calendar days of receipt; complex or voluminous requests may be extended by an additional 60 days, in which case we will notify you of the delay within the first month.

| Right | What it means, in plain English | |---|---| | Right to be informed | The right to a concise, transparent, intelligible copy of exactly what personal data we hold about you and how it is used — which this Policy is intended to satisfy, and which you can also get as a downloadable export on request | | Right of access (DSAR / Subject Access Request) | Obtain a machine-readable copy of all personal information we hold that is attributable to you, including structured copies of your account row, order history, credits ledger, AI task rows, tickets, and asset manifest | | Right to rectification | Ask us to correct inaccurate, incomplete, or out-of-date personal information about you (e.g. fix a typo in display name, update contact email) | | Right to erasure ("Right to be Forgotten") | Request deletion of your personal data in specific circumstances (e.g. processing no longer needed, you withdraw consent where consent was the basis, processing is unlawful). Special categories (tax records, legal-hold data) may legally require us to retain a minimal subset until the statutory retention window lapses; we will tell you exactly what we cannot delete and why. | | Right to restrict processing | Ask us to temporarily suspend active processing of your data in narrow cases (e.g. you contest accuracy, we no longer need it but you want it kept for legal claims) | | Right to data portability | Receive your personal data in a structured, commonly-used, machine-readable format (JSON + CSV package) that you can carry to another service — applied to data you directly provided us or was generated by your activity, where the legal basis was contract or consent | | Right to object | Object to processing that relies on our legitimate interests as its legal basis, for direct marketing, or for processing for the purposes of statistics / scientific historical research | | Right to withdraw consent | Where processing was based on your explicit written / click-through opt-in consent (e.g. if marketing opt-in is offered later), you can withdraw that consent at any time by emailing privacy@imaginedance.io or toggling the option in your Settings / Profile page — withdrawal does not affect the lawfulness of processing already done before withdrawal |

No fee is charged for a first valid request per 12-month window. We may charge a reasonable administrative fee or decline to act on requests that are manifestly unfounded, excessive, repetitive, or made by an unauthorised third party without valid power of attorney.

You may also, at any time, lodge a complaint with your local data-protection supervisory authority if you consider our processing of your personal data does not comply with applicable law.

9. Marketing & Opt-Out

We do NOT currently send unsolicited marketing email, SMS, or push notifications, and no marketing channel is configured in the Service at this time. All messages we send are strictly essential service notices: sign-in confirmations, billing receipts, AI-job completion events, security alerts, policy / legal updates, and support-ticket responses.

If at a later date we offer optional marketing communications about new feature launches, seasonal promotions, or credit pack discounts, every message will include: (a) clear and easy one-click unsubscribe; (b) an account-level marketing toggle in Settings → Profile; and (c) an option to opt out by replying UNSUBSCRIBE to the message or emailing privacy@imaginedance.io. Opting out of marketing never affects essential service notifications (billing, security, account status).

10. International Data Transfers

Imagine Dance is hosted on Cloudflare Workers (global edge-network) and the user-facing UI and database live primarily in Cloudflare's primary regions. When you use the Service from any country, your data may therefore be transferred to, stored in, and processed in jurisdictions outside the country in which you are resident — including but not limited to the United States, Singapore, and the European Economic Area — as part of normal edge-caching, AI inference dispatch, storage, and billing operations.

For cross-border international transfers of personal data originating in the EU / EEA / UK / Switzerland / other jurisdictions with transfer-restriction laws, we safeguard your data through one or more of the following mechanisms as applicable:

  • EU / UK Standard Contractual Clauses (SCCs / IDTA / 2024 UK Addendum): Valid and signed data processing agreements (DPAs) incorporating the latest European Commission-approved SCCs and the UK International Data Transfer Addendum are in place with every named sub-processor above that handles EU-origin personal data (Cloudflare, Waffo Pancake, Kie AI, Resend).
  • Transfer only to adequacy-listed recipients where possible: We prioritise sub-processor facilities in countries / territories with published adequacy decisions under EU / UK law.
  • Supplementary technical safeguards: For every cross-border transfer we enforce at the transport layer: mandatory TLS 1.3, strict TLS cipher-suite allowlists (no legacy CBC / RSA-only suites), payload field-level encryption on high-sensitivity columns, private-link-only internal service-to-service traffic, and zero public-DB exposure.

To request a copy of the relevant DPA / SCC annex for your jurisdiction, email privacy@imaginedance.io.

11. Children's Privacy

The Service is intended for users aged 18 and above. The minimum age in our Terms of Service to create an account or otherwise use Imagine Dance is 18. We do not knowingly collect, solicit, or process personal information from children under the age of 18. No part of the Service is directed at or marketed to children.

If you are a parent, legal guardian, or school / supervising institution and you believe a child under 18 has created an account, uploaded content, or otherwise provided us with personal data, please contact us immediately at privacy@imaginedance.io with the subject line Minor Data Report — [details], and we will promptly investigate, disable the account, and irrevocably delete any personal information and creative assets attributable to that minor from our production systems, backups, and sub-processor caches within a commercially reasonable window.

12. Third-Party Links, Integrations, and Embedded Services

The Service may render links to, or embed integrations with, independent third-party services and websites — for example: links to Cloudflare status, Kie AI documentation, Waffo Pancake billing self-serve, Microsoft Clarity opt-out page, or Google Account settings. These links and integrations are provided solely for your convenience.

This Privacy Policy applies only to data we directly collect from you on Imagine Dance. We do not operate, control, endorse, or make any warranties about the data practices, content accuracy, safety, or legality of any third-party website or service you reach via a link from our platform. We strongly encourage you to review that third party's own privacy policy and terms of service before using it or sharing any personal data with it.

13. Changes to This Privacy Policy

We may update this Policy from time to time to reflect changes in: (a) applicable law, regulation, or supervisory guidance; (b) the products, sub-processors, features, or data flows of the Service; (c) security and encryption standards; or (d) material changes to how we collect or use personal data.

For non-material updates (typographical corrections, formatting, updated contact details, sub-processor address change with no material effect on data flows, added retention clarification that does not reduce your rights), we will update the "Last Updated" date at the top of this page without prior notice.

For material updates (e.g. new purpose of processing, new category of shared data, expansion of sub-processors, reduction of your rights, change of legal basis for an existing processing activity, change to international transfer mechanisms), we will provide at least 15 calendar days' advance notice before the effective date via: (a) a prominent in-app banner announcement; and / or (b) an email to the address registered on your account.

Your continued use of the Service after the effective date of the revised Policy constitutes your acceptance of the changes. If you do not agree with the revised Policy, please stop using the Service and, if you wish, exercise your right to erasure as described in Section 8 above.

14. Contact Us

For any question, concern, subject-access request, breach report, or complaint about privacy or data protection, please contact us using the channels below — we typically respond to non-automated enquiries within 2 business days.

  • Privacy / DPO / Data Rights Email: privacy@imaginedance.io
  • General Support & Platform Help: support@imaginedance.io
  • Security Incident / Vulnerability Disclosure: security@imaginedance.io (PGP key available on request for sensitive submissions)
  • Business Hours: Monday – Friday, 09:00 – 18:00 (UTC+8)
  • Website: https://imaginedance.io | https://www.imaginedance.io

This Privacy Policy is for general reference and is based on the Waffo Pancake Account Reviews privacy template (https://docs.waffo.ai/mor/account-reviews/privacy-policy), with every [placeholder] replaced and every section customised to Imagine Dance's real data flows and sub-processors. It does not constitute legal advice. We strongly recommend having it reviewed by a qualified data-protection or legal professional in your target market if you operate in a highly regulated industry or a jurisdiction with specialised privacy requirements (e.g. HIPAA, PIPL, PIPEDA, LGPD, POPIA, VCDPA, CPA, CTDPA).

Imagine Dance · https://imaginedance.io