Privacy Policy

Last updated: June 23, 2026

This Privacy Policy explains how CharaSync ("CharaSync", "we", "us", or "our") collects, uses, shares, and protects personal data when you visit charasync.com (the "Site") or use our character-consistent AI image and video generation services (together, the "Service").

CharaSync is the data controller for the personal data described in this Policy. If you do not agree with this Policy, please do not use the Service.

1. Summary

CharaSync lets you generate images and videos in which the same character or object stays consistent across scenes. To do this, we process your account information, your prompts, any reference images or videos you upload, and the resulting outputs. Your prompts and the reference media you upload are transmitted to third-party AI providers (including providers located outside your country) so that the generation can be performed. Please read Section 5 carefully before uploading images of real people.

2. Information We Collect

2.1 Information you provide

• Account data: your name, email address, and password (stored only as a salted hash). If you sign in with Google, we receive your name, email address, and profile identifier from Google.
• Generation content ("User Content"): the text prompts you enter, the reference images and videos you upload to your asset library, motion descriptions and scripts, and the images and videos generated for you.
• Billing data: your subscription plan, credit balance, transaction history, and invoice identifiers. Payments are processed by Creem, acting as Merchant of Record, which collects your payment card details directly on its own checkout page. CharaSync never sees or stores your full card details.
• Support and communications: messages you send us through our contact form, support chat, or email, and your newsletter preferences.

2.2 Information collected automatically

• Usage data: pages viewed, features used, generations created, and timestamps.
• Device and connection data: IP address, browser type, operating system, language, and similar technical information.
• Cookies and similar technologies: as described in our Cookie Policy.

We do not intentionally collect special category data, and we ask that you do not submit it except as inherently contained in reference images you are lawfully entitled to use (see Section 5).

3. How We Use Your Information

We use personal data to:

• create and administer your account and authenticate you;
• operate the Service, including processing your prompts and reference media to generate images and videos;
• manage credits, subscriptions, billing, and invoices;
• provide customer support and respond to your requests;
• send service emails (verification, password reset, billing, security) and, where you have opted in or as permitted by law, newsletters and product updates;
• protect the Service, prevent fraud and abuse, enforce our Terms of Service, and maintain security;
• comply with legal obligations and respond to lawful requests; and
• analyze and improve the Service.

4. Legal Bases (EEA/UK Users)

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (to provide the Service you request); legitimate interests (to secure, maintain, and improve the Service and prevent abuse); consent (for optional cookies and marketing, which you may withdraw at any time); and legal obligation (for tax, accounting, and compliance).

5. AI Processing and Your Reference Media — Please Read

To generate your images and videos, your prompts and any reference images or videos you upload are transmitted to and processed by our AI processing provider, apimart, which routes requests to the underlying model providers that perform the generation. As of the date above these underlying providers include OpenAI (GPT Image 2) for images and ByteDance / Doubao (Seedance 2.0) for video; the specific providers may change over time.

This means:

• Your User Content leaves our systems and is processed by these third parties under their own terms and privacy policies, and may be processed on servers located in other countries, including the United States and China.
• If you upload images that contain a real person's face or likeness, that data will be processed by these providers. You must have the legal right and all necessary consents to upload and process any such image (see our Terms of Service). Do not upload images of other people without their consent, and do not use the Service to create deceptive, impersonating, or non-consensual content.

We transmit only what is necessary to perform the generation you request.

6. How We Share Information

We do not sell your personal data. We share it only with the following categories of recipients, acting as our processors or independent service providers:

• AI processing: apimart and the underlying model providers (currently OpenAI and ByteDance/Doubao), to generate your outputs (Section 5).
• Hosting and storage: Cloudflare (application hosting and content delivery) and Cloudflare R2 (or an S3-compatible store) where your uploads and generated outputs are stored. Generated media may be served from publicly accessible URLs; anyone with the URL may be able to view that file.
• Payments: Creem, acting as Merchant of Record to process payments and subscriptions. The checkout relationship is between you and Creem; see Creem's own privacy policy for how it handles payment data.
• Email and newsletter: Resend, to send service and marketing emails.
• Security and anti-abuse: Cloudflare Turnstile, where bot protection is enabled.
• Customer support: Crisp, where the support chat is enabled.
• Internal operations: automated operational notifications (e.g., to Discord) that alert our team to events such as new sign-ups or payments.
• Legal and corporate: authorities, regulators, or advisors where required by law, and a successor entity in connection with a merger, acquisition, or sale of assets.

7. International Transfers

We and our service providers may process your personal data in countries other than your own, including the United States and China. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. By using the Service, you understand that your User Content will be transferred to the AI providers described in Section 5.

8. Data Retention

We retain account and billing data for as long as your account is active and as needed to comply with legal, tax, and accounting obligations. We retain your generations (prompts, parameters, and outputs) until you delete them or close your account. You can delete individual generations at any time, and you can delete your account from your account settings, after which we will delete or anonymize your personal data within a reasonable period, except where retention is required by law. Note that copies of User Content transmitted to third-party AI providers are subject to their retention practices.

9. Security

We use technical and organizational measures designed to protect personal data, including encryption in transit, hashed passwords, access controls, and CAPTCHA protection. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Your Rights

Depending on where you live, you may have the right to access, correct, delete, or port your personal data, to restrict or object to certain processing, and to withdraw consent. Many of these actions can be performed directly in your account settings. To make any other request, contact us using the details in Section 14. You also have the right to lodge a complaint with your local data protection authority.

California residents have the right to know, delete, and correct personal information, and to opt out of "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined under California law.

11. Cookies

We use cookies and similar technologies as described in our Cookie Policy.

12. Children's Privacy

The Service is not directed to, and may not be used by, anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the "Last updated" date above. Material changes will be communicated through the Service or by email where appropriate.

14. Contact Us

If you have questions or requests regarding this Privacy Policy or your personal data, contact us at [email protected] or through our contact page.

Data controller: CharaSync. You can reach us at [email protected] or through our contact page.