1. Who controls the data
The Hong Kong operator of the RexVid service, identified in the applicable checkout record or receipt, controls the account and service data described in this policy. Privacy, access, and correction requests can be sent to support@airexvid.com with the subject “Privacy request.” Identity verification may be required before account data is disclosed or changed.
2. Data we handle
RexVid may handle Google account identifiers, name and email, preferences, prompts, private uploads, generated media and metadata, credit ledger and order records, API-key metadata and hashes, support communications, security events, request logs, and device and network information. Complete API secrets are shown once and are not stored in readable form. Account, payment, prompt, and upload data are provided voluntarily, but required fields must be supplied to create an account, buy credits, or perform the requested generation; without them, the relevant feature cannot be provided.
3. Why and on what basis we use it
Data is used to perform the requested service and contract, authenticate accounts, preserve preferences and drafts, quote and reconcile credits, process payments, protect private files, answer support requests, investigate errors and abuse, meet legal duties, and maintain auditability. RexVid does not sell personal data and does not currently use it for direct marketing. If direct marketing is introduced, the required notice and informed consent or opt-out process will be provided first. Where relevant outside Hong Kong, processing may rely on contract, legitimate interests, legal obligations, or consent; withdrawing consent does not affect earlier lawful processing.
4. Third-party model processing
RexVid transmits prompts, required settings, and permitted reference media to enabled third-party model providers so they can perform inference and return results. Provider handling is governed by the applicable service configuration, contract, and privacy terms. RexVid does not sell creative inputs or claim that every provider follows identical retention or training practices; material provider-specific differences must be disclosed before the related feature is enabled.
5. Service providers
Google supports sign-in, Stripe processes checkout and may calculate tax when configured, Neon provides Postgres and authentication, Vercel hosts the application and workflows, Cloudflare R2 stores private media, Resend delivers transactional email, and BytePlus or another disclosed model provider processes supported generation requests. These providers receive only the data reasonably required for their service role.
6. Retention and deletion
Generated assets are normally retained for 180 days and then deleted from active object storage. Browser-session drafts remain until consumed, the session ends, or site data is cleared. Account data is retained while the account is active and then only as reasonably needed for deletion handling, security, disputes, or legal duties. Payment, receipt, refund, ledger, and other business transaction records may be retained for at least 7 years where Hong Kong record-keeping law requires. Security and audit records are kept only for their documented integrity, fraud-prevention, or legal purpose. Backups and provider logs may take a limited additional period to cycle out.
7. International processing and security
Infrastructure and model providers may process data outside Hong Kong, including where they or their subprocessors operate. RexVid limits transfers to the service purpose, uses provider terms and access controls, private object storage, scoped credentials, and encryption in transit, and reviews material provider changes. No security measure eliminates every risk. If a material incident affects personal data, RexVid will investigate, contain, document, and notify affected people or authorities when required.
8. Your choices and rights
You may request confirmation, access, or correction of personal data by emailing support@airexvid.com with the subject “Privacy request.” A valid Hong Kong data access request will be handled within 40 days, subject to lawful verification, fees, or exemptions. Depending on location, you may also ask for deletion, restriction, objection, consent withdrawal, or portability, or complain to a regulator. Some ledger, payment, security, and audit records must be retained for legal or integrity reasons, so deletion is not always immediate or complete.
9. Minors, changes, and contact
RexVid is intended for adults and is not directed to children. Do not submit another person’s personal data without authority. Material changes will be dated and communicated where required. Privacy questions and complaints can be sent to support@airexvid.com; you may also contact the Privacy Commissioner for Personal Data in Hong Kong or the regulator available where you live.