Privacy Policy

Babou AI, Inc. ("Babou," "we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how your personal information is collected, used, and disclosed by Babou.

This Privacy Policy applies to our website at babou.ai, its associated subdomains (collectively, our "Website"), and our application and services (collectively, the "Service"). By accessing or using our Service, you signify that you have read, understood, and agree to our collection, storage, use, and disclosure of your personal information as described in this Privacy Policy and our Terms of Service.

1. Definitions

"Company"

When this policy mentions "Company," "we," "us," or "our," it refers to Babou AI, Inc., 1887 Whitney Mesa Dr #4241, Henderson, NV 89014.

"Customer"

The company, organization, or person that signs up to use the Service.

"Personal Data"

Any information that directly, indirectly, or in connection with other information allows for the identification of a natural person.

"Device"

Any internet-connected device such as a phone, tablet, or computer that can be used to access the Service.

"Cookie"

A small amount of data generated by a website and saved by your web browser, used to identify your browser, provide analytics, and remember information such as your language preference or login information.

2. Information We Collect

2.1 Information You Provide

We collect information from you when you register on our site, subscribe to a plan, or fill out a form. This may include:

• Name or username
• Email address
• Company name

In enterprise or billing flows, we may also collect additional information such as billing address or job title.

2.2 Payment Information

Payment processing is handled by our third-party payment processor, Stripe. Babou does not directly collect or store your credit card, debit card, or bank account numbers. Stripe's collection and use of your payment information is governed by the Stripe Privacy Policy. We receive billing metadata from Stripe such as the last four digits of your card, card brand, and billing country.

2.3 Automatically Collected Information

We automatically collect usage data when you interact with the Service, including pages visited, browser type, IP address, device information, and referring URLs.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Personalize your experience and respond to your individual needs
• Improve our website and service offerings based on your feedback
• Improve customer service and support
• Process transactions
• Send periodic emails related to your account and the Service
• Monitor and analyze usage patterns for security and performance

4. AI and Content Processing

4.1 What We Process

When you use the Service, we process your inputs (such as prompts, creative direction, brand assets, and uploaded media) and the outputs generated by the Service (such as rendered video, images, and other creative assets). This processing is necessary to provide the Service.

4.2 Third-Party AI Providers

Portions of the Service rely on third-party AI model providers to process your inputs and generate outputs. Your data may be transmitted to these providers solely for the purpose of delivering the Service. We select providers that offer contractual commitments regarding data handling and do not use your data to train their general-purpose models.

4.3 Training and Improvement

By default, Babou may use your inputs and outputs in aggregated and de-identified form to train and improve the models that power the Service. You may opt out of model training at any time through your account settings. Opting out applies going forward; it does not retroactively remove data already used in aggregated training. For details, see Section 3.3 of our Terms of Service.

4.4 Deletion

When you delete content or your account, we remove your identifiable inputs and outputs from active systems within 60 days. De-identified data that has already been incorporated into aggregated training datasets cannot be individually extracted or deleted.

5. How We Share Information

We may share your personal information with trusted third-party service providers who perform functions on our behalf. We do not sell your personal information.

If we are involved in a merger, asset sale, or other business reorganization, we may share or transfer your personal and non-personal information to our successors-in-interest, provided that the acquiring party agrees to adhere to the terms of this Privacy Policy. We may also disclose information (including personal information) to our corporate affiliates, who will treat it in accordance with this Privacy Policy.

We may disclose personal information to government or law enforcement officials or private parties as we believe necessary to respond to claims, legal process (including subpoenas), to protect our rights and interests or those of a third party, the safety of the public or any person, to prevent or stop any illegal or legally actionable activity, or to otherwise comply with applicable court orders, laws, rules, and regulations.

6. Subprocessors and Vendors

We use the following categories of third-party service providers to operate the Service:

• Payment processing: Stripe
• Authentication and database hosting: Supabase
• Error monitoring and session replay: Sentry
• CDN and security: Cloudflare (including Turnstile for bot protection)
• AI model providers: Anthropic, OpenAI
• Email delivery: Resend

Each provider is contractually required to process your data only as necessary to provide their services to us and in accordance with applicable data protection laws.

7. Session Monitoring

We use Sentry to monitor errors and may record session replays to diagnose issues and improve the Service. Session replays capture page interactions (clicks, navigation, and on-screen content) to help us identify and fix bugs. These recordings are stored by Sentry and accessed only for debugging and quality assurance purposes.

8. How We Use Your Email Address

By submitting your email address, you agree to receive transactional emails from us (such as account confirmations, billing receipts, and service notifications). You may also opt in to receive marketing emails. You can unsubscribe from marketing emails at any time by clicking the unsubscribe link included in each email. We do not send unsolicited commercial emails.

9. Data Retention

We retain different categories of data for different periods:

• Account data (name, email, preferences): retained for the duration of your account plus 60 days after deletion.
• Content and AI data (inputs, outputs, uploaded assets): deleted within 60 days of account deletion or content removal.
• Usage and analytics data: retained in identifiable form for up to 24 months, then aggregated or deleted.
• Billing records: retained as required by applicable tax and accounting laws.
• De-identified and aggregated data: may be retained indefinitely.
• Backups: standard backup systems may retain copies for a limited period as part of normal rotation schedules.

10. Data Security

We implement industry-standard security measures to maintain the safety of your personal information, including encryption in transit (TLS) and at rest. Access to personal data is restricted to authorized personnel who need it to operate, develop, or improve the Service. We cannot, however, ensure or warrant the absolute security of any information you transmit to us or guarantee that your information may not be accessed, disclosed, altered, or destroyed by a breach of any of our physical, technical, or managerial safeguards.

11. Cookies and Tracking Technologies

11.1 Essential Cookies

We use cookies that are strictly necessary for the operation of the Service, including authentication and session management cookies. These cookies are required for the Service to function and cannot be disabled.

11.2 Analytics and Performance Cookies

We may use non-essential cookies to understand how visitors interact with our website and to improve performance. You can disable these cookies in your browser settings without affecting core functionality.

11.3 Local Storage and Sessions

We use browser local storage and session storage to maintain application state and preferences. These function similarly to cookies but with enhanced capacity.

11.4 Managing Cookies

You may set your browser to block non-essential cookies. Blocking essential cookies will prevent the Service from functioning properly. Disabling a cookie does not delete it from your browser; you will need to do this yourself from within your browser's settings.

12. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate personal data
• Request deletion of your personal data
• Restrict or object to certain processing of your personal data
• Request portability of your personal data
• Withdraw consent where processing is based on consent

To exercise any of these rights, please contact us through our contact page. We may take reasonable steps to verify your identity before fulfilling your request.

13. European Data Protection (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, this section applies to you.

13.1 Lawful Bases for Processing

We process your personal data on the following legal bases:

• Contract performance: processing necessary to provide the Service you signed up for (account management, content processing, billing).
• Legitimate interests: improving the Service, security monitoring, fraud prevention, and aggregated analytics, where these interests are not overridden by your data protection rights.
• Consent: marketing emails and non-essential cookies, which you can withdraw at any time.
• Legal obligation: retaining billing records and complying with lawful requests from authorities.

13.2 International Transfers

Babou AI, Inc. is based in the United States. When we transfer personal data outside the EEA or UK, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission, or other valid transfer mechanisms under applicable law.

13.3 Data Processing Addendum

Our Data Processing Addendum is automatically incorporated into the Terms of Service and applies where Babou processes personal data on behalf of Customer. Enterprise customers may negotiate a custom DPA by contacting us.

13.4 Your GDPR Rights

In addition to the rights listed in Section 12, EEA and UK residents have the right to lodge a complaint with their local data protection supervisory authority.

14. California Residents (CCPA/CPRA)

The California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA"), provides California residents with specific rights regarding their personal information.

• Right to Know and Access. You may submit a verifiable request for information regarding the categories of personal information we collect, use, or share; the purposes for which it is collected; the categories of sources; and specific pieces of personal information we have collected about you.
• Right to Correct. You may request correction of inaccurate personal information we hold about you.
• Right to Delete. You may submit a verifiable request to delete personal information we have collected about you.
• Right to Opt Out of Sale or Sharing. We do not sell or share (as defined by the CCPA) the personal information of our users for cross-context behavioral advertising.
• Right to Non-Discrimination. We will not discriminate against you for exercising your privacy rights.

If you make a request, we have 45 days to respond (which may be extended by an additional 45 days where reasonably necessary). To exercise any of these rights, please contact us through our contact page.

15. Children's Privacy

The Service is not intended for anyone under the age of 18 (or the age of majority in your jurisdiction). We do not knowingly collect personally identifiable information from anyone under 18. If you are a parent or guardian and you are aware that your child has provided us with Personal Data, please contact us. If we become aware that we have collected Personal Data from anyone under 18 without verification of parental consent, we take steps to remove that information from our servers.

16. Third-Party Services and Links

We may display, include, or make available third-party content or provide links to third-party websites or services. Babou is not responsible for any third-party services, including their accuracy, completeness, or privacy practices.

When you use a link to go from the Service to another website, this Privacy Policy is no longer in effect. Your browsing and interaction on any other website is subject to that website's own rules and policies.

17. Governing Law

This Privacy Policy is governed by the laws of the State of Delaware without regard to its conflict of laws provisions. You consent to the exclusive jurisdiction of the courts in Delaware in connection with any action or dispute arising under or in connection with this Privacy Policy.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Unless otherwise required by law, we will notify you (for example, through our Service) before we make material changes and give you an opportunity to review them before they go into effect. If you continue to use the Service after changes take effect, you will be bound by the updated Privacy Policy. If you do not agree, you can delete your account.

19. Contact Us

For questions about this policy, to exercise your privacy rights, or to request a data processing agreement, please reach us through our contact page.