Privacy Policy

1. About this policy

This Privacy Policy explains how PopFestive ("we", "us" and "our") handles information when you use https://popfestive.com, create AI Christmas photos or videos, buy credits, manage a subscription, or contact support. It should be read together with our Terms of Service and Refund Policy. Contact us at hello@popfestive.com with privacy questions or requests.

2. Information you provide

• Account details: your email address, name, profile image and account preferences. Email-password accounts use password hashes rather than stored plain-text passwords. If you choose Google sign-in or connect Google to an existing account, we receive the profile information needed to authenticate you, such as your name, email address and profile image, and store the account connection.
• Photos and creation inputs: the images you upload, names or messages you add, Christmas style instructions, selected effect, model, resolution, video length and format. This includes a child’s photo and name for a Santa Nice List certificate, a portrait for a Christmas PFP or other festive photo, a baby reference photo for a reindeer video, and one or two images for Christmas pets.
• Creation records: task identifiers, processing status, generated photos or videos, download references, credit charges and returned credits.
• Orders, subscriptions and gifts: product, amount, currency, payment status, subscription dates and cancellation status; gift links, messages and claims when you use those features. Gift recipients may see the sender name and message you choose to share.
• Support: the messages, order numbers, task IDs and attachments you send when asking for help. Please do not send your password, full payment-card details or API keys.

3. Information collected through site use

We process IP addresses, request timestamps, browser and device information, error and security logs, and activity needed to operate your account and the creation workflow. We also record relevant product events, such as uploads, generation requests, checkout and downloads, to diagnose issues and understand use.

We use PVUV for website measurement. This can involve visited pages, referring pages, campaign parameters, approximate visit location, browser and device signals, interaction data, and pseudonymous visitor or session identifiers. Authentication cookies and browser storage also keep you signed in, remember preferences and retain referral information. Account-related activity may be associated with your account after sign-in. We do not intentionally send uploaded photos or generation prompts to website analytics.

4. Why we use this information

• Provide your account, authenticate you, process uploaded images and instructions, generate Christmas photos and videos, and let you view and download results.
• Operate credits, subscriptions, gifts, payment reconciliation and support; confirm payment notifications and prevent duplicate charges or grants.
• Review inputs and requests for prohibited content, detect automated abuse, protect accounts and investigate generation errors.
• Measure site performance and use, improve reliability, and communicate about your account, purchases or support requests.
• Meet applicable legal, accounting and security obligations and handle legitimate rights requests.

We do not sell your uploaded photos. PopFestive does not use your photos to train its own AI models. Processing by third-party AI providers is described below; this policy does not promise that every provider uses identical retention or data-handling settings.

5. AI processing and service providers

Relevant photos, prompts and settings are sent to APIMart and the model services it uses to produce the requested result and perform required safety or reference-image checks. Where the selected model is unavailable through APIMart, our generation integration may use fal as a backup. Provider processing can include temporary uploads, content review, task records and generated media delivery. Their applicable policies and service terms govern their processing; we do not promise zero retention or immediate deletion by every provider.

For provider information, see APIMart and fal’s Privacy Policy. We also use hosting, database, file-storage and delivery services, including Cloudflare services where configured. Authorized operators and service providers may access relevant information to operate the service, resolve support requests and protect it. Information may be disclosed where required by law or necessary to address fraud, security incidents or unlawful content.

6. Payments, Google sign-in and bot protection

Checkout is provided through Waffo. Waffo and its payment partners process the payment information entered at checkout. PopFestive receives order, payment, subscription and refund-status information needed to manage your purchase; we do not store the full payment-card number or card security code in our application. Google handles the Google authorization flow when you choose that sign-in method.

We use Cloudflare Turnstile on registration and sign-in to distinguish people from automated traffic. Cloudflare processes security signals such as IP address, user-agent information, TLS fingerprint and the site origin for this purpose and to improve its bot detection. See the Cloudflare Turnstile Privacy Addendum and Cloudflare Privacy Policy.

7. Storage, links and retention

We retain account details, uploaded content and creation history for as long as needed to provide the service, manage your account and resolve support or security matters. Payment and credit records may need to be retained longer for accounting, dispute handling or legal obligations. We do not promise permanent media hosting; download results you want to keep.

Uploads and outputs may be delivered through storage or provider-hosted asset URLs. Someone who receives such a link may be able to access the file, so keep it private unless you want to share it. A generation task’s access controls do not make every underlying media URL private. We do not automatically publish your personal uploads or generated results in a public gallery.

Temporary provider uploads can have a different retention period from the copy stored for your account. For example, our APIMart reference-image upload requests select its three-day retention tier; that setting does not establish the lifetime of every provider task, generated output, safety-review asset, account copy or backup.

To request deletion of photos, results or your account, contact hello@popfestive.com or use Settings → Support Tickets. We may ask you to verify account ownership. We will remove data we control that is no longer needed, subject to applicable retention requirements; provider copies, backups and legally required records may follow separate retention processes. Requesting deletion does not automatically cancel an active subscription—use Settings → Billing to stop renewals.

8. Children and photos of other people

PopFestive is not intended for children under 13 to create or operate their own accounts, or below a higher minimum age required where they live. The service does let parents, guardians and authorized users create family keepsakes using a child’s photo and, for a Nice List certificate, a name. Such photos and names are personal information and are processed for the requested creation; they are not treated as anonymous data.

Upload a child’s photo only if you are the parent or guardian or have their permission. Obtain permission before uploading another person’s photo. If a child has registered without the required permission, or someone’s image was uploaded without authorization, contact hello@popfestive.com so we can investigate and address the information or content concerned.

9. Your choices, rights and security

You can review available creation records, download results, update account details and manage billing through your account. Depending on applicable law, you may have rights to access, correct, delete or obtain a copy of personal information, object to certain processing, or withdraw consent where processing relies on it. Contact hello@popfestive.com; we may need to verify your identity and may retain information that the law requires.

Browser controls can limit cookies or local storage, although disabling essential storage or security tools may affect sign-in or other functions. We use authentication, access controls and other reasonable safeguards, but no system or transmission method is completely secure. Our providers may process data in countries other than yours under their applicable arrangements and policies.

10. Updates and contact

This policy was last updated on November 13, 2026. We will update this date when the policy changes and provide additional notice of material changes where required. For questions, requests or unauthorized-image reports, contact PopFestive at hello@popfestive.com or visit https://popfestive.com.