Scope and contact
This policy describes how Hotel Lobby AI handles information when you browse the site, create an account, submit portraits, purchase credits or contact support. For privacy questions or requests, email support@hotellobby.site.
What we collect
Google sign-in provides your account identifier, verified email and display name. We store this information with your credit balance, purchases and generation history. We do not receive your Google password.
If you create an email account, we store your email address and a salted password hash. We never store your password in plain text. Email registration does not require an email verification step. Google and email accounts are separate unless an account-linking feature is introduced; an unverified registration cannot access an existing Google account’s credits or videos.
Your selected photos, lyrics and settings initially stay in your browser. When you submit a generation, the photos upload to private storage and are processed to remove image metadata. Images, lyrics, vocal language, chosen format and generation instructions are sent to our generation provider to generate your duet with Wan 3.0.
Waffo processes payments. We store order references, credit-pack details, payment/refund status and amounts. We do not store card numbers. Waffo may collect payment, billing and tax information under its own terms.
If you contact support or submit a content report, we receive the information you choose to send, such as your email address, account or task reference and explanation of the issue. Send only what is needed to investigate. Do not email passwords, payment-card details, identity documents or prohibited media.
How and why we use information
We use account and generation information to provide the service you request, manage credits, deliver private videos and handle support. Payment records support billing, refunds and required recordkeeping. Limited usage and security information helps us understand broad site activity, prevent abuse and protect accounts.
Where applicable law requires a legal basis, account and purchased service processing relies on performance of our agreement with you; necessary security and limited usage measurement rely on legitimate interests; legally required records rely on legal obligations. Where consent is required for a particular use, you may withdraw it by contacting us, without affecting earlier lawful processing. You must have permission from every adult whose portrait you submit.
AI generation and content safety
Portraits are used as generation references. The site does not offer a facial-recognition database or biometric identity-verification service. We do not use private uploads or outputs to train our own AI models, and we do not publish them as examples without separate permission. The generation provider’s published terms state that API data is not used to train AI models. Provider processing and retention follow its privacy policy and applicable agreements. Our storage-deletion schedule covers our storage and does not establish zero retention by the generation or underlying model providers.
Requests include the generation provider’s NSFW-check setting. The provider receives the input photos and generation instructions and may reject a task for safety reasons. If you report harmful content or an unauthorized likeness, relevant task details and information you send may be used to investigate and respond under our Content policy. We do not guarantee that every upload or output receives human review.
Storage and retention
Free booth previews send your two sanitized portraits and fixed scene instructions to APIMart’s GPT Image 2 image model. Preview images are private, available for 7 days and normally removed within 8 days. We retain account preview counters to enforce the free allowance; deleting or expiring an image does not reset it.
Your current photos, lyrics and settings are temporarily saved for sign-in, checkout and page-language changes. Ordinary visits and reloads start a new session. A draft expires after 24 hours and can be removed by clearing this site’s browser data.
Source uploads are scheduled for removal after 24 hours, ordinarily within 48 hours because cleanup runs daily. Sources needed for a pending or uncertain submission may remain until its status is resolved. Generated videos are accessible for 30 days and ordinarily removed within 31 days. Service interruptions can delay cleanup; we monitor and retry failed removals.
Use Delete in My Videos to remove a completed or failed take, its source files and saved custom lyrics from our storage. A download link already issued can remain valid for up to one hour unless the underlying object is deleted. Deletion from our storage does not recall a copy you downloaded, shared or already sent to the generation provider. The generation provider processes and retains data under its own policies.
Account, payment and credit records remain for service operation, dispute handling and applicable recordkeeping requirements. Request account deletion through support. We retain only records still needed for those purposes after a verified deletion request, subject to applicable law.
Support and abuse-report correspondence is kept only as needed to resolve the issue, handle related disputes, prevent repeated abuse or meet a legal requirement. Necessary evidence may need to be retained beyond ordinary media-deletion periods. Retention depends on the type of record, an unresolved request or dispute, and applicable legal obligations; contact us for information about a specific record.
Providers and international processing
Our service uses Google for optional Google sign-in, Neon for account records, Cloudflare R2 for private files, an AI generation provider running Wan 3.0for video generation, Waffo for payments, Google Analytics for website statistics and Vercel for hosting. These providers may process information in countries other than yours. We do not sell portrait photos or make uploaded portraits or generated user videos public.
We may disclose limited information where required by law or necessary to address fraud, abuse, a rights complaint or a security incident. Access is limited to information relevant to the purpose. Cross-border processing must follow applicable data-protection requirements; you can contact us about the locations and transfer arrangements relevant to your information.
Cookies and analytics
Authentication uses essential session cookies. Local browser storage preserves your draft and a traffic-source category. Our own event records contain page paths, broad sources such as ChatGPT or Google, and interactions such as generation and checkout. These internal records exclude photos, lyrics, full referring URLs and search query strings and are cleaned up after 90 days. Security rate limits use short-lived identifiers. Hosting and provider logs may include request information such as IP addresses.
We also use Google Analytics 4. Google Analytics may use cookies and receive online identifiers, device and browser information, page views, page URLs and referring URLs. Its data handling follows our Analytics account settings and Google’s policies; our internal 90-day cleanup does not delete Google Analytics records. We do not intentionally send portrait files, lyrics, passwords or payment-card details as Analytics events. Learn how Google uses information from sites that use its services.
You can manage cookies and local storage through your browser’s privacy settings, although blocking essential storage can affect sign-in and draft restoration. Contact us with objections or questions about statistics collection. Cookie and analytics choices are subject to the requirements of applicable law.
Your choices
Upload only adult people’s photos with their permission. You can browse public content without signing in, delete your finished work, and request access, correction or deletion of your account data. Contact supportto exercise these choices.
Depending on applicable law, you may also request a portable copy of your data, restrict processing, object to processing based on legitimate interests, or withdraw consent where processing relies on consent. You may raise a complaint with the data-protection authority responsible for your location. We may verify a request using limited information and respond within the time limits required by applicable law. An account is not required to report misuse of your likeness.
Children’s information
The generator is for users aged 18 or older and prohibits children’s portraits. If you believe a child’s information has been submitted, contact us with the relevant reference so we can investigate and take appropriate action. Do not send copies of illegal or exploitative material.
Policy changes
Updates are published on this page with a revision date. We will provide any additional notice or obtain consent for a new use when required by applicable law.