Privacy Policy

Last updated: May 30, 2026

At Hitmakr, we take your privacy seriously. This Privacy Policy explains how we collect, use, store, and protect your information when you use our AI-powered video creation platform. By using Hitmakr, you consent to the data practices described in this policy. This policy applies to all users worldwide and addresses specific rights under GDPR (EU/EEA), CCPA (California), and other applicable privacy regulations.

1.Information We Collect

•Account information: When you create an account, we collect your name, email address, and password (stored securely using industry-standard bcrypt hashing).
•Usage data: We collect information about how you use Hitmakr, including features accessed, videos created, audio files processed, token transactions, and interaction patterns to improve our service.
•Audio content: Audio files you upload are temporarily processed by our AI and are not stored permanently beyond the processing period unless you explicitly save them to your asset library.
•Device and browser information: We collect standard technical data such as browser type, operating system, screen resolution, and IP address for compatibility, performance optimization, and fraud prevention.
•Payment information: Payment processing is handled by Stripe. We store only a tokenized reference to your payment method; we never store full credit card numbers or CVV codes.
•Notification preferences: We store your email notification preferences (video completion, newsletter, promotional) to honor your communication choices.

2.How We Use Information

•To provide and maintain the Hitmakr platform and its features, including video generation, token management, and sharing services.
•To process your audio content and generate visual content using our AI models.
•To manage your account, subscriptions, token balances, and notification preferences.
•To communicate with you about service updates, security alerts, password resets, video completion notifications, and support responses.
•To improve our AI models and platform features through aggregated, anonymized usage analytics.
•To detect and prevent fraud, abuse, and violations of our Terms of Service.
•To comply with legal obligations and respond to lawful requests from public authorities.

3.Data Storage & Security

•Your data is stored on secure, encrypted servers hosted in the United States.
•Audio files uploaded for processing are retained for up to 72 hours after processing completes, then automatically deleted from our processing servers.
•Generated videos stored in your Projects are retained for the duration of your account, or 90 days after account deletion.
•Account data is retained for as long as your account is active. Upon account deletion, personal data is removed within 30 days, with certain anonymized analytics retained for service improvement.
•We implement industry-standard security measures including encryption at rest (AES-256) and in transit (TLS 1.3), regular security audits, access controls, and automated vulnerability scanning.
•Password reset tokens are time-limited (1 hour) and single-use, and are securely stored with automatic expiration.

4.Third-Party Services

•We use third-party services for payment processing (Stripe), email communications (Resend), hosting and storage (Vercel, Vercel Blob, Neon), analytics (Google Analytics when enabled), OAuth (Google), and AI/media generation providers including OpenAI, Kie.ai, Gemini, fal.ai, eachlabs/Pixverse, and Pexels. Each provider processes the data needed to provide its service.
•We do not sell, trade, or otherwise transfer your personal information to third parties for marketing or advertising purposes.
•Third-party service providers are contractually obligated to protect your data and may only use it for the services they provide to us.
•In the event of a merger, acquisition, or asset sale, user data may be transferred as part of the transaction, with at least 30 days advance notice provided via email.

5.Cookies & Tracking

•We use essential cookies to maintain your login session and remember your preferences (e.g., authentication tokens stored in localStorage).
•We do not use third-party advertising trackers or sell data to ad networks.
•Analytics data is collected in aggregate form and does not include personally identifiable information.
•You can control cookie settings through your browser preferences. Disabling essential cookies may prevent the platform from functioning correctly.

6.Your Rights (GDPR)

•Access: You can request a copy of all personal data we hold about you at any time through your account settings or by contacting support.
•Rectification: You can update your account information at any time through your profile settings.
•Erasure ("Right to be Forgotten"): You can request complete deletion of your account and associated data. This process is completed within 30 days.
•Portability: You can export your generated videos and account data in standard formats by contacting support.
•Restriction: You can request that we restrict the processing of your personal data under certain circumstances.
•Objection: You have the right to object to processing of your personal data for direct marketing purposes or based on legitimate interests.
•Automated Decision-Making: Our AI generates video content based on your inputs. You have the right to request human review of any automated decisions that significantly affect you.
•For EU/EEA users, our legal bases for processing are: contract performance (account services), consent (marketing emails), and legitimate interests (security, fraud prevention, service improvement).

7.Your Rights (CCPA/CPRA - California)

•Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you.
•Right to Delete: You may request deletion of your personal information, subject to certain exceptions permitted by law.
•Right to Opt-Out: We do not sell personal information. If this changes, we will provide a "Do Not Sell My Personal Information" link.
•Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
•Right to Correct: You may request correction of inaccurate personal information.
•To exercise any of these rights, contact us at privacy@hitmakr.ai or use the account settings in your profile.

8.Children's Privacy

•Hitmakr is not directed to children under 13 (or the applicable age of digital consent in your jurisdiction).
•We do not knowingly collect personal information from children under 13.
•If we learn that we have collected personal information from a child under 13, we will promptly delete that information.
•If you believe a child has provided us with personal information, please contact us at privacy@hitmakr.ai.

9.Data Retention

•Active account data: retained while your account is active.
•Token purchase records: retained for 7 years for tax and audit compliance.
•Generated videos: retained while your account is active, deleted within 90 days of account closure.
•Server logs: retained for 90 days for security and debugging purposes.
•Email communication records: retained for 3 years or as required by law.
•You can request earlier deletion of your data by contacting privacy@hitmakr.ai, subject to legal retention requirements.

10.International Data Transfers

•Hitmakr is based in the United States. If you access the platform from outside the US, your data may be transferred to and processed in the US.
•For EU/EEA users, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission for international data transfers.
•By using Hitmakr, you consent to the transfer and processing of your data in the United States and other jurisdictions where our service providers operate.

11.AI Processing & Audio Data

•When you upload audio, our AI models analyze it for tempo, beat patterns, energy levels, mood classification, and structural segments (intro, verse, chorus, etc.). This analysis is performed in real-time and the extracted metadata is used only for your video generation.
•Audio analysis data (tempo maps, mood vectors, beat grids) is ephemeral and deleted immediately after your video is generated. We do not retain audio fingerprints or analysis data for model training.
•When a feature requires it, we may transcribe lyrics or speech, analyze timing, or process vocal alignment to create captions, beat-mapped scenes, lip sync, and relevant visual search terms. We do not use audio for voice identification or biometric identification.
•AI models used by Hitmakr are pre-trained and are not fine-tuned on individual user data. Your audio files are never incorporated into training datasets.
•Generated video content is created by AI and may share visual similarities with content generated for other users who use similar settings. This is inherent to AI generation and does not constitute copying.

12.Marketing Communications

•With your consent, we may send you marketing emails about new features, promotions, and product updates. You can opt out at any time via the unsubscribe link in any marketing email or through your notification preferences in profile settings.
•Transactional emails (password resets, video completion notifications, security alerts, billing receipts) are not marketing and cannot be opted out of while your account is active.
•We do not share your email address with third parties for their marketing purposes.
•Push notifications (if enabled) can be managed through your device settings or browser notification preferences.

13.Do Not Track & Browser Signals

•Hitmakr honors Do Not Track (DNT) browser signals. When we detect a DNT signal, we disable non-essential analytics tracking for that session.
•We support the Global Privacy Control (GPC) signal as an opt-out of any future data sharing, should our practices change.
•Browser-level cookie controls are respected. If you block cookies, certain platform features (authentication, preferences) may not function correctly.

14.Data Breach Notification

•In the event of a data breach that affects your personal information, we will notify affected users via email within 72 hours of becoming aware of the breach, as required by GDPR and applicable state laws.
•Breach notifications will include: a description of the nature of the breach, the categories and approximate number of records affected, the likely consequences, and the measures we have taken or propose to take to address the breach.
•We will also notify the relevant supervisory authority (for EU/EEA users) and the appropriate state attorney general (for US users) as required by applicable law.
•We maintain an incident response plan that is tested annually. Our security team monitors for unauthorized access 24/7 using automated detection systems.

15.Changes to This Policy

•We may update this Privacy Policy from time to time. Material changes (those that affect your rights or how we process your data) will be communicated via email at least 30 days before taking effect.
•Non-material changes (clarifications, formatting, contact information updates) may be made without prior notice and will be reflected by updating the "Last updated" date.
•Continued use of Hitmakr after a material change takes effect constitutes acceptance of the updated policy. If you do not agree with the changes, you may delete your account before the effective date.
•Previous versions of this policy are available upon request by contacting privacy@hitmakr.ai.

16.Contact & Data Protection Officer

•For general privacy inquiries: privacy@hitmakr.ai
•For data subject access requests: dsar@hitmakr.ai (include your account email in the subject line "Data Request")
•For DMCA/copyright concerns: dmca@hitmakr.ai
•We aim to respond to all privacy-related inquiries within 10 business days, and to all data subject requests within 30 days as required by GDPR.
•If you are unsatisfied with our response, EU/EEA users have the right to lodge a complaint with their local Data Protection Authority. California residents may contact the California Attorney General's office.

Cookie Preferences

Manage which types of cookies you allow. Essential cookies cannot be disabled as they are required for the platform to function.

Essential

Required

Required for the platform to function. Authentication, security, and session management.

Analytics

Help us understand how you use Hitmakr so we can improve features and performance.

Marketing

Used to show you relevant promotions and measure ad campaign effectiveness.

Preferences

Remember your settings like theme, language, and notification choices.

Cookies We Use

Detailed breakdown of all cookies and local storage entries used by Hitmakr.

This privacy policy is effective as of February 26, 2026 and will remain in effect until modified. Material changes will be communicated via email at least 30 days before taking effect.