Privacy Policy

Version 2026-10-22 · Effective: [PENDING: launch date]

Draft. Items marked [PENDING] must be completed, and the whole text reviewed by a lawyer, before Orange Falco opens to the public.

1. Who is responsible for your data

The controller is [PENDING: legal name], [PENDING: address]. Contact for anything about your data: [PENDING: email].

2. What we collect and why

Data	Why	Legal basis (EU/UK)
User name and password. The password is stored only as a scrypt hash, never as text.	Create and protect your account.	Contract
Date you created the account and accepted the Terms; failed sign-in count and temporary lock.	Run the account, prove acceptance, stop password guessing.	Contract; legitimate interest (security)
Session cookie. We keep only a hash of it.	Keep you signed in.	Contract
What you upload and write (scripts, prompts, pictures, video, sound), the projects and results you make.	Do the work you ask for and keep it for you.	Contract
Technical data of requests: IP address, browser, time, page, and country and network reported by our security provider.	Keep Orange Falco working and safe, limit abuse (for example too many new accounts from one place) and keep evidence of attacks.	Legitimate interest (security)

We do not sell your data, do not share it for advertising, and do not use your content to train AI models.

3. Who else handles it

Hosting: [PENDING: hosting company and server location — Hetzner, EU proposed] stores and runs Orange Falco.
Network and security: Cloudflare carries traffic to Orange Falco and blocks attacks; it sees technical data such as your IP address.
Free graphics-card computing: when you use “Make a video for free”, your starting picture and what you wrote are sent to a public Hugging Face Space that runs the open Wan 2.2 model (Hugging Face, Inc., USA; the Space is run by an independent developer), and the video comes back to Orange Falco. Do not use pictures of people without their permission. If you add your own Hugging Face token, it is sent with that request only and Orange Falco does not keep it.
Rented graphics cards: other generation may run on a rented graphics card [PENDING: provider name].
Tools you connect yourself (for example fal.ai or Dreamina): when you use them, the content you send goes to that company under its own privacy policy.

Some of these companies are in the United States. When data leaves the European Economic Area we rely on the safeguards the law allows, such as the EU–US Data Privacy Framework or Standard Contractual Clauses [PENDING: confirm per provider].

4. How long we keep it

Account and content: while your account exists. When you delete content or your account, we delete it, and backup copies disappear within [PENDING: backup period].
Security records: [PENDING: retention period — 90 days proposed, longer only for evidence of a specific attack].

5. Your rights

On your account page you can download all your data in one file or delete your account and everything in it, at any time. You can also ask to see or correct your data, or to object to or limit its use. Write to [PENDING: email]; we answer within the time the law sets. In the EU/UK you can also complain to your data protection authority.

California residents: we do not sell or share personal information as those words are defined in California law. You will not be treated differently for using your privacy rights.

6. Do Not Track and tracking across sites

Orange Falco does not track you across other websites and does not let other companies do so through Orange Falco, so it treats every visit the same whether or not your browser sends a Do Not Track signal.

7. Cookies

We use only the cookies needed to keep you signed in. See the Cookie Policy.

8. Children

Orange Falco is not for children. You must be at least [PENDING: minimum age — 18 proposed]. If we learn that a child has an account, we delete it.

9. Security

We protect data with encrypted connections (HTTPS), hashed passwords and sessions, per-person storage separation, limits on repeated attempts and access only for people who need it. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.

10. Changes

We will post changes here with a new version date, and tell you about important ones before they take effect.