Privacy Policy

This Privacy Policy governs your use of Ozil Goal AI (accessible at ozilgoal-ai.org). We respect your privacy and are committed to protecting your personal information, facial likeness, and generated media through transparent policies, minimal data retention, and strict access controls.

1. Service Overview

Ozil Goal AI is an independent fan-made creative application that transforms a single uploaded portrait photo into a 15-second vertical AI video recreating the iconic 2016 Champions League solo goal.

Photo Preview and Submission: Selecting a photo in the generator creates a local preview in your browser. Submitting a generation job uploads that photo for processing. The data practices described below apply to user authentication, asset upload, and video generation workflows.

2. Information We Collect

We collect only the data necessary to provide, secure, and operate our generation service:

2.1 Account and Identity Data

When you sign in using Google OAuth 2.0, we receive:

• Your verified email address
• Your public display name
• Your unique Google account identifier
• Your profile avatar image URL (for display in your user navigation)

We do not collect or store passwords; all authentication is handled securely through Google.

2.2 Uploaded Photos and Generation Inputs

When you submit a generation task, you provide:

• One source photograph of one adult person (in JPG, PNG, or WebP format, up to 15 MB)
• The Keep My Own Clothes preset, which is the currently supported styling mode
• Output resolution preference (Standard 720p or HD 1080p)

2.3 Generated Media Outputs

• The synthesized 15-second 9:16 vertical video recreation
• Output cover thumbnails and task status markers

2.4 Payment and Transaction Records

Payments are processed directly by our merchant processor, Stripe. We receive:

• Stripe customer IDs and payment intent identifiers
• The purchased credit pack tier, transaction amount (in USD), and timestamp
• Credit ledger additions and debits

Payment Card Security: We do not collect, process, or store credit or debit card numbers, expiration dates, or CVV/CVC security codes on our infrastructure. All card handling takes place entirely on Stripe’s PCI-DSS Level 1 certified servers.

2.5 Technical Logs and Telemetry

• IP addresses (used exclusively for security rate-limiting, geo-routing, and fraud prevention)
• Browser user-agent headers and operating system indicators
• Task processing durations, server error codes, and generation lifecycle timestamps

2.6 Facial Landmark Detection and Biometric Notice

To composite your likeness onto the cinematic animation sequence, our rendering pipeline analyzes facial geometry landmarks (e.g., face orientation, eye line, and bounding box coordinates).

• This processing occurs transiently during inference execution.
• We do not construct persistent biometric identifiers, facial recognition templates, or surveillance profiles.
• We do not identify you across other databases, sell biometric records, or use your facial likeness for commercial advertising without explicit permission.

3. How We Collect Information

We obtain data through three direct channels:

1. Directly from you: When you log in with Google, upload a photo, configure style parameters, or contact support at support@ozilgoal-ai.org.
2. Automatically via platform infrastructure: When your browser requests pages, generating standard server logs, and through essential session storage.
3. From third-party integrations: Verification tokens from Google OAuth and settlement confirmations via Stripe webhooks.

4. How We Use Information

We process your data strictly for legitimate operational purposes:

• Delivering the core service: Synthesizing the 15-second football recreation video from your uploaded photo and chosen parameters.
• Managing your credit ledger: Tracking one-time credit pack balances, video generation debits (100 credits for Standard 720p; 200 credits for HD 1080p), and automatic refunds for failed renders.
• Reviewing quality concerns: Investigating defect reports submitted via My Videos within our 2 business day review window.
• Platform safety and moderation: Scanning inputs through automated content moderation to detect and reject abusive, non-consensual, sexually explicit, or illegal uploads.
• Legal and tax compliance: Maintaining immutable financial records, dispute resolution logs, and anti-fraud monitoring.

Artificial Intelligence Model Training Policy

We do not use your personal uploaded photographs or generated video outputs to train, fine-tune, or improve public foundation AI models. Uploaded assets are routed through private API inference endpoints solely to render your requested video.

5. Legal Basis for Processing (GDPR Article 6)

For individuals located in the European Union (EU), European Economic Area (EEA), or United Kingdom (UK), our legal bases for processing include:

6. Service Providers and Data Processors

We partner with established infrastructure and technology providers:

• Cloudflare, Inc.: Provides edge hosting, Workers serverless compute, Cloudflare D1 distributed SQL database, and Cloudflare R2 object storage.
• Stripe, Inc.: Handles checkout, card authorization, fraud detection, and payment settlements.
• Google LLC: Provides Google OAuth 2.0 user authentication.
• AI Cloud Inference Providers (e.g., Replicate): Provides cloud GPU acceleration to execute image-to-video diffusion tasks.
• Automated Safety Providers: Automated content classification rungs used to flag sexually explicit or harmful imagery prior to rendering.

All service providers are bound by strict confidentiality and data protection obligations and may only process data on our verified instruction.

7. Data Retention and Lifecycle Deletion Schedule

We maintain a strict data minimization schedule designed to prevent long-term exposure of personal media:

• Uploaded Photos and Generated Videos: Automatically scheduled for permanent deletion from Cloudflare R2 storage 7 days after upload or creation.
• Immediate User Deletion: You can permanently delete any completed video and its corresponding input photo immediately by clicking the delete option in My Videos.
• Account and Transaction Records: Your Google account association, credit ledger history, and Stripe order references remain active to preserve non-expiring credit balances, resolve billing disputes, and satisfy statutory tax obligations.
• External Copies: Deleting media from our servers does not affect copies you have already downloaded to your device or published to third-party social media channels.

8. International Data Transfers

Our infrastructure utilizes Cloudflare's globally distributed edge network and secure cloud compute centers located in the United States and other international regions. If you access our service from the European Economic Area, Switzerland, or the United Kingdom, your data may be transferred to and processed in countries outside your residence. Where applicable, we rely on Standard Contractual Clauses (SCCs) and robust technical encryption safeguards to ensure adequate data protection.

9. Your Privacy Rights

Depending on your jurisdiction (including under GDPR, UK Data Protection Act, and CCPA/CPRA), you possess specific rights regarding your personal information:

• Right to Access / Know: You may request a summary of the personal data we hold about you.
• Right to Rectification: You can request correction of inaccurate profile data.
• Right to Erasure ("Right to be Forgotten"): You can delete media via My Videos or request full deletion of your account record.
• Right to Restrict or Object: You may object to specific processing activities based on legitimate interests.
• Right to Data Portability: You may request an export of your account and task metadata.
• California Consumer Privacy Act (CCPA/CPRA) Disclosures:
  • No Sale or Sharing of Personal Data: We do not sell your personal information or share it with third parties for cross-context behavioral advertising.
  • No Discrimination: We will never deny services, alter prices, or degrade service quality because you exercise your privacy rights.

To exercise any of these rights, email your request to support@ozilgoal-ai.org from your registered account email. We respond to verified privacy requests within 30 days.

10. Cookies and Browser Storage

We maintain a lightweight web environment free of third-party advertising tracking:

• Essential Cookies: We utilize secure, HTTP-only authentication cookies strictly required to maintain your signed-in session with Google OAuth and prevent Cross-Site Request Forgery (CSRF).
• Local Browser Storage: We store temporary generator state (such as your chosen resolution or style filter) locally on your device for immediate convenience.
• No Third-Party Ad Trackers: We do not load third-party advertising tracking pixels or data broker beacons.

11. Security Measures

We implement industry-standard physical, technical, and procedural safeguards:

• All communications are encrypted in transit using Transport Layer Security (TLS 1.3 / HTTPS).
• Media files and database tables are encrypted at rest using AES-256 on Cloudflare R2 and D1 infrastructure.
• Strict role-based access control (RBAC) and least-privilege API token policies protect backend databases.
• Automated rate limiting mitigates brute force, denial of service, and scraping attempts.

Note: While we adhere to rigorous security standards, no internet transmission or cloud storage system can guarantee 100% invulnerability.

12. Children's Privacy (COPPA & GDPR Article 8)

Ozil Goal AI is intended strictly for individuals aged 18 and older (or the age of majority in your legal jurisdiction). We do not knowingly collect personal information, account registrations, or facial images of children under 13 years of age (or under 16 in the European Union).

If you are a parent or legal guardian and believe that a minor has submitted personal photos or created an account without consent, please contact support@ozilgoal-ai.org immediately. We will promptly delete the data and terminate any associated account.

13. Changes to this Privacy Policy

We may update this Privacy Policy periodically to reflect enhancements to our generation pipeline, changes in legal obligations, or new operational practices. The "updated_at" date at the top of this document indicates when changes were last published. Material modifications will be communicated through an on-site announcement or directly within user account portals.

14. Contact and Privacy Inquiries

If you have questions, feedback, or formal privacy requests concerning this policy, contact our privacy desk:

• Service Name: Ozil Goal AI
• Email: support@ozilgoal-ai.org
• Response Window: Inquiries are acknowledged within 2 business days; statutory rights requests are fulfilled within 30 days.
• Governing Pages: See also our Terms of Service, Refund Policy, Responsible Use, and About pages.