Director AI

Director AI Privacy Policy

Last updated: November 2, 2026

Director AI, available at directorvideo.ai and through our applications, creates AI media from your prompts and uploads. This policy explains how we handle information when you use the service. It works together with our Terms of Use.

The data controller is Boby AI Yazılım A.Ş., registered in Istanbul, Türkiye. For privacy questions or requests, contact support@directorvideo.ai.

1. Information we collect

  • Account information: your name, email address, account identifiers, and sign-in information. When you use Google or Apple sign-in, we receive the information authorized by that provider; we do not receive its password. Email/password accounts use a protected password hash. Guest sessions, where available, have an account identifier.
  • Your inputs: uploaded images, video, audio, prompts, and other information you submit to create or edit media.
  • Generated content: images, storyboards, audio, video, workflow inputs and outputs, and generation status and history.
  • Billing information: credit grants and spending, purchase and subscription records, transaction identifiers, and entitlement status. Payment providers handle payment card details; we do not store your full card number.
  • Technical information: IP addresses, session information, browser or device information, request identifiers, and operational records used to run, secure, and troubleshoot the service.
  • Support information: messages and information you provide when contacting us or reporting a problem.

2. How we use information

We use information to authenticate you, process your inputs, generate and deliver media, maintain your library, manage credits and purchases, communicate about your account, resolve support requests, and prevent abuse. We also use operational records to diagnose failures and improve reliability.

We may email you about offers for the service. Every such email has an unsubscribe link, and you can also turn these emails off in your account settings. Emails about your account, such as sign-in and purchase messages, are sent regardless. We record whether our emails are delivered and opened and which of their links are followed, so we can tell which emails are useful.

We measure how the website is used and how our advertising performs, including which pages are visited, whether an account was created, and whether a purchase was completed.

Where applicable data-protection law requires a legal basis, we rely on performance of our contract with you, our legitimate interests in operating and securing the service, compliance with legal obligations, and consent where required. You may withdraw consent without affecting processing that occurred before withdrawal.

3. AI processing and service providers

Generating media requires sending the relevant inputs to the provider used by the selected model or workflow. Different nodes in one workflow may use different providers. We share information with service providers as needed for the following purposes:

  • Google Cloud Vertex AI, fal.ai, and EachLabs: process prompts and media for AI generation. These services may use the underlying model providers needed to fulfill your request.
  • Cloudflare: hosts our application services and workflows, stores and delivers media through R2 and its network, provides security, and supports transactional email delivery.
  • PlanetScale: hosts our PostgreSQL database for account, generation, catalog, and billing records.
  • Axiom: processes operational logs used for reliability, security, and troubleshooting.
  • Google Analytics and Meta: measure website usage and advertising performance. They receive page addresses, device and browser information, IP address, and sign-up and purchase events; Meta also receives a hashed form of your email address and account identifier for purchases and registrations.
  • PostHog: product analytics and error tracking for the website, the apps, and our servers. Receives the pages you visit, the features you use, the progress of your generations, subscription changes, and error diagnostics, tied to your account identifier. It never receives your prompts, uploads, or payment details.
  • Paddle: processes web purchases and billing as merchant of record where shown at checkout.
  • RevenueCat, Apple, and Google: manage mobile purchase entitlements and app-store billing where those purchase methods are offered. When you request a refund from an app store, we tell that store whether the purchase was delivered, how much of its credits were used, and which outcome we prefer.
  • Google and Apple: provide optional sign-in when available.

Provider processing is subject to the applicable service agreements and privacy terms. We do not train our own AI models on your uploads, prompts, or generated content. The selected model provider’s handling of inputs is governed by the terms under which that service is provided.

We do not sell your personal information or share it with advertisers for targeted advertising. We may disclose information where required by law, to protect rights and safety, or in connection with a business transfer subject to appropriate protections.

4. Photos, voices, and likeness

Upload another person’s image or voice only when you have permission and a lawful basis to use it. Do not cast minors unless you are their parent or legal guardian and are authorized to consent. These requirements are described in our Terms of Use.

If someone has used your likeness without permission, contact us to request review and removal. Include enough information to locate the content, without sending unnecessary sensitive information.

5. Cookies and local storage

We use cookies and similar storage for sign-in sessions, security, and interface preferences. These support features such as staying signed in and remembering display settings. You can control cookies through your browser, but disabling necessary cookies may prevent authentication or other features from working.

On the website we also use analytics and advertising cookies from Google Analytics and Meta, and a cookie of our own that remembers how you first reached the site, such as the advertisement or link you followed.

6. Mobile apps

Our iOS and Android apps include software from the providers below. It starts with the app and collects information about the device and how the app is used, separately from the website cookies described above.

  • Firebase (Google): analytics, crash reporting, remote configuration, and an app installation identifier. Receives in-app events, crash diagnostics, and device and operating-system information.
  • Adjust: measures which campaign, advertisement, or shared link led to an install or brought you back. Receives install and session information, device information, and the advertising identifier where it is available.
  • Meta: measures in-app advertising performance through automatically logged app events and the advertising identifier where it is available.
  • UXCam: records in-app screens and interactions so we can find where the app is confusing or broken. Text entered into sign-in and payment fields is hidden from the recording.
  • PostHog and Statsig: product analytics, experiments, and feature flags, tied to your account identifier.
  • Expo, Apple, and Google: deliver push notifications. A push token is stored with your account until notifications are turned off or the account is deleted.

The app also keeps an identifier for the device itself, so one-per-device welcome credits are granted once. It is generated on the device, or on Android derived from the system identifier through a one-way hash, and it is sent to us alone — never to an advertising network.

On iOS the app asks for your permission before using the advertising identifier for tracking. On Android you can reset or delete the advertising identifier in system settings. Notification, photo, and camera access are each asked for separately and can be withdrawn there as well.

7. International processing and security

Our infrastructure and providers operate internationally. Information may be processed outside your country, including in the United States, Europe, and locations served by global delivery networks. Where required, we use appropriate safeguards for international transfers under applicable data-protection law.

We use technical and organizational safeguards, including access controls and encryption in transit, to protect information. No method of storage or transmission is completely secure.

8. Retention and deletion

We retain account information and content as needed to provide the service and maintain your account. Retention depends on the type of information, operational needs, and legal obligations. Billing, security, and dispute records may need to be retained after account closure.

You may remove content through available library controls, or delete your account and associated content as described on our account deletion page. Tell us if your request also concerns generated material derived from an upload. Copies in backups, delivery caches, or provider systems may take additional time to be removed according to their retention processes. Information required for legal compliance, fraud prevention, or resolving disputes may be retained for those purposes.

9. Your rights

Depending on your location, including rights under Türkiye’s KVKK and applicable European data-protection laws, you may request access, correction, deletion, restriction, or portability of your personal information, and object to certain processing. You may also have the right to complain to your local data-protection authority.

Send requests to support@directorvideo.ai. We may need to verify your identity before acting to protect your account and other people’s information.

10. Children

Director AI accounts are intended for adults aged 18 and over. We do not knowingly allow children to register. If you believe a child has created an account or that we have received information in violation of this policy, contact us so we can investigate and take appropriate action.

11. Changes and contact

We will update the date above when this policy changes. Material changes will be communicated through the service or by email where appropriate.

For privacy, access, deletion, or likeness-removal requests: support@directorvideo.ai.

12. YouTube API Services

Our internal content tools use YouTube API Services to publish and manage videos on our own official YouTube channel and to read publicly available YouTube data (such as video titles, view counts and public comments) for trend and market research. By interacting with features that use YouTube API Services, you also agree to the YouTube Terms of Service. Google’s handling of data is described in the Google Privacy Policy.

We only access our own YouTube channel through Google OAuth and only public data from other channels. We do not collect, sell or share personal data of YouTube users. Public YouTube data we store for research is kept for no longer than 30 days and is then deleted or refreshed.

Authorized access to a Google account can be revoked at any time via the Google security settings page. To request deletion of any YouTube-related data we hold, contact support@directorvideo.ai; we delete it within 7 days.