Privacy Policy

Last updated: November 8, 2026

MakeHit AI operates MakeHit AI at makehit.app from the United States. “We” and “us” mean MakeHit AI. This policy explains how we handle personal information when you browse our website, create an account, submit photos, purchase credits or contact us. We are independent and unaffiliated with Mesut Özil, Arsenal or UEFA.

1. Information we collect

• Account and sign-in data: email address, name, account identifier, email verification status and profile picture when supplied. Google sign-in also provides authentication identifiers and tokens used to manage access. Email sign-in uses a verification code. Signing in does not import your Google Photos, Gmail messages or Drive files.
• Photos and generated media: the subject and scene photos required by the selected template and its options, any generated character or other reference media, the generated video and its thumbnail. Current templates request between one and six photos, depending on the selected roles and options.
• Generation and credit records: generation instructions, template and variant selections, selected quality, subject, supporting-role, scene and environment settings, task identifiers, file URLs, timestamps, status, errors, credits used and credit adjustments. Each template supplies its own prepared references and instructions.
• Payment records: order and transaction identifiers, packages, amounts, currency, payment status and billing details returned by the payment provider. Payment credentials go to the provider; we do not store full payment card numbers or security codes.
• Technical data: session records, IP addresses, browser and device information, access times, page activity, performance measurements and diagnostic logs.
• Marketing attribution data: campaign parameters, referring domain, landing page, country code, broad device category and timestamps used to connect account registration, purchases and product activity with acquisition channels. We do not store a full IP address, city or device fingerprint for attribution. You may contact us to request access to or deletion of this account-linked data.
• Support correspondence: your email address, messages and files you choose to send us.

2. Photo & AI processing

Before you submit

Selecting a photo creates a local preview. This generator also saves your selected photos and quality in this browser so you can return after sign-in or checkout.

A saved setup can be restored for up to 24 hours. You can remove it with Clear saved setup and photos in the generator or by clearing this site's browser data. Saving a setup alone does not upload photos. The site also stores a job identifier locally so you can return to a submitted job.

Temporary uploads and generation submissions

In preview mode, an authenticated user's photos are uploaded when they start the creation flow, before any generation is submitted. These discovery uploads and their upload records expire after 24 hours and are eligible for scheduled cleanup. In live mode, photos are uploaded when you submit a generation. For Ozil Goal tasks, inputs are scheduled for deletion about 48 hours after completion or failure, and deleting the completed or failed task removes stored files sooner. Other tasks currently support history removal only through My Creations.

Each selected template uses its own prepared workflow and configured provider. Depending on the template, the workflow may create character or other reference media from uploaded subject photos and then generate video using those references, optional scene inputs, preset performance or media references, instructions and settings.

Your generated result

The selected workflow generates an MP4 with template-specific audio. Current native-template outputs are approximately 6–29 seconds and may be vertical or landscape, depending on the template and options. We retrieve and store the resulting video and thumbnail for viewing and download.

Uploaded photos and reference images are used to guide the subjects, supporting roles or scenes shown in the selected template. We do not use this workflow to identify people or build a facial recognition database. Google sign-in data is used for your account, not as input to AI generation.

MakeHit AI will never use your uploaded photos, character references or generated videos to train or fine-tune AI models. This commitment covers our own use of your media. We have not obtained an equivalent no-training commitment covering every configured provider—APIMart or Kie API—or their underlying model operators. Provider documents do not establish how long every fetched input or model-operator copy is retained, or whether every deletion request reaches every operator. Do not upload photos if these unknowns are unacceptable to you.

3. How we use information

• Authenticate you, maintain your account and deliver generations and downloads.
• Manage purchases, credits, payment reconciliation and failed-task credit returns.
• Provide support and necessary sign-in, billing, security and service messages, including an account-confirmation welcome email. If a newly registered user separately opts in to a first-video reminder and has not submitted a video after 48 hours, we send one reminder at the next successful scheduled check with an unsubscribe link.
• Diagnose failures and improve reliability using operational and usage information.
• Investigate unauthorized photo use, abuse, fraud and security incidents, and meet legal obligations.

Improving the service does not authorize training on your content or publication of it. Authorized team members may access content when needed for support, troubleshooting, safety or legal requests. We do not use uploaded photos or generated videos for advertising. Optional analytics events are described below; the site denies advertising storage and personalization in its Google tag configuration.

Where EEA or UK data protection law applies, our legal bases depend on the activity: contract performance for account, generation and billing services; legitimate interests for proportionate security, fraud prevention and diagnostics; legal obligations for required records; and consent for optional public display and other processing requiring consent. Withdrawal does not affect processing that was lawful beforehand.

4. Service providers & disclosures

We disclose information needed to deliver the service to:

• AI generation providers — APIMart and Kie API:

  Prepared native-template workflows route the media and instructions needed for generation through APIMart and/or Kie API, depending on actual model and workflow capabilities. Compatible dual-provider stages prefer APIMart and can fall back to Kie. Bulin 47 and some stages of other workflows are Kie-only. The general video-generation API also prefers APIMart where the selected model and mode support it, retains Kie as a fallback for compatible models, and keeps models without a supported APIMart mapping Kie-only.

  The applicable provider and its model operators receive the media, references, instructions and settings needed by the selected workflow. Models and processing stages vary by template or general-API model; Nano Banana 2 and Wan 3.0 are not site-wide processing steps.

  We do not include your account email or profile name in model-generation requests.

  Provider documents: Kie API’s privacy policy, API retention documentation, and File Upload API documentation.

  Kie documents a 14-day retention period for generated media and two months for task logs. Its separate File Upload API documents 24 hours, but the Kie prepared-workflow path uses temporary media links rather than that upload endpoint. These Kie-specific statements do not establish retention or deletion periods for APIMart, every fetched input, every underlying model-operator copy or backups.

• Hosting, database, object storage and delivery providers: Vercel hosts the website and provides analytics and performance measurement when enabled. Our current database configuration uses Neon PostgreSQL for account and task records, and Cloudflare R2 for uploaded and generated media. These providers receive the data needed to operate, store and deliver the service. Cloudflare Turnstile is separate from R2 storage. During production sign-in, the Turnstile script is loaded from challenges.cloudflare.com, a challenge token is included with supported sign-in requests, and the token is validated through our server-side Cloudflare Turnstile integration.
• Google: authentication data when you choose Google sign-in. See Google’s privacy policy.
• PayPal: payment and order data when you purchase credits through PayPal. See PayPal’s privacy statement.
• Brevo: recipient addresses, message content, delivery events and marketing-consent records for sign-in, welcome and opted-in one-time first-video reminder emails. See Brevo’s privacy policy.
• Google Analytics 4: page views and product conversion events, including photo preparation, account access, pack selection, checkout, confirmed purchases and completed videos. Purchase events include an internal transaction ID, pack, currency and amount; account access can be associated with an internal user ID. We do not intentionally send photos, filenames, email addresses, prompts or payment credentials in these events. See Google’s privacy policy.
• Microsoft Clarity: website interaction and session data when you allow optional analytics. See Microsoft’s privacy statement.
• Vercel Analytics and Speed Insights: website usage and performance data where these integrations operate. We do not intentionally include your photos or generated media in analytics events. See Vercel’s privacy policy.

We may also disclose information when legally required, to address fraud or safety incidents, to protect legal rights, or in a business transfer subject to applicable protections and required notices.

5. Privacy & optional public display

We do not automatically publish uploads or final videos in a public gallery. Generating a video or accepting this policy does not grant permission to use it in our examples, social posts or marketing. Such use requires a separate, optional opt-in identifying the final video and proposed use. Refusing does not affect generation. We do not publicly display original photos or character references.

A public-display opt-in is not currently available in the generator. Until separate permission is obtained, your content is not eligible for our public examples. We do not feature content depicting minors. Permission for a multi-person video must cover everyone shown; the uploader’s permission alone does not replace their rights.

You may withdraw permission by emailing us. We will stop future use and remove displays under our control, subject to applicable law. We cannot retrieve copies others have downloaded or reposted.

Viewing and downloading your videos through the site require sign-in to the account that created them. AI providers receive temporary links to the files needed for processing. Deleting a video from the site does not remove copies already downloaded or held by third-party providers.

6. Retention & deletion

To request deletion: support@makehit.app.

1. Send the email from your account address and include the relevant task or video identifier.
2. Say whether you want the associated photos, references, video and thumbnail removed, your account closed, or both.

A task that is still being generated cannot be deleted. For a completed or failed Ozil Goal task, Delete in My Creations removes access immediately and deletes associated files from our storage, with retry after storage errors. For other tasks, Delete removes the item from My Creations but leaves associated stored files in place; contact support for a separate file-deletion review. These actions do not close your account or erase provider copies or browser drafts.

For account closure or a separate privacy request, we will verify the request, explain what can be removed and what must be retained, and confirm the outcome. Contact support if task-file cleanup remains pending. If you request deletion of provider-controlled copies, include the task ID; we will submit the request to the applicable configured provider where a provider process is available, but cannot guarantee deletion by every underlying model operator.

We cannot promise immediate erasure or deletion of copies controlled by third-party providers.

Kie documents a 14-day retention period for generated media and two months for task logs. Its separate File Upload API documents 24 hours, but the Kie prepared-workflow path uses temporary media links rather than that upload endpoint. These Kie-specific statements do not establish retention or deletion periods for APIMart, every fetched input, every underlying model-operator copy or backups.

7. Cookies & analytics

We use session cookies for sign-in and may store theme or language preferences in cookies or browser storage. Disabling necessary cookies can prevent sign-in or generation. Usage and performance integrations are described above; not every analytics service uses cookies.

Use Privacy settings below or at the bottom of the site to accept or withdraw optional analytics consent. Optional analytics remain disabled until you consent. Withdrawal stops future optional analytics loading and clears our attribution cookies; it does not automatically erase data previously sent to analytics providers or necessary server and security logs. Contact us about earlier account-linked attribution or analytics processing.

8. Your rights & requests

Depending on your location and applicable law, you may have rights to access, correct, delete or obtain a portable copy of personal data; object to or restrict processing; withdraw consent; and complain to a data protection authority. Applicable US state laws may also provide appeal and opt-out rights. These rights and exceptions vary; not every regional law applies to every request.

Email support@makehit.app, preferably from your account address. Describe your request and include relevant generation identifiers if available. We may need proportionate information to verify your identity or authority to act for someone else. Do not send passwords, payment credentials or identity documents unless we explain why further verification is needed and arrange a suitable method.

We respond within applicable legal deadlines, explain permitted extensions or refusals, and do not discriminate against you for exercising privacy rights. You can request review of a denial by replying to our response. Account settings currently do not offer complete correction, export or account-deletion controls. Revoking Google access does not delete your account or files.

9. Age & photo permissions

MakeHit AI is for people aged 13 or older. Users aged 13–17 need permission from a parent or legal guardian to use the service and upload their own photo. Anyone under 13 must not create an account, upload photos or submit personal information. Meet any higher minimum age required where you live. These age and guardian-permission rules apply when you sign in and generate. Current forms do not ask for a separate age or guardian-permission confirmation; we do not collect birth dates or independently verify age or guardian consent. The generation flow includes only a confirmation that the user has permission to use the people in the uploaded photos.

You may upload your own photo if you are at least 13 and, if under 18, have parent or guardian permission. Other identifiable people in subject, supporting-role or scene photos must be consenting adults aged 18 or older. Do not upload other minors, celebrities or public figures.

Upload only your own photo under the age and permission rules above, or a photo of an adult who has authorized this AI processing. The same rule applies to every uploaded role and identifiable people in environment photos. Permission to generate is separate from permission to publish. If you or your child appear in an unauthorized upload, contact us to investigate, restrict use and address deletion under applicable law. If we learn that we collected information from an ineligible child, we will take steps to remove it as required.

10. Security & international processing

We use authenticated account access and encrypted connections for service requests. No transmission or storage method is completely secure. Historical media links and third-party processing have the limitations explained above. Contact us about suspected unauthorized access to your account or content.

We operate from the United States and serve users internationally. Providers may process information in the United States or other countries with different privacy laws. Our location does not mean all data stays in the United States. Where international transfers require safeguards, the relevant processing must use them. Contact us about the locations and safeguards applicable to your request.

11. Policy updates

We update the date on this page when our practices change. Material changes will receive an appropriate website notice or email notification, with fresh consent where required. An update does not itself authorize new public-display or model-training uses.

12. Contact us

MakeHit AI
United States
Privacy and support: support@makehit.app

Read our Terms of Service for the rules governing use of the service.