Privacy Policy

1. Data the Service retains

• Account information: Email address, display name, and avatar URL obtained from Google OAuth.
• Analysis history: A reference ID for each analysis, the number of detected faces, the number of candidates, the risk score and risk level, the display language, and the time of the run. (This does not include the uploaded videos or images themselves. File names are not stored either.)
• Subscription information: Your current plan, subscription status and renewal dates, and the customer and subscription IDs issued by Stripe. We do not hold card numbers or other payment details.

2. Purpose of use

We use the information for the purposes below. We never sell it to third parties. For information sent externally for analysis and payment, see Section 5 (Data sent to external services); for information sent externally to measure advertising, see Section 6 (Use of cookies).

• Providing the Service and running analysis
• Account authentication and abuse prevention (including usage limits)
• Maintaining and improving service quality (aggregate data only; never in a personally identifiable form)
• Important notifications about changes or incidents (sent to your registered email)
• Measuring advertising performance and optimizing ad delivery (via Meta Pixel; see Section 6)

3. About Google OAuth sign-in

The Service uses Google OAuth (OpenID Connect) for sign-in. At sign-in, Google shares the following with the Service:

• Email address (for account identification)
• Display name / full name (for UI presentation)
• Avatar URL (for UI presentation)

The Service never accesses your Google account password, contacts, calendar, drive, or any other information.Authentication is handled according to Google's security standards (including 2-factor authentication where enabled), and the session is managed by the authentication provider (Supabase) via an encrypted cookie.

By linking your Google account, Google may retain sign-in records on its side under its own policy. See the Google Privacy Policy for details.

4. Handling of videos and images

On our servers (Supabase Storage / Vercel), uploaded videos and images are stored only temporarily for analysis and, regardless of success or failure, are deleted as soon as the analysis finishes. Files left over — for example when an upload is never analyzed — are automatically deleted within 24 hours. Detailed analysis output (similar-candidate lists, face crops, AI commentary, etc.) is not stored on our servers except for temporary processing during the analysis, and is returned only to your browser on completion. Data sent to external services for analysis is handled as described in the next section.

5. Data sent to external services

The Service uses the following external services for analysis, payment, and related functions, and sends them the data needed for those purposes. Under each provider’s terms, the data sent may be retained on the provider’s servers for a period:

• Google (Gemini API): Used to read the content and to search for similar candidates. We send the video file, the image files, face and full-figure crops taken from them, and text describing the content. Video files are placed in Google’s file storage and are automatically deleted within 48 hours at most. Other data (images, text, and records of queries that use Google Search) may be retained for the periods set out in Google’s terms (as of October 2026, up to 30 days for records of queries that use Google Search).
• Anthropic (Claude API): Used for risk evaluation. Videos and images themselves are not sent; only text produced by the analysis is sent (a summary of the content, descriptions of the appearance of people or characters, detected concerns, text and names read from the screen, personal information visible in the content (e.g. names or addresses on name tags or documents), logo/brand names, findings on signs of synthesis, similar-candidate names, and the titles, site names and snippets of pages found by image search).
• SerpApi (Google Lens / Google Images): Used for image-based similarity search. Uploaded images (up to 3) and/or face crops taken from an image or from a single video frame (up to 3) — depending on the analysis type, both — are passed to SerpApi through a temporary URL that is valid for only 5 minutes, and are matched via Google Lens and Google’s image search. The temporary copy is deleted from our servers as soon as the search finishes. To fetch reference images for candidates, we also send candidate names as text. Search records may be retained for the periods set out in SerpApi’s terms (as of October 2026, up to 31 days).
• Stripe: Used for paid-plan payments. Card numbers and other payment details are entered directly on Stripe’s pages; our servers neither receive nor store them. We send Stripe your email address, the plan you selected, and an identifier for your account.
• Resend (email delivery): Used to send the operator a notification email when a new account is created or a paid plan is purchased. The notification contains the email address, display name, account identifier, and the plan and amount.

* Each provider handles data under its own privacy policy and terms. Retention periods may change when those terms change. Even after data is deleted from our servers, it may remain on the providers’ servers for a period as described above. The Service cannot be held responsible for how third-party providers handle your data.

6. Use of cookies

The Service uses cookies and similar technologies to keep you signed in and to measure advertising performance.

• Authentication cookie (encrypted JWT session cookie issued by Supabase Auth). Used to keep you signed in.
• We use Meta Pixel (for Facebook / Instagram ad measurement). Page-view, registration, and checkout events are sent to Meta Platforms, Inc. for ad-delivery optimization and performance tracking. You can disable this with browser extensions (e.g., uBlock Origin) or OS-level tracking-prevention settings. See Meta's privacy policy at https://www.facebook.com/policy.php for details on how Meta processes this data.
• You can disable cookies in your browser, but you will not be able to sign in.

7. Access logs and error logs

For stable operation and troubleshooting we collect the following logs. They are never used to identify individuals.

• Access logs (IP address, User-Agent, request URL, timestamp) — collected by Vercel by default
• Error logs (stack traces of failures) — collected by Vercel by default
• Analysis execution logs (success or failure, counts, and duration of calls to external services, and names of candidates found by search). The uploaded videos and images themselves are not logged.

These logs are automatically deleted after a certain period in accordance with Vercel's policy.

8. Communication encryption

All communication is encrypted via HTTPS / TLS. Supabase Storage encrypts data at rest with AES-256.

9. Third-party disclosure

We never disclose personal information obtained from users to third parties without the user's consent.However, we send data to the external services described above that we use to operate the Service (Supabase / Vercel / Google / Anthropic / SerpApi / Stripe / Resend / Meta) to the extent necessary for each purpose, and those providers process it.

10. Data deletion and disclosure requests

If you would like to request deletion or disclosure of your account and analysis history, please contact us via the operator below. We will respond within a reasonable timeframe after identity verification.

11. Use by minors

The Service is generally intended for users aged 13 and above. Users under 13 should read this policy with the consent of a guardian.

12. Notes regarding the beta

The Service is currently in beta, and this policy may be updated without prior notice. The Service provides AI-based reference information; final decisions on publication or commercial use must be made under the supervision of legal counsel or other qualified professionals.

13. Operator and contact

Service operator: LightKing Tokyo (https://lightking-tokyo.lovable.app/home)

Please direct inquiries about this Privacy Policy or the handling of personal information to the contact information listed on the operator's website above.