Privacy Policy — LiveGen

1. Introduction / Who we are

LiveGen (livegen.ai) is a browser-based, zero-install web app for real-time interactive AI video. You open your camera — or upload a video or image — and the Services transform it live, using one of our six modes: Live Morph, Outfit Swap, Style Morph, Bring to Life, Summon (AR), and Freestyle. Because this involves your camera, your face, and your likeness, we want to be very clear and specific about what happens to your data. This Privacy Policy explains what we collect, why, who we share it with, how long we keep it, and the choices and rights you have.

Who we are. In this Policy, "LiveGen," "we," "us," "our" means comiaos, LLC, whose registered address is 131 Continental Dr, Suite 305, Newark, DE 19713, US. For personal data governed by the EU GDPR, the UK GDPR, and similar laws, LiveGen is the controller of the personal data described here, except where we act as a processor on behalf of a business customer.

Scope. This Policy applies to the "Services" — the LiveGen website(s) at livegen.ai, our apps, and related products and features. Some defined terms used throughout:

"Account" — a registered LiveGen user account.
"User Content" — anything you provide to the Services: your live camera feed, uploaded videos or images, reference images, text prompts, and other inputs.
"Inputs" — the prompts, reference images, camera feed, and settings you submit to generate a result.
"Output" — the transformed video or image the Services generate from your Inputs.
"Creations" — Outputs you choose to save, export, publish, or share (including to public pages).
"Model Provider" — the independent third-party provider of the underlying real-time generation model that processes the stream.

How to contact us. For any privacy question, or to exercise your rights, email privacy@livegen.ai. Data-protection matters can also be sent to our data protection contact at dpo@livegen.ai. Our full contact details, including any EU/UK representative, are in Section 14.

This Privacy Policy works together with our Terms of Service. Please read them together — the Terms of Service incorporate this Privacy Policy by reference and describe your rights and responsibilities when using the Services.

2. The data we collect

We collect the following categories of data.

(a) Data you provide

Account data. When you create an Account, we collect information such as your name or display name, email address, password (stored hashed), and any profile details you add. If you sign in with a third-party identity provider, see (d) below.
Billing data. When you buy credits or a subscription, our payment processor collects and processes your payment details (for example, card or wallet information). We generally receive only limited billing information — for example, a transaction identifier, the last four digits of a card, billing country, and your plan and credit balance. We do not store full card numbers.
User Content. The live camera feed, uploaded videos and images, reference images, text prompts, mode selection, and other settings you submit as Inputs, plus the Outputs generated from them and any Creations you save or share. Because our product is built around video and faces, User Content can include your face, voice, and likeness. See Section 2(c) for how we treat camera and facial data specifically.
Communications. If you contact support, respond to a survey, report content, or otherwise communicate with us, we keep those messages and their contents (for example, emails to support@livegen.ai).

(b) Data collected automatically

When you use the Services, we and our providers collect certain data automatically:

Device and connection data — browser type and version, operating system, device type, language, screen and camera capabilities relevant to WebRTC, and similar technical attributes.
IP address and approximate location — derived from your IP address (for example, country or city-level region), used for security, fraud prevention, routing, and legal compliance. We do not collect precise GPS location.
Usage and analytics data — pages viewed, features and modes used, session duration, credits consumed, generation events, error and performance logs, and how you navigate the Services.
Cookies and similar technologies — see Section 6.

(c) Camera and biometric / facial data — please read carefully

This is the most sensitive category of data we handle, so we describe the data flow precisely.

What we process. To run a real-time transformation, the Services capture your live camera feed (or your uploaded video/image) and stream it to be processed by the underlying AI model. That live video contains your face and likeness, from which facial features are analyzed to generate the transformed Output. Depending on your local law, this may constitute biometric or facial data, which is a special / sensitive category of personal data. We treat it as such.
Where it goes. The live video is streamed over WebRTC to the Model Provider, which processes the stream to generate the transformed Output that renders back into your browser. This means your live camera video — including your face and likeness — is transmitted off your device to be processed. We are being deliberately clear here: the feed does not stay only on your device. It is sent to run the transform and produce the Output. Reference images and uploaded files are sent to cloud object storage (Cloudflare), which returns a URL used as the reference for generation.
How long it's kept. The raw stream is processed in real time. When you record in Studio, we automatically record the untransformed video during the same recording and upload that clip to private storage for product analysis, even if you do not save or share the generated Creation. This includes camera input or the corresponding playback segment of a video you selected, excludes microphone audio, and does not collect the entire uploaded source file. Only authorized administrators can view these analysis clips. Access expires after 30 days; our scheduled cleanup removes the stored files. See Section 8 for retention and Section 9 for deletion requests. The Model Provider's own processing and retention are governed by its terms.
Analysis recording and display. Original-clip collection is enabled by default whenever you record camera input or a video you selected. These clips are retained for authorized administrators to review generation quality and diagnose product problems. The “Show original video” checkbox controls the original picture-in-picture in your preview and exported/shared Creation; it does not control internal original-clip recording or upload. There is no separate analysis opt-in checkbox. To avoid new analysis clips, do not start a recording; to request deletion of previously submitted clips, contact privacy@livegen.ai. Internal analysis copies do not appear as separate items in your gallery, exports, public pages, or community feed. Administrator playback and deletion are logged. Our upload record identifies the collection policy version and does not represent an affirmative consent action.
Consent for real-time generation. Because generation involves biometric / facial processing, we rely on your consent (Section 3). You can decline camera access, and you can withdraw consent at any time by stopping camera use and, where offered, revoking the permission in your browser or in your Account settings. Withdrawing consent does not affect processing that already happened.

(d) Data from third parties

Single sign-on (SSO) / social login. If you register or sign in using a third-party identity provider, we receive basic profile data from that provider (for example, name and email) according to your settings with them.
Payment processor. We receive limited transaction and status data from our payment processor to confirm purchases, manage subscriptions and credits, and prevent fraud.
Safety, analytics, and infrastructure providers. We may receive signals from security, anti-fraud, and analytics providers that help us protect and operate the Services.

3. How we use your data and our legal bases

We use personal data for the purposes below. Where the EU/UK GDPR or similar laws apply, the relevant legal basis is shown in bold.

Purpose	What this involves	Legal basis
Provide the Services	Create and manage your Account, run the six modes, generate Output, save and share Creations, provide support	Performance of a contract with you
Real-time generation	Stream your Inputs (including the camera feed) to the Model Provider to produce Output and render it back to you	Performance of a contract with you; and, for the facial/biometric element, your consent
Biometric / facial processing	Analyze facial features in the live feed to power Live Morph and the other modes	Your explicit consent (Section 2(c))
Billing and credits	Process payments, track credit balances (1 credit = 1 second of generation), manage subscriptions and free credits	Performance of a contract; legal obligation for tax and accounting records
Safety and content moderation	Detect and act on prohibited content, enforce our Acceptable Use rules (including consent requirements for using a real person's likeness), and report unlawful content where required	Legitimate interests in a safe service and in protecting others; legal obligation where reporting is required; substantial public interest where applicable to sensitive data
Fraud prevention and security	Detect abuse, secure Accounts, prevent unauthorized access, and protect the Services	Legitimate interests in keeping the Services secure
Analytics and product improvement	Understand usage, fix errors, and improve features (using aggregated or de-identified data where feasible)	Consent where required (for example, non-essential cookies); otherwise legitimate interests
Marketing and communications	Send service messages and, where you have opted in, product updates and offers	Consent for marketing where required; legitimate interests for service messages
Legal compliance	Respond to lawful requests, enforce our Terms, and establish, exercise, or defend legal claims	Legal obligation; legitimate interests

Where we rely on consent, you can withdraw it at any time (Section 9). Where we rely on legitimate interests, you can object (Section 9), and we have balanced our interests against your rights.

4. AI processing and model training

Because LiveGen is an AI product, we want to be explicit about how your data is used in generation and training.

How generation works. When you use a mode, your Inputs — including your live camera feed, reference images, prompts, and settings — are streamed over WebRTC to the Model Provider to generate the Output, which is rendered back into your browser in real time. Reference images and uploaded files are stored in Cloudflare and referenced by URL for generation.
We do not train our own models on your content. We do not use your User Content, Inputs, Outputs, or Creations to train, fine-tune, or develop our own AI models. Your content is used to provide the transformation and to review the product using analysis clips collected during recordings as described in Section 2(c). Neither use includes training our own models.
Aggregated / de-identified data. We may use aggregated or de-identified data — data that does not identify you and cannot reasonably be used to identify you — to measure performance, understand usage, and improve the Services.
The Model Provider as an independent provider / sub-processor. The Model Provider is an independent third party that processes the streamed data to run the underlying model. It processes data under its own terms, and acts as an independent provider and/or sub-processor. The specific data-processing terms, retention, security commitments, and any training use on the Model Provider's side are set out in its own terms and privacy practices. We will update this Policy to reflect the confirmed terms and will seek contractual commitments consistent with applicable data-protection law before relying on them.

We share personal data only as described here. We do not sell your personal data, and we do not "share" it for cross-context behavioral advertising as those terms are defined under California law.

Model Provider. Your Inputs, including the live camera feed, are transmitted to the Model Provider to generate Output, as described in Sections 2(c) and 4. It processes this data under its own terms and privacy practices.
Cloud storage (Cloudflare). Reference images and uploaded files are stored in Cloudflare object storage and returned as URLs used for generation.
Payment processor. To take payments, manage subscriptions and credits, and prevent payment fraud.
Hosting and infrastructure providers. For website hosting, content delivery, database, and security services that run the Services.
Analytics providers. To help us understand and improve usage, subject to your cookie choices (Section 6).
Legal authorities and third parties. Where we believe in good faith it is necessary to comply with law, respond to lawful requests, enforce our Terms, or protect the rights, safety, and property of users, the public, or LiveGen.
Child-safety reporting. Where required or appropriate, we report content that sexually exploits or endangers minors to the relevant authorities or hotlines and cooperate with investigations.
Business transfers. If LiveGen is involved in a merger, acquisition, financing, reorganization, or sale of assets, personal data may be transferred as part of that transaction, subject to this Policy or a successor policy with equivalent protections.
With your direction. When you publish or share a Creation to a public creation page or community gallery, or share it externally, you make it visible to others by your own choice.

We require service providers to protect personal data and to use it only to provide services to us.

6. Cookies and similar technologies

We use cookies, local storage, and similar technologies to keep you signed in, remember preferences, secure the Services, and understand usage. We group them as:

Strictly necessary — required to run the Services (for example, authentication, security, load balancing). These cannot be switched off.
Functional — remember your settings and preferences.
Analytics / performance — help us understand how the Services are used so we can improve them. We use Google Analytics to measure traffic and feature usage, and Microsoft Clarity to capture how you use and interact with the Services through behavioral metrics, heatmaps, and session replay. This usage data is collected using first- and third-party cookies and similar technologies and is used for site optimization and fraud/security purposes. For more information about how Microsoft collects and uses your data, see the Microsoft Privacy Statement.

Where required by law, we ask for your consent before setting non-essential cookies, and you can change your choices at any time through our cookie controls or your browser settings. Disabling some cookies may affect how the Services work.

7. International data transfers

LiveGen's application and object storage run on Cloudflare infrastructure in the United States. We do not use Chinese cloud infrastructure and do not route or store your data in China. When we transfer personal data across borders — including from the EEA, the UK, or Switzerland to the United States or another country — we rely on a lawful transfer mechanism, such as an adequacy decision or data-transfer framework where available, or the Standard Contractual Clauses (SCCs) / UK International Data Transfer Agreement, together with supplementary measures where needed. Where the Model Provider processes your streamed Inputs to generate Output, it does so under its own terms, and we put appropriate safeguards (such as the SCCs) in place where required. You can contact us at privacy@livegen.ai for more information about the safeguards we use.

8. Data retention

We keep personal data only as long as needed for the purposes in this Policy, then delete or de-identify it.

Raw camera stream / live feed — recorded and uploaded automatically during your Studio recordings as described in Section 2(c), independently of whether you display, save, or share the original picture-in-picture. Analysis clips are available to authorized administrators for 30 days from upload, then become inaccessible and are removed by scheduled cleanup. Administrators can delete them earlier on request. Closing your Account disables access and queues the files for cleanup. Upload retries may temporarily keep a local copy in your browser; successful uploads clear it, and retries stop after 24 hours. Expired local copies are removed on your next visit. Minimal upload and administrator-access records may remain for security and to prevent deleted clips from being restored. The Model Provider's retention remains subject to its own terms.
Custom images submitted for generation — we attempt to save one private copy of the latest successfully archived image per generation session for product analysis, including still images submitted to Bring to Life. Choosing an image without submitting it does not trigger this storage. A newly saved image replaces the previous copy; failed uploads are not retried. Copies are accessible only to authorized administrators for 30 days after storage, then become inaccessible and are removed by scheduled cleanup. Closing your Account disables access and queues cleanup. These images are not added to your public Creations or shared pages. We do not add a separate administrator-access audit for these image previews. The Model Provider’s processing and retention remain subject to its own terms.
Creations — kept until you delete them or close your Account, unless we must retain them longer for legal or safety reasons.
Account data — kept for the life of your Account and for a short window afterward to handle recovery, disputes, and legal obligations, after which it is deleted or de-identified.
Billing and transaction records — kept as required by tax, accounting, and other laws.
Logs, analytics, and security data — kept for limited retention windows appropriate to their purpose.

Where we cannot fully delete data (for example, in backups), we isolate it and protect it until deletion is possible.

9. Your rights and choices

Subject to your location and applicable law, you may have the right to:

Access the personal data we hold about you and get a copy;
Correct inaccurate or incomplete data;
Delete your data ("right to be forgotten");
Port your data to another service;
Restrict or object to certain processing, including processing based on legitimate interests;
Withdraw consent at any time — including consent to camera and biometric / facial processing — without affecting processing that already took place;
Opt out of marketing communications; and
Lodge a complaint with your data-protection authority (see Section 15).

GDPR / UK GDPR. If you are in the EEA, the UK, or Switzerland, you have the rights above, and we rely on the legal bases in Section 3. Because facial/biometric processing relies on your explicit consent, you can withdraw it at any time by stopping camera use and, where offered, revoking the permission.

California (CCPA/CPRA). If you are a California resident, you have rights to know, access, correct, and delete personal information, and to limit the use of sensitive personal information (which can include biometric/facial data). We do not sell or share your personal information for cross-context behavioral advertising. We will not discriminate against you for exercising your rights.

Other US states. If you are a resident of a US state with a comprehensive privacy law (such as Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and others), you may have rights to access, correct, delete, and port your data, to opt out of targeted advertising and any sale, and to limit processing of sensitive data. We honor these where they apply.

How to exercise your rights. Email privacy@livegen.ai or use the controls in your Account. We may need to verify your identity before acting, and you can use an authorized agent where the law allows. We respond within the timeframes required by applicable law and will not charge a fee except where permitted.

10. Security

We use technical and organizational measures designed to protect personal data, including encryption in transit (including for the WebRTC stream and stored reference files), access controls, authentication safeguards, logging and monitoring, and least-privilege practices for our team and providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a personal-data breach that affects you, we will notify you and the relevant authorities as required by law. Please keep your Account credentials confidential and contact support@livegen.ai if you suspect unauthorized access.

11. Children's privacy

The Services are not directed to children below the applicable minimum age. You must be at least 13 years old to use the Services, at least 16 in the EEA, the UK, and Switzerland, or older where your local law sets a higher minimum age. We do not knowingly collect personal data — including camera or facial data — from children below the applicable age. Given the biometric nature of our product, we take under-age use seriously: if we learn that a child below the applicable age has provided personal data, we will delete it and close the Account. If you believe a child has used the Services, contact privacy@livegen.ai.

12. Third-party sites and services

The Services may link to, or interoperate with, third-party websites and services (for example, identity providers, payment processors, and platforms where you share Creations). Those third parties have their own privacy practices, which we do not control. This Policy does not cover them, and we encourage you to review their privacy notices.

13. Changes to this Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where required, provide additional notice (for example, by email or an in-product notice) and, for changes that require it, seek your renewed consent. Your continued use of the Services after an update takes effect means you accept the revised Policy, except where consent is required.

14. Contact

For privacy questions, requests, or complaints:

Privacy: privacy@livegen.ai
Data protection contact / DPO: dpo@livegen.ai
General support: support@livegen.ai
Legal / IP: legal@livegen.ai
Mailing address: comiaos, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, US
EU / UK representative: where a representative under Article 27 of the EU/UK GDPR is required, we will appoint and identify one; EEA/UK users can contact dpo@livegen.ai in the meantime

15. Region-specific notices

EEA, UK, and Switzerland. LiveGen (or its appointed representative) is the controller for the processing described here. Our legal bases are in Section 3; facial/biometric processing relies on your explicit consent. You may lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office). Where an EU/UK representative is required under Article 27 GDPR, we will appoint and identify one; in the meantime, EEA/UK users can contact our data protection team at dpo@livegen.ai.

California. This section supplements the above for California residents under the CCPA/CPRA. We collect the categories of personal information described in Section 2 (including identifiers, commercial information, internet activity, geolocation (approximate), and sensitive personal information such as account credentials and biometric/facial data used to run the transforms), for the purposes in Section 3, and disclose them to the recipients in Section 5. We do not sell or share personal information, and we do not use sensitive personal information for purposes beyond those allowed without a right-to-limit. California residents may exercise the rights in Section 9 by contacting privacy@livegen.ai.

Other US states. Residents of other US states with comprehensive privacy laws have the rights described in Section 9, exercisable by contacting privacy@livegen.ai. Where a state law provides an appeal process for a denied request, we will honor it.

This Privacy Policy is cross-referenced by, and should be read together with, the LiveGen Terms of Service.