Privacy Policy

Effective and last updated: August 12, 2026

This policy explains how First Take Lab (“we”, “us”, or the “service”) handles information when you visit firsttakelab.com, create an account, buy credits, or generate media. First Take Lab is an independently operated AI video tool and is not affiliated with ByteDance.

Information we process

Account information

When you create an account, we process the account identifier, email address, profile information supplied by the sign-in method, authentication records, credit balance, subscription status, and account settings.

Generation content and task records

We process the prompts, model choice, generation settings, uploaded-media URLs, task status, provider request identifier, output URL, credit charge, failure reason, and timestamps needed to provide the generation service. Do not upload content you are not authorized to use or information you do not want processed by an AI inference provider.

Payments

The checkout provider presented to you may be Stripe, Creem, or PayPal, depending on current configuration and availability. The payment provider processes card or payment-account details under its own privacy terms. First Take Lab stores transaction references, product, amount, currency, status, and the records needed to credit your account; we do not store full card numbers.

Security, rate-limit, and technical data

We process request metadata needed to operate and secure the service, such as IP-derived abuse-control identifiers, browser/device information, timestamps, error logs, and request status. Generation rate-limit records store a keyed, irreversible IP hash rather than the raw address in the generation-attempt ledger.

Analytics

If analytics is configured, Google Analytics and/or PostHog may receive page, referral, device, and product-event data. Product events are designed to exclude prompts, uploaded-media URLs, and email addresses. Browser controls or blocking tools may limit analytics collection.

Why we use information

We use the information above to:

• authenticate accounts and preserve settings;
• check balances, process purchases, and maintain transaction records;
• submit generation requests, show status, return results, and settle eligible failure refunds;
• enforce content-safety, fraud, abuse, account, and IP rate limits;
• diagnose errors and improve the product experience;
• comply with lawful requests and protect users, the service, and third parties.

Service providers and disclosures

We disclose only the information required for a provider to perform its function. Current provider categories include:

• fal.ai for hosted AI inference; generation inputs and an irreversible end-user identifier are sent for supported requests;
• Cloudflare for hosting, networking, storage, security, and the production database;
• authentication providers selected during sign-in;
• Stripe, Creem, or PayPal when used for checkout and payment processing;
• Google Analytics and/or PostHog when configured for analytics.

We may also disclose information when reasonably necessary to comply with law, enforce our terms, investigate abuse, or protect rights and safety. We do not sell personal information as a data-broker product.

Retention

We retain account, transaction, generation, security, and support records for as long as needed to provide the service, maintain accurate credits and accounting, resolve disputes, prevent abuse, and meet legal obligations. Different records may have different retention periods. Provider-hosted outputs can be subject to the provider’s retention rules. You should download outputs you need to keep.

Security

We use access controls, managed infrastructure, transport encryption, server-side secrets, and keyed identifiers intended to reduce exposure of raw account and network identifiers. No internet service can guarantee absolute security.

Your choices and requests

Depending on where you live, you may have rights to request access, correction, deletion, restriction, portability, or objection. You may also ask us to close your account. Some transaction, fraud-prevention, security, or legal records may need to be retained.

Send a request from the email associated with the account to huangxiaofeng775@gmail.com. We may need to verify the request before acting on it.

Children

The service is not directed to children under 13, and users must be old enough to agree to the Terms of Service in their jurisdiction. Do not submit personal data or images of minors without a lawful basis and appropriate authorization.

International processing

Our providers may process information in countries other than yours. Those locations can have different data-protection laws. We use providers and contractual arrangements appropriate to the service we operate.

Changes and contact

We may update this policy as the product or providers change. The updated date above identifies the current version. Material changes will be posted on this page.

Privacy questions or requests: huangxiaofeng775@gmail.com