隐私政策以中文版本为准
本隐私政策说明 Really.Show（AI 视频创作工作台，下称“本服务”）如何收集、使用、存储、共享与删除你的个人信息。本服务主要面向企业客户，并面向全球用户开放。
1. 适用范围与角色
本政策适用于本服务的网站与工作台（含注册、登录、创作工作台、资产库、创作历史、团队与租户管理）。
角色划分：当你以个人名义注册时，我们就账号数据而言是个人信息处理者；当你的账号由企业客户开通、且该企业以其名义向我们提供你的信息时，我们可能以受托处理者身份处理相关数据。企业客户与其员工/成员之间的告知与授权由其负责。〔企业客户与终端用户的角色划分与合同依据待法务确认〕
2. 我们收集哪些数据
下表按用途归类列出我们服务端实际存储的数据字段（键名为服务端存储中的真实字段名）。我们不收集支付卡号（当前无在线支付），也不采集精确地理位置（地区信息来自注册填写与 IP 归属地推断）。
2.1 账号与身份（users）
- 标识与凭证：
username、email、passwordHash（密码仅以哈希形式存储，我们不保存明文密码）。 - 权限与组织：
roleId、orgRole、orgId、status、mustChangePassword。 - 邮箱验证与密码重置：
emailVerified、emailVerifyToken、emailVerifyCode、emailVerifyExpiresAt、passwordResetToken、passwordResetExpiresAt（一次性、带有效期，用后失效）。 - 时间戳：
createdAt、updatedAt。
2.2 注册画像与登录安全
- 你填写的：
country、region、useCase、platforms（选填的创作市场信息）。 - 注册时自动采集的：
regMeta（来源 Referer/UTM、语言、时区、设备指纹概要等）。 - 登录安全记录：
loginCount、lastLoginAt、lastLoginIp、lastLoginDevice、lastLoginRegion、loginHistory（仅保留最近若干条）。 - 同意留痕：
consent: { at, version, ip }—— 记录你在注册时同意的条款/政策版本、时间与来源 IP。
2.3 创作内容与任务（tasks）
- 产品与创作信息：
productName、payload（提交给模型的结构化输入）、captions、capText（字幕文本）。 - 生成产物路径：
videoPath、videoFilePath、thumbPath。 - 计量与模型：
cost、model、duration。 - 排障信息：
errorRaw、errorDetail（失败原因原文，可能包含上游返回的错误信息）。 - 归属与请求上下文：
userId、userName、tenantId、clientIp、clientTag、clientSession。
2.4 资产库（assets）
- 文件与缩略图地址：
url、thumbUrl；文件属性：name、size、type、status、tags。 - 归属：
ownerId、tenantId、projectId、productName。 - 结构化元数据：
meta；其中产品定义卡meta.productDefinitionCard可能内联包含图片数据（_cardDataUrl）——即该字段本身含有一张产品图的图像数据。
2.5 用量与计费（usage）
每次调用会记录：userId、username、endpoint、task、kind、model、inputTokens、outputTokens、totalTokens、imageCount、videoSeconds、videoTokens、cost、credits、method、status、projectId、projectName。账号余额相关字段为 creditUsed、creditQuota、tokenUsed、tokenQuota。
2.6 审计与安全日志（ops）
为安全与可追溯，管理性操作与部分被拒绝的请求会记录：actorId、actorName、action、target、targetId、ip、details、tenantId、result、timestamp。
2.7 评价数据（ratings）
你对生成结果的评分记录：taskId、userId、score、tenantId。
2.8 我们不收集 / 不使用的
- 不收集支付卡号或银行账号（当前无在线支付；开通与发积分由管理员人工办理）。
- 不采集通讯录、短信、相册（除你主动上传的素材）与精确 GPS 位置。
- 服务端的语音识别接口（
/api/asr）当前为占位实现，前端未接入；因此我们目前不会把你的音频上传给第三方做语音识别。
3. 收集目的与法律依据
| 目的 | 涉及数据 | 法律依据（待法务逐域确认） |
|---|---|---|
| 创建与管理账号、提供登录与创作功能 | 账号与身份、创作内容、资产 | 履行与你（或你的企业客户）之间的合同 |
| 生成内容（调用第三方 AI 处理方） | 你上传的产品图/参考图、提示词、生成产物 | 履行合同 + 你的主动发起（构成该次处理的必要步骤） |
| 计量、扣费与对账 | 用量与计费 | 履行合同；合法利益（防欺诈与对账） |
| 安全、反滥用与限流（含注册风控） | 登录安全记录、regMeta、审计日志 | 合法利益（保护服务与其他用户） |
| 发送事务邮件（邮箱验证、密码重置、通知） | 邮箱地址 | 履行合同 |
| 合规留存与响应监管要求 | 审计日志、同意留痕 | 法律义务 |
| 产品改进（只读统计口径） | 用量聚合数据 | 合法利益 〔是否使用个人级数据待法务确认〕 |
4. 第三方处理方与跨境传输（重要）
我们的生产服务部署在阿里云韩国地域，而面向的是全球用户：这意味着你提交的数据会先传输并存储到位于韩国的服务器，而不是仅停留在你所在的国家/地区。
生成类请求会调用位于中国境内的第三方处理方——火山引擎方舟（Volcengine Ark，图像生成 ark-seedream、视频生成、大模型调用）、MiniMax（视频生成）、阿里云百炼 DashScope（通义万相多角度）、阿里云邮件推送 DirectMail（事务邮件）——因此你的数据（含你上传的产品图与参考图、提示词、生成结果、以及账号邮箱）会发生跨境传输。
跨境传输所依据的具体法律机制（例如标准合同条款 SCC、单独同意、或其他合规路径）尚未确定，待法务确认；本页不声明我们已取得任何认证或已完成任何官方备案。
4.1 第三方处理方清单
| 处理方 | 用途 | 涉及数据 | 所在地 |
|---|---|---|---|
| 火山引擎 方舟（Volcengine Ark） | 图像生成（ark-seedream）、视频生成、大模型调用 | 提示词、参考/产品图、生成结果 | 中国境内 |
| MiniMax（Hailuo / 海螺） | 视频生成（首帧/首尾帧图生视频） | 提示词、参考/首帧图、生成视频 | 中国境内 |
| 阿里云百炼 DashScope | 通义万相多角度生成 | 产品图、生成图 | 中国境内 |
| 阿里云邮件推送 DirectMail | 事务邮件：邮箱验证、密码重置、注册与简报通知 | 收件邮箱、邮件内容 | 中国境内 |
| 阿里云（基础设施） | 服务器托管与运行环境 | 上述服务端存储的数据 | 韩国地域 |
ark.cn-beijing.volces.com、dashscope.aliyuncs.com、api.minimaxi.com、dm.aliyuncs.com）。如我们新增或更换处理方，会按第 9 节通知并更新本表。5. 保留期限
- 账号数据（
users）：在你注销或我们删除账号前保留；当前站内未提供自助注销，需联系我们办理。 - 任务与成片记录（
tasks）：设有保留上限——最多保留最近 5000 条，超过上限的旧记录会被自动清理。 - 审计日志（
ops）：同为最多 5000 条，超过上限的旧记录会被自动清理。 - 用量记录（
usage）：最多保留最近 10000 条，超过上限的旧记录会被自动清理。 - 资产库（
assets）：未设自动上限，在你或管理员主动删除前保留。 - 邮箱验证/密码重置一次性凭证：带有效期，验证或重置后即失效。
- 登录历史：每人仅保留最近若干条。
- 同意留痕（
consent）：与账号同期保留，以便在条款版本变更时证明你的同意。
6. Cookie 与本地存储
我们不使用第三方广告或分析类 Cookie。我们使用的浏览器存储包括：
- 鉴权 Cookie：登录/注册成功后服务端下发 HttpOnly 签名 Cookie，用于页面级鉴权兜底；你的登录令牌同时以
artbus_jwt（localStorage）形式保存在浏览器本地。
| 本地存储键名（localStorage） | 用途 |
|---|---|
artbus_jwt、artbus_user、artbus_user_id、artbus_perms、artbus_session、artbus_logged_out | 登录状态、账号资料与权限缓存 |
artbus_active_pid、artbus_ps_*、artbus_ps_failed_*、artbus_copy_draft_*、artbus_productVisualCard_*、artbus_pc_feedback_*、artbus.history.filter、artbus.history.ui、artbus.agentThinkLog、tunerCategoryDrafts、productcard_fast、productcard_size、digitalHumanAsset、as_history、aura_prompt_config | 项目草稿、面板草稿、创作历史与本地偏好（保存在你自己的浏览器中） |
appTheme、vdoc-theme、appLang | 主题与语言偏好 |
artbus_tenant_name、artbus_tenant_slug、artbus_tenant_kind、artbus_tenant_welcome、artbus_balance、artbus_owner、artbus_style_agent_map、artbus_useProductCard、artbus_req_align_enabled、artbus_boot_seq、artbus_clientTag、artbus_is_new_signup、artbus_is_invite_signup | 租户品牌与界面状态缓存 |
artbusDebug、debugPanelEnabled、debugPanelPos、debugSessionId、auth_denied_role | 调试面板与本地会话标识 |
你可以通过浏览器设置清除这些本地存储；清除后本地草稿与偏好会丢失（服务端已保存的数据不受影响），但你将需要重新登录。
7. 你的权利
我们尽力把可自助完成的部分放在站内，其余需要人工处理。下表如实区分：
| 权利 | 当前实现方式 | 状态 |
|---|---|---|
| 访问你的数据 | 登录后可在「创作历史」「资产库」「账号资料」查看任务、成片、素材与用量；账号资料接口会返回你的账号信息与同意留痕 | 站内自助已支持 |
| 更正数据 | 密码可自助重置（登录页「忘记密码」）；邮箱、国家/地区、用途、发布平台等资料修正目前需联系管理员在后台修改 | 部分自助 + 部分需联系我们 |
| 导出数据 | 创作历史页支持导出 CSV；单条任务的完整轨迹可导出；审计日志可由管理员导出 CSV。完整账号数据导出包尚未提供，需联系我们 | 部分自助 + 完整导出需联系我们 |
| 删除数据 | 素材/资产、任务与项目可在站内删除；账号注销与账号级数据删除当前未提供自助入口，需联系我们（由管理员执行删除） | 内容级自助 + 账号级需联系我们 |
| 撤回同意 / 反对处理 / 限制处理 | 尚未提供自助入口，请通过第 10 节联系方式提出 | 需联系我们 |
| 向监管机构投诉 | 你有权向所在司法辖区的数据保护机构投诉 | — |
8. 未成年人
本服务面向企业与专业创作者，不面向未成年人，我们不会有意收集未成年人的个人信息。若你是未成年人，请不要注册或使用本服务。若我们发现在未经监护人同意的情况下收集了未成年人的个人信息，我们会删除相关数据。如你是监护人并认为我们持有未成年人的信息，请通过第 10 节联系方式告知我们。
〔待法务确认〕各法域对儿童年龄门槛与监护人同意的具体要求不同，需逐域确认。
9. 本政策的变更与通知
本政策修订时会更新页面顶部的版本号与生效日期。发生实质性变更（例如新增第三方处理方、扩大使用目的、变更跨境路径）时，我们会通过站内公告或邮件通知，并在必要时重新征求你的同意。你在注册时勾选同意的版本会被留痕记录，因此我们能够追溯你同意的是哪一版。
10. 联系方式
- 个人信息处理者（运营方）：〔占位：公司主体名称〕
- 隐私与个人信息请求专用邮箱：〔占位：privacy@ 待填写〕
- 法律事务联系邮箱：〔占位：legal@ 待填写〕
- 所在地与邮寄地址：〔占位〕
- 数据保护官（DPO）：当前未任命；是否需要任命及对外公示信息待法务确认。
Privacy PolicyChinese version prevails
This Privacy Policy explains how Really.Show (the AI video creation workbench, the “Service”) collects, uses, stores, shares and deletes your personal information. The Service is primarily offered to business customers and is open to users worldwide.
1. Scope and roles
This policy applies to the Service’s website and workbench (sign-up, sign-in, creation workbench, asset library, creation history, team and tenant management).
Roles: when you sign up as an individual we are a data controller for account data; where an enterprise customer provisions your account and provides your information to us, we may act as a processor. Notice and authorisation between an enterprise customer and its staff/members are the customer’s responsibility. [Controller/processor allocation and contractual basis to be confirmed by legal]
2. What data we collect
The tables below group the fields our server actually stores, using the real field names. We do not collect payment card numbers (no online payment today), nor precise GPS location (region information comes from what you enter at sign-up and from IP-based geolocation).
2.1 Account and identity (users)
- Identifiers and credentials:
username,email,passwordHash(passwords are stored only as a hash; we do not keep plaintext passwords). - Permissions and organisation:
roleId,orgRole,orgId,status,mustChangePassword. - Email verification and password reset:
emailVerified,emailVerifyToken,emailVerifyCode,emailVerifyExpiresAt,passwordResetToken,passwordResetExpiresAt(one-time, expiring, invalidated after use). - Timestamps:
createdAt,updatedAt.
2.2 Sign-up profile and login security
- Provided by you:
country,region,useCase,platforms(optional market information). - Collected automatically at sign-up:
regMeta(referrer/UTM source, language, time zone, device-fingerprint summary). - Login security records:
loginCount,lastLoginAt,lastLoginIp,lastLoginDevice,lastLoginRegion,loginHistory(only the most recent entries). - Consent record:
consent: { at, version, ip }— the version of the Terms/Policy you accepted at sign-up, when, and the originating IP.
2.3 Creation content and tasks (tasks)
- Product/creation data:
productName,payload(structured model input),captions,capText. - Output paths:
videoPath,videoFilePath,thumbPath. - Metering and model:
cost,model,duration. - Troubleshooting data:
errorRaw,errorDetail(raw upstream error text). - Ownership and request context:
userId,userName,tenantId,clientIp,clientTag,clientSession.
2.4 Asset library (assets)
- File and thumbnail locations:
url,thumbUrl; attributes:name,size,type,status,tags. - Ownership:
ownerId,tenantId,projectId,productName. - Structured metadata:
meta; the product definition cardmeta.productDefinitionCardmay embed image data (_cardDataUrl) — i.e. that field itself contains the pixels of a product image.
2.5 Usage and billing (usage)
Each call records: userId, username, endpoint, task, kind, model, inputTokens, outputTokens, totalTokens, imageCount, videoSeconds, videoTokens, cost, credits, method, status, projectId, projectName. Balance fields: creditUsed, creditQuota, tokenUsed, tokenQuota.
2.6 Audit and security logs (ops)
For security and traceability, administrative operations and some rejected requests record: actorId, actorName, action, target, targetId, ip, details, tenantId, result, timestamp.
2.7 Ratings (ratings)
Scores you give to generated results: taskId, userId, score, tenantId.
2.8 What we do not collect
- No payment card or bank account numbers (no online payment; activation and credit grants are handled manually by an administrator).
- No contacts, SMS or photo library (beyond material you actively upload) and no precise GPS location.
- The server-side speech-recognition endpoint (
/api/asr) is currently a placeholder and is not wired up in the frontend; we therefore do not upload your audio to a third party for speech recognition today.
3. Purposes and legal bases
| Purpose | Data involved | Legal basis (to be confirmed per jurisdiction) |
|---|---|---|
| Create and manage accounts; provide sign-in and creation features | Account/identity, creation content, assets | Performance of a contract with you (or your enterprise customer) |
| Generate content (calling third-party AI processors) | Your uploaded product/reference images, prompts, outputs | Contract performance + your initiation of the request (a necessary step of that processing) |
| Metering, charging and reconciliation | Usage and billing | Contract performance; legitimate interests (fraud prevention, reconciliation) |
| Security, anti-abuse and rate limiting (incl. sign-up risk control) | Login security records, regMeta, audit logs | Legitimate interests (protecting the Service and other users) |
| Transactional email (verification, password reset, notices) | Email address | Contract performance |
| Compliance retention and responding to regulators | Audit logs, consent record | Legal obligation |
| Product improvement (aggregate read-only reporting) | Aggregated usage data | Legitimate interests [whether individual-level data is used is to be confirmed by legal] |
4. Third-party processors and cross-border transfers (important)
Our production service is deployed in the Alibaba Cloud Korea region while serving users worldwide: the data you submit is transmitted to and stored on servers located in Korea, not only in your own country.
Generation requests call third-party processors located in mainland China — Volcengine Ark (image generation ark-seedream, video generation, LLM calls), MiniMax (video generation), Alibaba Cloud Bailian / DashScope (Tongyi Wanxiang multi-angle), and Alibaba Cloud DirectMail (transactional email) — so your data (including uploaded product/reference images, prompts, outputs and account email) is subject to cross-border transfer.
The specific legal mechanism for those transfers (e.g. Standard Contractual Clauses, separate consent, or another compliance route) is not yet determined and is pending legal confirmation; this page does not claim any certification or completed official filing.
4.1 Processor list
| Processor | Purpose | Data involved | Location |
|---|---|---|---|
| Volcengine Ark | Image generation (ark-seedream), video generation, LLM calls | Prompts, reference/product images, outputs | Mainland China |
| MiniMax (Hailuo) | Video generation (first-frame / first-last-frame image-to-video) | Prompts, reference/first-frame images, generated video | Mainland China |
| Alibaba Cloud Bailian (DashScope) | Tongyi Wanxiang multi-angle generation | Product images, generated images | Mainland China |
| Alibaba Cloud DirectMail | Transactional email: verification, password reset, sign-up and digest notices | Recipient email address, email content | Mainland China |
| Alibaba Cloud (infrastructure) | Server hosting and runtime | All server-side data described above | Korea region |
ark.cn-beijing.volces.com, dashscope.aliyuncs.com, api.minimaxi.com, dm.aliyuncs.com). If we add or replace a processor we will notify you under section 9 and update this table.5. Retention
- Account data (
users): kept until you close your account or we delete it; no self-service account deletion is available today — contact us. - Task and clip records (
tasks): capped at the most recent 5000 entries; older records beyond the cap are automatically purged. - Audit logs (
ops): likewise capped at 5000 entries, oldest purged beyond the cap. - Usage records (
usage): capped at the most recent 10000 entries, oldest purged beyond the cap. - Asset library (
assets): no automatic cap; kept until you or an administrator delete the item. - One-time email-verification / password-reset credentials: time-limited and invalidated on use.
- Login history: only the most recent entries per user.
- Consent record (
consent): kept for the life of the account so we can evidence your consent when document versions change.
6. Cookies and local storage
We do not use third-party advertising or analytics cookies. The browser storage we use is:
- Auth cookie: a signed HttpOnly cookie issued on sign-in/sign-up as a page-level auth fallback; your login token is also kept locally as
artbus_jwt(localStorage).
| localStorage key | Purpose |
|---|---|
artbus_jwt, artbus_user, artbus_user_id, artbus_perms, artbus_session, artbus_logged_out | Login state, account profile and permission cache |
artbus_active_pid, artbus_ps_*, artbus_ps_failed_*, artbus_copy_draft_*, artbus_productVisualCard_*, artbus_pc_feedback_*, artbus.history.filter, artbus.history.ui, artbus.agentThinkLog, tunerCategoryDrafts, productcard_fast, productcard_size, digitalHumanAsset, as_history, aura_prompt_config | Project drafts, panel drafts, local creation history and preferences (stored in your own browser) |
appTheme, vdoc-theme, appLang | Theme and language preference |
artbus_tenant_name, artbus_tenant_slug, artbus_tenant_kind, artbus_tenant_welcome, artbus_balance, artbus_owner, artbus_style_agent_map, artbus_useProductCard, artbus_req_align_enabled, artbus_boot_seq, artbus_clientTag, artbus_is_new_signup, artbus_is_invite_signup | Tenant branding and UI state cache |
artbusDebug, debugPanelEnabled, debugPanelPos, debugSessionId, auth_denied_role | Debug panel and local session identifier |
You can clear this local storage through your browser settings. Doing so loses local drafts and preferences (data already stored on the server is unaffected) but you will need to sign in again.
7. Your rights
We put what can be self-served in-product; the rest requires human handling. The table below states this honestly:
| Right | How it works today | Status |
|---|---|---|
| Access your data | After sign-in, the Creation History, Asset Library and account pages show tasks, clips, assets and usage; the account API returns your profile and consent record | Self-service in-product |
| Correct your data | Password can be reset yourself via “Forgot password”; correcting email, country/region, use case and platforms currently requires an administrator to edit it in the back office | Partly self-service + partly contact us |
| Export your data | The history page exports CSV; a single task’s full trace can be exported; administrators can export audit logs as CSV. A full account data export bundle is not available yet — contact us | Partly self-service + full export contact us |
| Delete your data | Assets, tasks and projects can be deleted in-product; account closure and account-level deletion have no self-service entry today — contact us (an administrator performs the deletion) | Content-level self-service + account-level contact us |
| Withdraw consent / object / restrict processing | No self-service entry yet; please use the contact details in section 10 | Contact us |
| Complain to a regulator | You may lodge a complaint with the data protection authority in your jurisdiction | — |
8. Minors
The Service is intended for businesses and professional creators and is not directed at minors; we do not knowingly collect minors’ personal information. If you are a minor, please do not register or use the Service. If we learn that we have collected a minor’s personal information without guardian consent, we will delete it. If you are a guardian and believe we hold a minor’s information, please contact us via section 10.
[to be confirmed by legal] Age thresholds for children and guardian-consent requirements differ by jurisdiction and must be confirmed per jurisdiction.
9. Changes and notice
When we revise this policy we update the version number and effective date at the top of the page. For material changes (e.g. a new processor, an expanded purpose, a changed cross-border route) we notify you in-product or by email and, where required, seek your consent again. The version you ticked at sign-up is recorded, so we can trace which version you accepted.
10. Contact
- Data controller (operator): [placeholder: legal entity name]
- Privacy / personal-data requests: [placeholder: privacy@ to be filled]
- Legal matters: [placeholder: legal@ to be filled]
- Registered/postal address: [placeholder]
- Data Protection Officer: none appointed at this time; whether one is required, and the public particulars, are pending legal confirmation.