Last updated: March 16, 2026
Tornads ("we", "us", "our") operates the website tornads.ai (the "Service"). This Privacy Policy explains how we collect, use, and protect your personal data in accordance with the General Data Protection Regulation (GDPR) and applicable French data protection laws.
Data Controller: Tornads, auto-entrepreneur — SIRET 52153618500049
Contact: hello@tornads.ai
1. Data We Collect
1.1 Account Data
When you create an account, we collect your email address and, if you choose, your name and profile picture. Authentication is handled via Supabase Auth.
1.2 Payment Data
Payments are processed by Stripe. We do not store your credit card number or full payment details on our servers. Stripe acts as an independent data controller for payment data it processes.
1.3 Content You Upload
You may upload images, videos, logos, and other media to create video ads. These files are stored in our infrastructure (Supabase Storage) and are used solely to provide the Service to you.
1.4 Generated Content
When you use our AI-powered tools, we process the information and media you provide to generate videos, images, scripts, and voiceovers. Generated content is stored in your account.
1.5 Usage Data
We collect basic usage data such as pages visited, features used, browser type, and device information to improve the Service. This data is collected through essential cookies (see our Cookie Policy).
2. How We Use Your Data
We process your personal data for the following purposes:
- Service delivery — to provide, maintain, and improve the Service (legal basis: contract performance)
- Account management — to manage your account and authenticate you (legal basis: contract performance)
- Payment processing — to process subscriptions and payments via Stripe (legal basis: contract performance)
- Service improvement — to analyze usage patterns and improve features (legal basis: legitimate interest)
- Communication — to send you service-related notifications and, with your consent, marketing communications (legal basis: consent or legitimate interest)
- Legal obligations — to comply with applicable laws (legal basis: legal obligation)
3. Data Sharing
We do not sell your personal data. We share data only with the following categories of service providers, strictly as needed to operate the Service:
- Supabase — database hosting and authentication
- Vercel — web application hosting
- Cloudflare — CDN and security
- Stripe — payment processing
- AI service providers — to generate video content, voiceovers, and images as part of the Service (your content is processed but not used to train third-party models)
4. International Data Transfers
Some of our service providers are located outside the European Economic Area (EEA). When data is transferred outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or adequacy decisions by the European Commission.
5. Data Retention
We retain your personal data for as long as your account is active or as needed to provide the Service. When you delete your account, we delete your personal data and uploaded content within 30 days, except where we are required by law to retain certain data (e.g., invoicing records for 10 years under French law).
6. Your Rights
Under the GDPR, you have the following rights regarding your personal data:
- Access — request a copy of your data
- Rectification — correct inaccurate data
- Erasure — request deletion of your data
- Restriction — restrict processing of your data
- Portability — receive your data in a structured, machine-readable format
- Objection — object to processing based on legitimate interest
- Withdraw consent — where processing is based on consent, withdraw it at any time
To exercise any of these rights, contact us at hello@tornads.ai. We will respond within 30 days.
You also have the right to lodge a complaint with the French data protection authority (CNIL): www.cnil.fr.
7. Children's Privacy
The Service is available to users aged 13 and above. We do not knowingly collect personal data from children under 13. If you are between 13 and 16, parental consent may be required under applicable law. If we learn that we have collected data from a child under 13, we will delete it promptly.
8. Security
We implement appropriate technical and organizational measures to protect your data, including encryption in transit (TLS), access controls, and regular security reviews. However, no method of transmission over the internet is 100% secure.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.
10. Contact
For any questions about this Privacy Policy or your personal data, contact us at: hello@tornads.ai