Privacy Policy

What wan40.org (Wan 4.0 AI Studio) collects, how prompts and uploads are encrypted and purged, and how to exercise your privacy rights.

Nov 13, 2026

This policy describes how wan40.org (Wan 4.0 AI, the “site”, “we”, “us”) handles information when you visit and use https://wan40.org.

It applies solely to wan40.org. It does not govern Alibaba Cloud Model Studio, third-party payment processors, or external websites linked from our pages.

Effective 14 November 2026. Privacy contact: hello@wan40.org.

wan40.org is an independent third-party studio built on Alibaba's Wan video model family (wan3.0-video and wan3.0-video-prime active today). We are not Alibaba and not Alibaba Cloud.

0. Key answers up front

Are my prompts or uploads used to train AI models? wan40.org has no foundation model of its own, builds zero training datasets from customer prompts, images, PDFs, or generated clips, and never sells customer content. Live video inference runs over Alibaba Cloud Model Studio's API. Alibaba documents its data practices in the Model Studio privacy notice and the Qwen and Wan training-data disclosure (which notes customer business data is not used to develop or improve models without explicit consent). All transport between your browser, our Workers runtime, object storage, and upstream APIs uses TLS 1.3 encryption, and upstream temporary render links/caches expire within 24 hours.

Is commercial use included? Yes, on every paid plan and credit pack. There is no separate commercial add-on and no watermark on paid exports. See Terms §4 and Pricing.

Do failed generations cost credits? No. Failed jobs, safety-scan refusals (checked before debit), and upstream jobs that expire unclaimed after 24 hours return 100% of credits automatically. Unused first-purchase credits also qualify for our 7-day refund window under our Refund Policy.

1. Information we collect

Email address
Display name, if provided by you or your sign-in provider
A salted password hash if you register with email and password
OAuth tokens/profile identifiers when signing in with Google or GitHub
Locale preference, first-touch attribution (utm_source when present), and IP address recorded at sign-up

Generation workspace data

Text prompts, studio settings (model tier, duration, aspect ratio, resolution, Single-Take Lock), and any reference images, keyframes, video clips, PDFs, or public web URLs you submit
Output video files, task metadata, model ID (wan3.0-video or wan3.0-video-prime), and task IDs

Billing information

We never store raw card numbers or CVV codes. Checkout is handled by the payment processor named at checkout (such as Stripe, or another supported processor shown at checkout). We store your customer/subscription reference ID, purchased plan or credit pack, credit ledger history, and refund records.

Usage, device, and security information

Request metadata, page views, and generation lifecycle events (started, succeeded, failed)
IP address (cf-connecting-ip via Cloudflare) for rate limiting, abuse prevention, and per-network account caps
Operational error logs and diagnostic task traces
Bot-verification tokens (Cloudflare Turnstile) when security checks are active

Cookies and local storage

h3_vid: first-party HttpOnly visitor cookie (up to 1 year) used for workspace session continuity and abuse rate limiting. The cookie name comes from the underlying framework and does not identify a specific AI model
Authentication session cookies issued by Better Auth
Preference & attribution values (NEXT_LOCALE, notice-dismiss flags, utm_source) in cookies or browser localStorage
Optional analytics (Google Analytics or Microsoft Clarity), only if explicitly enabled in site configuration

We do not collect biometric templates, health records, or precise GPS coordinates, and we do not knowingly collect data from anyone under 16 (see Section 11).

2. How we collect information

Directly from you when you register, submit prompts or media in the studio, adjust settings, or email hello@wan40.org
Automatically through essential session cookies, Cloudflare edge telemetry, and security checks
From service providers such as OAuth identity providers (Google/GitHub), payment processors (Stripe/checkout partners), and upstream video inference endpoints returning job status or output media

3. How we use information

Authenticate accounts, maintain credit balances, and execute requested video generations
Store finished exports in My Creations for download
Process plan renewals, credit packs, and refunds under our Refund Policy
Prevent automated abuse, enforce Responsible Use, and debug failed renders
Send transactional account emails (email verification, password resets, billing notices)
Meet tax, accounting, anti-fraud, and legal compliance obligations

4. Legal bases (EEA, UK, and similar jurisdictions)

Contract performance: providing the studio workspace, executing generations, and managing credits/billing
Legitimate interests: platform security, abuse prevention, troubleshooting failed jobs, and reliability monitoring
Consent: optional non-essential analytics where prior consent is required
Legal obligation: tax retention, dispute resolution, and lawful authority requests

If you are in the EEA, UK, or Switzerland, you may object to legitimate-interest processing by writing to hello@wan40.org.

We share only the minimum data needed for each provider to perform its role:

Party	Purpose
Upstream model providers (Alibaba Cloud Model Studio)	Prompt, reference media, and generation parameters needed to render your clip
Payment processors (Stripe and any processor named at checkout)	Payment authorization, invoicing, tax handling, and refunds
Cloud infrastructure (Cloudflare Workers, D1 database, R2 object storage)	Application hosting, account/credit database, and temporary file storage
Transactional email providers (Brevo / Resend when active)	Account verification and password-reset emails
Auth providers (Google, GitHub)	Completing social sign-in flows you initiate
Bot protection (Cloudflare Turnstile)	Separating human users from scripted abuse
Legal authorities	Only when legally compelled (such as mandatory NCMEC reporting under Responsible Use)

We do not sell personal information and do not share personal information for cross-context behavioural advertising under CCPA/CPRA.

6. International data transfers

wan40.org runs on Cloudflare's global edge network, while payment processors and upstream model APIs may process requests in the United States, Asia-Pacific, or other jurisdictions. Where required, transfers rely on providers' published Standard Contractual Clauses or applicable adequacy frameworks.

7. Data retention

Data Category	Retention Window
Temporary studio inputs / upstream links	Upstream output links and temporary inference caches expire within 24 hours
Signed-in finished videos	Stored in your account's R2 workspace for approximately 7 days (unless you delete them earlier via My Creations) so you have time to download your paid exports after upstream links expire
Account profile	Retained while your account remains open; deleted or anonymised after a verified deletion request (subject to legal holds below)
Billing & credit ledger	Retained as long as required by tax, accounting, and card-network dispute rules
Security & error logs	Short operational window, then rotated
Visitor cookie `h3_vid`	Up to 1 year, or until cleared in your browser

8. Your privacy rights

Depending on where you live (including Australia, the EEA, UK, Switzerland, or US state privacy laws), you may ask us to:

Access a copy of the account data we hold about you
Correct inaccurate profile information
Delete your account and stored outputs within our control
Export portable account metadata where technically feasible
Restrict or object to specific processing
Withdraw consent for optional analytics

Email hello@wan40.org from your registered account address with subject Privacy request. We respond within 30 days (or shorter where required by local law) without charging a fee for valid requests. You may also lodge a complaint with your local data protection authority (such as the OAIC in Australia, the UK ICO, or an EU supervisory authority).

9. Cookies and tracking controls

Strictly necessary cookies (h3_vid, auth session cookies, Turnstile tokens) are required for sign-in, security, and generation requests to work.
Preference state (NEXT_LOCALE, UI flags) keeps language and layout state across reloads.
You can clear or block cookies via browser settings at any time (blocking essential session cookies will prevent signed-in studio access).

10. Security

All web traffic and API transfers use HTTPS / TLS encryption in production with HSTS enabled
Authentication and visitor identifiers use HttpOnly cookies
Administrative endpoints require operator authentication
Payment credentials never touch our database

No online system guarantees absolute security; if a breach legally requiring user notice occurs, we will notify affected account holders by email promptly.

11. Children

wan40.org is not directed to anyone under 16. Do not register an account or upload imagery or voices depicting minors. If we discover personal information collected from a child under 16, we will remove it promptly.

12. Data controller and contact

Operator / Data Controller: Hao Lin (sole trader)
Address: 35 Parkes Road, Melbourne, Victoria 3004, Australia
Email: hello@wan40.org

13. Changes to this policy

When this Privacy Policy changes, we update the Effective and updated_at dates at the top of wan40.org/privacy and email registered users when material changes require notice. Continued use after the updated effective date constitutes acceptance of the revised policy.

About · Terms of Service · Refund Policy · Responsible Use · Report Content · Contact

Written and maintained by the wan40.org editorial teamPublished 25 August 2026Last updated 14 November 2026