Mango Animate

GDPR overview

Concrete, and more detailed than most. The privacy policy names the publisher as data controller for EU-domiciled users and commits to processing under the GDPR. It also claims operational alignment with the US FTC guidance on mobile privacy disclosures and with California's Online Privacy Protection Act, backed by periodic compliance assessments. An Article 27 representative is designated by name: BONDOC SI SCA, 44 Londra Street, Sector 2, 011764 Bucharest, Romania. Access, rectification, erasure, restriction, objection, withdrawal of consent and portability are all listed, exercised through the published support address, with a right to complain to a local supervisory authority. Two gaps stand out: no standard contractual clauses are cited for the transfer to the United States, which rests on contractual necessity alone, and no data processing agreement is offered. Governing law remains that of Hong Kong.

Who owns the data?

The terms are unusually direct: you retain full ownership of your User Content, meaning both what you upload and what the service generates for you. Mango Animate disclaims any ownership claim over that material. In exchange you grant the publisher a non-exclusive, royalty-free, worldwide and limited licence to use, modify, reproduce, display and translate it, strictly so the service can operate. Content you keep private is excluded from distribution outside the platform. The privacy policy adds that your data and submissions are never sold, and that deleting an item or closing the account ends retention.

Reuse rights

Because ownership stays with you, reusing your own output needs no permission: exports can be published, shared or sold within the licence attached to your plan. That licence is the real gate. Free-tier exports carry a Mango AI watermark and a personal-use licence, while commercial rights arrive with the Pro tier. Note that the pricing page contradicts itself on Starter, billing it as a commercial licence on the plan card and as personal use in the comparison table just below, so Pro is the safe choice if you intend to sell the result. On the publisher's side, uploads also feed AI model research and fine-tuning unless you ask to be excluded.

Data retention & training

Hosting summary

Hosting is unambiguous and unusually restrictive. The privacy policy states that all collected data is transferred to the United States for processing and that nothing is backed up outside the country. There is no regional option, no EU residency and no way to elect a jurisdiction. Infrastructure sits with Amazon Web Services, Linode and Cloudflare, which hold uploaded and generated content on a temporary basis; the publisher then moves user submissions to its own in-house servers for generation and model fine-tuning. The wider subprocessor roster is drawn from the United States, the United Kingdom, Hong Kong, Ireland, Romania and unnamed other countries. Photos, face data and rendered output are described as encrypted throughout the pipeline. At network level the domain resolves to a Cloudflare anycast address, so the serving edge says nothing about where processing actually happens — the policy text does. For a European buyer the practical consequence is straightforward: the transfer rests on contractual necessity, no standard contractual clauses are cited, and the governing law claimed elsewhere in the documents is that of Hong Kong.