Privacy Policy
Last updated: 11 November 2026
This Privacy Policy explains how CYBERSHEILD PTE. LTD., a company incorporated in the Republic of Singapore, doing business as MIST Ai ("MIST Ai", "we", "us") collects, uses, shares and protects personal data when you visit our website at mistai.ai (the "Site"), contact us, or use the video-generation API access we resell (the "Services").
The Services are offered only to business customers outside mainland China. They are not intended for consumers or for anyone under 18.
1. Who we are and our role
MIST Ai is an authorized reseller of these services, as permitted under its agreements with BytePlus and Alibaba Cloud. We give business customers access to third-party video-generation models:
- Seedance on BytePlus ModelArk, Singapore region (
ap-southeast-1) - Wan on Alibaba Cloud Model Studio (international), Singapore region
We do not build, train or host these models. After a customer signs a contract, we provision a sub-account for it under our upstream cloud account: a BytePlus IAM sub-account or an Alibaba Cloud RAM sub-account. The customer then uses the upstream console and API directly.
Our role depends on the data:
| Data | Our role |
|---|---|
| Website visitors, sales leads, form submissions, customer contacts, billing and account records | Controller (GDPR) / organisation (Singapore PDPA) |
| Prompts, reference images, video and audio, and generated outputs submitted through a customer's sub-account ("Customer Content") | Processor (GDPR) / data intermediary (PDPA), acting on the customer's instructions. The upstream provider acts as our sub-processor. |
2. Personal data we collect
a. Data you give us
- Contact and lead data: name, work email, company, job title, country, phone or messaging handle (if you give one), and the content of your message. This includes the "Get API access" and "Talk to sales" form (including requests for a model we do not list).
- Contract and account data: authorised contacts, billing contacts, invoicing details, sub-account usernames, and the console permissions we assign.
- Support data: your correspondence with us and any files you choose to send.
b. Data collected automatically on the Site
- Device and log data: IP address, browser type, pages viewed, referring URL, and timestamps.
- Cookie data. See section 9.
c. Usage and billing data from upstream providers
- Metered usage per sub-account (for example tokens, seconds of video, request counts, model and region), which we use to bill you and to support you.
d. Customer Content
- Customer Content goes from your systems straight to the upstream provider's API under your sub-account. We do not routinely access or store Customer Content. As the holder of the main upstream account, we may be technically able to see sub-account resources, usage records and logs in the upstream console. MIST Ai staff may access that information, and Customer Content if it is visible to the main account, only: (i) to provide support at your request; (ii) to investigate security incidents, fraud, abuse or suspected breaches of the Terms or the Compliance & Acceptable Use Policy; (iii) to meet a legal, regulatory or Upstream Provider requirement; or (iv) to bill and administer the Services. Any such access will be limited to personnel who need it. Adult or sexually explicit material must not be submitted as Customer Content.
- Customer Content can include personal data, such as images, video or voice of real people. You are responsible for having a lawful basis and any consents needed for this data. See the Compliance & Acceptable Use page.
We do not knowingly collect special-category or sensitive personal data through the Site. Please do not submit it in forms.
3. How we use personal data and our legal bases
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Replying to enquiries and model requests; sales follow-up | Legitimate interests; steps before entering into a contract |
| Signing and performing contracts; provisioning sub-accounts; billing | Performance of a contract; legal obligation (tax and accounting) |
| Customer support and service notices, such as upstream changes and deprecations | Performance of a contract; legitimate interests |
| Security, fraud prevention, enforcing our Terms and Acceptable Use Policy | Legitimate interests; legal obligation |
| Export-control and sanctions screening | Legal obligation; legitimate interests |
| Operating, securing and improving the Site | Legitimate interests |
| Marketing emails to business contacts | Consent or legitimate interests, as local law allows. You can opt out at any time. |
Under the Singapore PDPA, we collect, use and disclose personal data with your consent, deemed consent, or under an applicable exception, and only for purposes a reasonable person would consider appropriate.
We do not sell personal data. We do not use Customer Content to train any model.
4. Sub-processors and other recipients
We share personal data only as follows:
| Recipient | Purpose | Location |
|---|---|---|
| BytePlus (BytePlus Pte. Ltd. or the BytePlus contracting entity for our account) | Hosting and processing Customer Content for Seedance on BytePlus ModelArk; sub-account identity (IAM); usage metering | Console / API endpoint: Singapore region (ap-southeast-1). BytePlus's public ModelArk data-processing documentation states that data centres and Customer Data processing may also be located in Malaysia, Indonesia and/or the EU/EEA, and that input and output triggered by the content filter may be retained for 180 days in Malaysia. |
| Alibaba Cloud (the Alibaba Cloud international contracting entity for our account) | Hosting and processing Customer Content for Wan on Alibaba Cloud Model Studio; sub-account identity (RAM); usage metering | Console / workspace: Singapore region, unless your Order Form states another authorised region. Alibaba Cloud International Website Product Terms §4.48.1(g)(viii) state that Member Content may be transferred to, stored and processed in any country where Alibaba Cloud, its affiliates or its sub-contractors maintain facilities for Model Studio Service. |
| Professional advisers, auditors, authorities | Legal, accounting, compliance; responding to lawful requests | As required |
We also use service providers to host the Site, to receive form submissions and email, and to process invoices or payments. A current list is available on request at api@mistai.ai.
Upstream providers process data under their own terms and privacy documents, including the BytePlus Privacy Policy, the BytePlus Data Processing Addendum, the Alibaba Cloud International Website Privacy Policy and section 4.48 of the Alibaba Cloud International Website Product Terms of Service. Alibaba Cloud's Product Terms say it will not use Model Studio Member Content to develop or improve its models without separate consent. BytePlus's public ModelArk data-processing documentation states that, without the customer's prior authorization, BytePlus ModelArk will not use Customer Data for its own model training.
For customers who have signed a Data Processing Addendum with us, we will give advance notice of changes to our sub-processors, normally at least 30 days. If an Upstream Provider requires a change on shorter notice, we will notify those customers as soon as reasonably practicable.
5. Where data is stored and international transfers
- Customer Content – region and actual processing locations. Your console or API endpoint is in the Singapore region of the Upstream Provider you use (BytePlus ModelArk
ap-southeast-1; Alibaba Cloud Model Studio international, Singapore region, unless your Order Form states another authorised region). That regional designation is not a promise that all processing stays in Singapore. Public upstream terms and documentation provide as follows: (i) Alibaba Cloud International Website Product Terms §4.48.1(g)(viii) state that Member Content will be transferred to, stored, and processed in the country where Alibaba Cloud, its affiliates, or its sub-contractors maintain facilities for Model Studio Service, which may be a different jurisdiction; (ii) BytePlus's ModelArk data-processing documentation states that data centres and Customer Data processing may be located in Malaysia, Indonesia and/or the EU/EEA, and that input and output triggered by the content filter may be retained for 180 days in Malaysia. - Our business records are stored by us or by our service providers.
- Where personal data from the EEA, the UK or Switzerland is transferred to a country that is not the subject of an adequacy decision, including Singapore, we will use a transfer mechanism required by applicable law, typically the European Commission's Standard Contractual Clauses and, where applicable, the UK International Data Transfer Agreement or Addendum, plus supplementary measures where needed. For transfers out of Singapore, we will take steps to ensure the recipient provides protection comparable to the PDPA.
6. Retention
| Data | Retention |
|---|---|
| Sales leads that don't become customers | 24 months after last contact, then deleted or anonymised |
| Customer contract, account and billing records | Contract term plus 5 years |
| Support correspondence | 3 years after the ticket is closed |
| Site logs | 12 months |
| Customer Content | Set by upstream retention. For example, Seedance result URLs on BytePlus ModelArk are documented as valid for 24 hours and Wan task results on Alibaba Cloud Model Studio for 24 hours. Download and store outputs yourself. When a sub-account is closed, we will deactivate the sub-account and request deletion of associated resources where the upstream console allows. |
7. Security
We use administrative, technical and organisational measures appropriate to the risk.
Sub-account credentials and API keys are held by you. Keep them confidential. See our Terms of Service.
If a personal data breach affects you, we will notify you and the relevant authorities as the law requires. This includes the GDPR 72-hour regulator notification where applicable and the PDPA notifiable data breach regime.
8. Your rights
Depending on where you are, you may have the right to:
- access the personal data we hold about you;
- correct inaccurate data;
- erase data (the "right to be forgotten");
- restrict or object to processing, including direct marketing;
- data portability;
- withdraw consent at any time, without affecting earlier processing;
- lodge a complaint with a supervisory authority. In Singapore this is the Personal Data Protection Commission; in the EEA or UK, your local data protection authority.
To exercise these rights, email api@mistai.ai. We will respond within one month of receipt, or within any shorter period the applicable law requires. We may need to verify your identity.
If your request concerns Customer Content processed on behalf of one of our customers, we will pass it to that customer and help them respond.
9. Cookies
The Site uses only cookies and similar browser storage that are strictly necessary to operate it, for example for security. These don't need consent.
We do not currently use analytics, advertising or cross-site tracking cookies. If we start using analytics cookies, we will name the provider here and ask for your consent where the law requires it. You can control cookies through your browser settings.
10. Children
The Site and Services are for businesses. They are not directed to anyone under 18, and we do not knowingly collect children's personal data.
11. Changes
We may update this Policy. We will post the new version here with a new "Last updated" date. Where changes are material, we will notify customers by email.
12. Contact
CYBERSHEILD PTE. LTD., a company incorporated in the Republic of Singapore, doing business as MIST Ai
Email: api@mistai.ai