Privacy Policy
Last Updated: 2026-08-02
Nano Banana Pro ("we", "us" or "our") is committed to protecting your privacy. This Privacy Policy ("Policy") explains how we collect, use, store and share your personal information when you use Nano Banana Pro (the "Service"), and the rights available to you.
Please read this Policy carefully before using the Service. By using the Service, you agree to this Policy. We may update this Policy from time to time and will notify you of material changes by email or in-product notice.
1. Data Controller
- Service: Nano Banana Pro — https://nano-banana-pro.com
- Operator / data controller: an independent developer (sole trader) operating Nano Banana Pro
- Privacy contact: support@nano-banana-pro.com
- Data Protection Officer (DPO): not applicable — we do not carry out large-scale or high-risk processing that would require one
2. Personal Information We Collect
2.1 Information You Provide Directly
- Account information — your name, email address and, where you sign up with a password, a securely hashed password. If you sign in with Google or GitHub, we receive the basic profile information (name, email, avatar) shared by that provider.
- Generation inputs — the text prompts you enter and any reference images you upload.
- Payment information — the transaction amount, currency, payment status, invoice id and the email address used for payment. We never receive or store your full card number; card data is handled exclusively by our payment processor (see Section 5).
- Communications — the emails, support requests and reports you send us.
2.2 Information We Collect Automatically
- Generated content — the images and videos produced for you, retained so you can revisit, download and re-generate them from your history.
- Device and network data — IP address, device type, operating system, browser type, language and time zone.
- Usage data — pages visited, features used, generation history, model selected and credit consumption.
- Log data — request timestamps, error logs and performance metrics.
- Content-safety records — the outcome of the automated safety scan applied to each prompt (verdict, matched policy categories and a scan reference id), retained so that moderation decisions can be audited and appealed.
- Marketing attribution — UTM parameters and referrer information from the link you arrived through, used to understand which channels bring us users.
3. How We Use Your Information
| Purpose | Legal Basis |
|---|---|
| Delivering and maintaining the Service, including generating your content | Contract performance |
| Billing, credit management and payment processing | Contract performance |
| Customer support and handling reports | Contract / Legitimate interests |
| Service notifications (billing, security, policy changes) | Legitimate interests |
| Content safety, abuse prevention, security and fraud prevention | Legitimate interests / Legal obligation |
| Product analytics and improvement | Legitimate interests |
| Legal and tax compliance | Legal obligation |
| Marketing emails about new features and offers | Your consent |
We may aggregate or anonymise data for statistical purposes. Such data cannot be linked back to any individual.
We do not use your prompts, reference images or generated content to train AI models without your explicit consent.
4. Cookies and Tracking Technologies
| Type | Purpose | Disableable |
|---|---|---|
| Strictly necessary | Login sessions, core functionality | No |
| Functional | Language and theme preferences | Yes |
| Analytics | Anonymous usage statistics, product optimisation | Yes |
| Attribution | Remembering which campaign brought you to the site | Yes |
Depending on our current configuration, the analytics tools we may use include Google Analytics, Vercel Analytics, Microsoft Clarity, Plausible and OpenPanel. You can manage cookies through your browser settings.
5. Sharing and Disclosure
We do not sell your personal information, including as defined under laws such as the CCPA. We share your information only in the following circumstances:
- Payment processing — payments are handled by Waffo Pancake, which acts as our Merchant of Record. They receive your email address, billing details and transaction data in order to process the payment, calculate tax and issue the invoice. Payment card data is processed exclusively by their PCI-DSS certified infrastructure and is never stored on our servers.
- AI model providers — to generate your content, your prompt and any reference images are transmitted to the third-party model providers listed in Section 2.4 of our Terms of Service, through the API gateways we use. They process this data to produce the output and are bound by their own terms and privacy policies.
- Content safety — text prompts are sent to Waffo Prompt Sift (
api.waffo.ai) for a real-time safety check before generation, as described in our Acceptable Use Policy. - Infrastructure providers — hosting, database, object storage and email delivery vendors, acting as processors under confidentiality obligations.
- Analytics providers — as listed in Section 4.
- Legal requirements — where required by law, court order or a lawful regulatory request, and where necessary to report content that endangers children or public safety.
- Business transfers — in a merger, acquisition or similar event, with advance notice and continued protections.
- With your consent — for any other purpose, with your explicit prior consent.
6. Data Security
- Encryption in transit via TLS / HTTPS.
- Passwords are stored hashed; secrets and API keys are held in server-side environment configuration and are never exposed to the browser.
- Least-privilege access controls; administrative access is limited to the operator.
- Regular dependency updates and security review.
In the event of a security incident affecting your rights, we will notify you and the relevant authorities within 72 hours of discovery, as required by applicable law. Please keep your credentials secure and do not share them.
7. Data Retention
| Data Type | Retention Period | Upon Expiry |
|---|---|---|
| Account information | While the account is active; 90 days after deletion or cancellation | Deleted or anonymised |
| Prompts, reference images and generated content | While the account is active; 90 days after account deletion | Deleted |
| Transaction and invoice records | As required by tax and accounting law, typically 7 years | Retained in restricted archive |
| Content-safety scan records | 12 months | Deleted |
| Support and report records | 24 months | Securely deleted |
| Security and access logs | 12 months | Securely deleted |
8. Your Data Rights
To exercise any of the rights below, contact support@nano-banana-pro.com from your registered email address. We respond within 30 calendar days.
| Right | Description |
|---|---|
| Right to be informed | Know what data we collect and how we use it |
| Right of access | Obtain a copy of your personal information |
| Right to rectification | Correct inaccurate or incomplete data |
| Right to erasure | Request deletion of your account and content |
| Right to restrict processing | Temporarily suspend processing in certain cases |
| Right to data portability | Receive your data in a machine-readable format |
| Right to object | Object to processing based on legitimate interests or marketing |
| Right to withdraw consent | Withdraw consent for consent-based processing at any time |
You may also lodge a complaint with your local data protection authority.
9. Marketing and Opt-Out
With your consent, we may send you emails about new features, model additions and offers. You can opt out at any time by clicking "Unsubscribe" in any such email or by contacting us. Opting out does not affect essential service notifications such as billing receipts and security alerts.
10. International Data Transfers
Our infrastructure and the third-party services we rely on (hosting, storage, payment processing, AI model providers) may be located outside your country. For international transfers we rely on data processing agreements incorporating EU Standard Contractual Clauses, or on transfers to recipients providing an equivalent level of protection.
11. Children's Privacy
The Service is intended for users aged 18 and above. We do not knowingly collect information from children. If you believe a child has provided us with personal information, contact us immediately and we will delete it promptly.
12. Third-Party Links and Services
The Service may link to or integrate with third-party services. This Policy applies only to data we collect directly. We are not responsible for the privacy practices of third parties and encourage you to review their policies.
13. Policy Changes
For material changes we will give at least 15 days' advance notice by in-product announcement or to your registered email, and update the "Last Updated" date at the top of this page. Continued use after the effective date constitutes acceptance.
14. Contact Us
- Privacy, support and data requests: support@nano-banana-pro.com
- Service: Nano Banana Pro — https://nano-banana-pro.com
- Operator: an independent developer (sole trader)
This Privacy Policy is provided for general reference and does not constitute legal advice.
Nano Banana Pro · https://nano-banana-pro.com