Privacy Policy

Banana Studio (“we,” “us,” or “our”) operates an AI-powered text-to-image generation service. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services.

Important: Banana Studio is an independent, third-party service. We are not affiliated with, endorsed by, or sponsored by Google, Alphabet Inc., or the official model owner. Banana Studio is powered by Google Nano Banana model.

By using our Service, you consent to the data practices described in this Privacy Policy. If you do not agree with this policy, please do not use the Service.

We collect the following types of information:

2.1 Information You Provide

• Account Information: When you sign in with Google, we receive your name, email address, and profile picture from Google OAuth.
• Prompts: The text prompts you submit to generate images. We may retain truncated versions for debugging and abuse prevention.
• Payment Information: If you subscribe, payment details are collected and processed by Creem. We do not store your full credit card number.

2.2 Information Collected Automatically

• IP Address: We collect and hash IP address prefixes for rate limiting and abuse prevention. We do not store full IP addresses long-term.
• Anonymous Identifiers: We use signed cookies (nb_anon_id) to track anonymous usage and enforce rate limits.
• Usage Data: We log generation counts, timestamps, generation modes, and error events for analytics and service improvement.
• Device Information: Browser type, operating system, and general device characteristics may be collected via standard HTTP headers.

We use the information we collect to:

• Provide, operate, and maintain the Service
• Process your image generation requests
• Manage your account and subscription
• Process payments and billing
• Enforce usage limits and prevent abuse (rate limiting, fraud detection)
• Improve the Service through analytics and debugging
• Communicate with you about your account, updates, or support requests
• Comply with legal obligations

We use the following cookies and similar technologies:

Essential Cookies: Our cookies are essential for the Service to function. We do not use advertising or third-party tracking cookies.

You can configure your browser to refuse cookies, but this may prevent you from using certain features of the Service.

We use the following third-party services to operate the Service. Each has its own privacy policy governing their use of your data:

• AI Model Providers: Your prompts are sent to third-party AI services to generate images. These providers may process prompts according to their own terms.
• Google OAuth: For authentication. Google receives information about your sign-in requests.
• Creem: For payment processing. Creem collects and processes payment information under their privacy policy.
• Supabase: For database and authentication services.
• Cloudflare: For CDN, security, and Turnstile verification.
• Cloud Hosting Providers: For infrastructure and storage.

We do not sell your personal information.

We may share your information in the following circumstances:

• Service Providers: With third-party vendors who assist in operating the Service (as listed above).
• Legal Requirements: When required by law, court order, or governmental authority.
• Safety and Abuse: To protect the rights, safety, or property of us, our users, or others; to investigate fraud or abuse.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

• Account Data: Retained while your account is active and for a reasonable period after deletion for legal and operational purposes.
• Generated Images: Temporarily cached for delivery and deleted within a short period (typically 24-48 hours). We do not permanently store your generated images.
• Usage Logs: Retained for up to 90 days for analytics and debugging.
• Rate Limit Data: Automatically purged after 48 hours.
• Payment Records: Retained as required for tax and legal compliance.

We implement reasonable technical and organizational measures to protect your information, including:

• Encryption of data in transit (HTTPS/TLS)
• HMAC-signed cookies to prevent forgery
• Secure authentication via OAuth 2.0
• Access controls and audit logging
• Regular security reviews

However, no method of transmission or storage is 100% secure. We cannot guarantee absolute security of your data.

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate data.
• Deletion: Request deletion of your personal data, subject to legal retention requirements.
• Portability: Request your data in a portable format.
• Objection: Object to certain processing of your data.
• Withdraw Consent: Where processing is based on consent, you may withdraw it at any time.

To exercise these rights, please contact us using the information in the Contact section. We will respond within a reasonable timeframe as required by applicable law.

The Service is not intended for children under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately and we will take steps to delete such information.

Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws. By using the Service, you consent to such transfers.

We take steps to ensure that your data receives adequate protection in accordance with this Privacy Policy and applicable law.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify you via email or through the Service.

Your continued use of the Service after changes become effective constitutes your acceptance of the revised policy.

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us at [email protected].