Nano Banana Bingo

Privacy Policy

Last updated: August 3, 2026

This Privacy Policy explains how Nano Banana Bingo ("Nano Banana Bingo," "we," "us," or "our") collects, uses, discloses, and protects personal information when you visit nanobanana.bingo, create an account, purchase credits or a subscription, generate videos, or otherwise use our websites and related services (collectively, the "Service").

This Privacy Policy does not apply to third-party websites or services that maintain their own privacy policies. If you do not agree with this Privacy Policy, please do not use the Service.

Please also review our Terms of Service, which govern your use of the Service.

1. Scope and Our Role

Nano Banana Bingo provides tools for creating AI-generated video from prompts and optional reference media. For personal information that we decide how and why to process, Nano Banana Bingo acts as the data controller or business, as those terms are used under applicable law. Authentication, payment, analytics, cloud, and AI providers may process information on our behalf or as independent controllers under their own terms.

2. Information We Collect

Account and Google OAuth information

When you sign in through Google OAuth, Google and our authentication provider may provide information you authorize, such as your name, email address, profile image, unique account identifier, authentication provider, and related profile metadata. We use this information to create and secure your account. We do not receive your Google password.

Prompts, uploads, and generated content

We collect content and settings you submit for generation, including prompts, instructions, uploaded images, video clips, audio files, first and last frames, reference media, model selection, duration, resolution, aspect ratio, audio options, and other controls. We also process generated previews, videos, output URLs, and related results.

Uploaded media may contain embedded metadata and may depict or contain information about you or others, including faces, voices, locations, or other potentially sensitive information. Submit only content you are authorized to use and disclose.

Task, account, and credit records

We maintain records needed to operate the Service, such as task and request identifiers, prompts, model settings, uploaded and generated file URLs, task status, timestamps, errors, moderation outcomes, generation history, credit costs, credit balances, and credit additions or deductions.

Purchase and subscription information

When you make a purchase, we and our payment providers may process your account and customer identifiers, email address, order and subscription identifiers, plan, billing frequency, amount, currency, payment status, renewal period, and refund or cancellation status. Payment details required to complete checkout are collected by the third-party payment processor. We do not store complete payment card numbers or card security codes on our systems.

Communications, device, and usage information

If you contact us, we collect your message, contact details, attachments, and relevant account or task information. We and our providers may also automatically collect IP address, browser and device type, operating system, language, approximate location derived from IP address, pages viewed, links clicked, referrer, access times, session activity, request logs, errors, and diagnostic information. We may collect campaign and referral data such as UTM parameters, landing page, referrer, and advertising click identifiers when present.

Cookies and similar technologies

We use cookies, local storage, pixels, scripts, and similar technologies to maintain sessions, support authentication and security, remember preferences, attribute visits, measure usage, and improve the Service.

3. How We Use Information

We use personal information to:

  • provide, maintain, secure, and troubleshoot the Service;
  • create accounts and maintain authenticated sessions;
  • process prompts, uploaded media, settings, previews, and video generation requests;
  • submit content to moderation, API, and AI model providers and return results to you;
  • store and deliver uploaded media and generated videos through object storage and content delivery networks;
  • maintain task history, generation status, credit costs, balances, and credit activity;
  • process purchases, subscriptions, renewals, cancellations, refunds, and payment-related events;
  • prevent fraud, abuse, prohibited content, security incidents, and violations of our terms;
  • analyze usage, diagnose errors, measure campaigns, and improve features and performance;
  • provide support and send transactional, security, service, or policy communications; and
  • comply with law, respond to lawful requests, resolve disputes, and protect legal rights and safety.

4. Legal Bases for Processing

Where applicable law requires a legal basis, we rely on one or more of the following:

  • Contract: to create your account, process requested generations, deliver results, administer credits, and complete purchases or subscriptions.
  • Legitimate interests: to secure and improve the Service, prevent abuse, measure performance, support users, and maintain appropriate business records, where those interests are not overridden by your rights.
  • Consent: where we ask for it, including for certain cookies or processing that requires consent. You may withdraw consent without affecting prior lawful processing.
  • Legal obligations: to meet tax, accounting, consumer-protection, sanctions, law-enforcement, and other compliance requirements.
  • Rights and safety: where processing is necessary to protect a person, the public, the Service, or legal rights as permitted by law.

5. AI Processing and Uploaded Content

The Service depends on external APIs and AI systems. When you request a generation, preview, prompt transformation, or content review, we may send your prompt, uploaded media, selected settings, storage URLs, and related task information to Apipass and to one or more upstream API, content-moderation, or AI model providers. Uploaded images, videos, or audio may therefore be submitted to model providers as necessary to complete the generation you requested.

Those providers may process inputs and outputs outside your country and may retain limited copies for service delivery, security, or abuse prevention under their own terms and privacy policies. Provider identities and models may change as availability, quality, safety, and product features evolve.

Nano Banana Bingo does not operate the third-party foundation models used by the Service and cannot control every aspect of their processing. Whether an upstream provider uses content to improve its services or models depends on that provider, its contract, product tier, and configuration. Do not submit confidential information or personal information that is unnecessary for your generation.

Uploaded media and generated outputs may be delivered through URLs. Anyone with a link you share may be able to access or redistribute the content.

6. Service Providers and Other Disclosures

We disclose information as reasonably necessary to operate the Service to the following categories of recipients:

  • Supabase for authentication, account and database services, realtime updates, and storage of user, task, credit, referral, subscription, and operational records.
  • Google for Google OAuth and Google Tag Manager or other Google tags configured for the Service.
  • Cloudflare, including Cloudflare R2 and CDN services, to receive, store, cache, and deliver uploaded reference media.
  • Apipass and upstream AI model providers to process prompts and reference media, create previews, run models, and generate videos.
  • OpenAI and AIHubMix to perform supported content moderation, prompt processing, and preview-related operations.
  • FastPay and Stripe to process checkout, payment methods, orders, subscriptions, renewals, cancellations, refunds, and fraud screening.
  • OpenPanel for product analytics, including account identifiers or profile attributes for signed-in users, screen views, outbound-link activity, event properties, and device or usage data.
  • Infrastructure and professional providers for hosting, monitoring, security, communications, support, accounting, legal, and compliance services.

We may also disclose information at your direction; to comply with law or legal process; to investigate fraud, abuse, prohibited content, or security incidents; to protect rights, property, and safety; or in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets. We may use or disclose aggregated or de-identified information that does not reasonably identify you.

We do not sell personal information for money. Some disclosures to analytics or advertising-technology providers may be treated as a "sale," "sharing," or targeted advertising under certain laws even when no money is exchanged. You may contact us to exercise an applicable opt-out right.

7. Cookies and Analytics

Essential technologies support login, security, routing, checkout, and core functionality. Preference and attribution technologies remember settings and store referral or campaign information, including UTM parameters, in cookies or local storage. Analytics technologies measure visits, screen views, outbound links, interactions, performance, and errors.

Google Tag Manager helps us deploy and manage measurement tags. Tags loaded through Google Tag Manager may collect technical and usage data under their provider's policies. OpenPanel provides product analytics and may associate events with a signed-in account as described above.

You can control many cookies in your browser and clear local storage. Blocking essential technologies may prevent login, checkout, generation, or other features from working. Because browser "Do Not Track" signals lack a uniform standard, the Service may not respond to them in every circumstance. Where applicable law requires recognition of a valid opt-out preference signal, such as Global Privacy Control, we will process it as required by that law.

8. International Data Transfers

We and our providers operate across multiple countries. Your information may be processed outside the country where you live, including through authentication, cloud storage, payment, analytics, API, moderation, and AI model providers. Privacy laws in those countries may differ from local law.

Where required by applicable law, we take steps designed to use an appropriate transfer mechanism or safeguard, which may include contractual protections, adequacy decisions, or supplementary security measures made available by our providers. Contact us for more information about safeguards applicable to your information.

9. Data Retention

We retain information for as long as reasonably necessary for the purposes in this Privacy Policy. Retention depends on the nature of the information, whether your account remains active, the need to provide generation history and outputs, provider practices, security and operational requirements, payment and accounting obligations, and the need to resolve disputes or enforce agreements.

Account, task, prompt, credit, purchase, and subscription records may be retained while your account is active and afterward when reasonably necessary. Uploaded media and generated outputs may remain in object storage, caches, backups, delivery systems, or provider systems while needed to complete requests, make results available, investigate failures, maintain security, or meet legal obligations.

When information is no longer needed, we take reasonable steps to delete or de-identify it. Deletion from active systems may not immediately remove backup, cache, log, or provider copies. We may retain limited information after a deletion request when permitted or required by law.

10. Data Security

We use administrative, technical, and organizational safeguards designed to protect personal information. Depending on the system, these may include encryption in transit, authentication and access controls, row-level access rules, restricted service credentials, time-limited or presigned uploads, monitoring, logging, backups, and provider security controls.

No transmission, storage system, or security measure is completely secure. We cannot guarantee that information will never be accessed, disclosed, altered, or destroyed without authorization. Protect your Google account and avoid sharing private media or output links unnecessarily.

11. Your Privacy Rights and Choices

Depending on where you live and subject to legal exceptions, you may have the right to access, correct, delete, or obtain a portable copy of personal information; object to or restrict processing; withdraw consent; opt out of sale, sharing, targeted advertising, or certain profiling; appeal a privacy-request decision; and complain to a competent authority.

You may revoke Nano Banana Bingo's Google access in your Google account settings and manage cookies in your browser. Revoking OAuth access does not automatically delete records already held by Nano Banana Bingo.

To exercise a right, email contact@nanobanana.bingo. Describe your request and provide enough information to identify the relevant account or records. We may verify your identity and authority before responding. We will respond within the period required by applicable law and explain any lawful reason we cannot fulfill all or part of a request.

12. GDPR and Similar Rights

If the GDPR, UK GDPR, or comparable data-protection law applies, Nano Banana Bingo is the controller for the processing described here, except where a provider acts as an independent controller. Our legal bases are described in Section 4.

You may have rights of access, rectification, erasure, restriction, objection, and data portability, as well as the right to withdraw consent. Where we rely on legitimate interests, you may object based on your particular situation. You may lodge a complaint with the data-protection authority where you live, work, or believe a violation occurred. We encourage you to contact us first so we can try to address your concern.

13. California Privacy Notice

If you are a California resident, the CCPA and CPRA may provide additional rights. Categories we may collect include identifiers; account and customer records; commercial and transaction information; internet or network activity; audio, visual, and user-provided content; approximate location derived from IP address; and preferences or inferences reflected in generation settings and usage. Content you choose to upload may contain information treated as sensitive under California law.

We collect, use, retain, and disclose these categories for the purposes and to the provider categories described above. We do not use sensitive personal information to infer characteristics beyond what is reasonably necessary to provide, secure, and improve the Service unless we give additional notice and any legally required right to limit that use.

Subject to exceptions, California residents may request to know, access, correct, or delete information; receive a portable copy; opt out of sale or sharing; limit certain uses of sensitive information; and receive equal service without unlawful discrimination. We do not knowingly sell or share the personal information of consumers under 16. You or an authorized agent may submit a request through the contact method in Section 11, subject to appropriate verification.

14. Children's Privacy

The Service is not directed to children. You must be old enough under applicable law to use the Service and provide valid consent. We do not knowingly collect personal information from a child below the age at which parental consent is legally required.

If you are a parent or guardian and believe a child has provided personal information without valid consent, contact us. We will review the request and take appropriate steps, including deletion where required.

15. Third-Party Services

The Service may interact with third-party identity providers, payment pages, storage endpoints, websites, and AI services. Their practices are governed by their own privacy policies, not this Privacy Policy. Review those policies before providing information directly to a third party.

16. Changes to This Privacy Policy

We may update this Privacy Policy as the Service, providers, or legal requirements change. We will post the updated version here and revise the "Last updated" date. If a change is material, we may provide additional notice through the Service, by email, or by another appropriate method.

17. Contact Us

For questions, concerns, or privacy requests, contact contact@nanobanana.bingo.