Privacy Policy

This Privacy Policy explains how Tekronix Inc, the company that operates NanoAPI ("NanoAPI", "we", "us" or "our"), collects, uses, shares and protects personal information when you use nanoapi.ai, the NanoAPI API, the developer console, the online playground, share links and related services (together, the "Service"), or when you contact us.

Key points

• We collect what we need to run the Service: your account details, the inputs you submit and the results you generate, your API keys (hashed, except the playground key, which is kept encrypted), webhook settings, recharges, balance and usage, and basic technical data.
• We do not sell your personal information, and we do not use your inputs or results to train AI models.
• To generate results, your inputs are processed by our generation backend and sent to the AI infrastructure and model providers that run the model.
• Your email address, name and profile photo stay with our website. The generation backend that runs your tasks knows you only by your account ID.
• If you send your own users' content through the API, you decide what is sent and you are responsible for telling them and for having a legal basis (Section 3).
• Results are served from public links that anyone with the link can open. Playground creations made before your first recharge are public in Community.
• You can access, correct, export or delete your data. Contact support@nanoapi.ai for any privacy request.

1. Information we collect

1.1 Account information

When you sign in with Google, we receive your name, email address, profile photo and a Google account identifier. We never receive your Google password.

1.2 API data

When you use the API, our generation backend processes:

• API keys: a hashed version of each key, its name and its first few characters (the prefix), and when it was created. The full key is shown to you once and never stored. The one exception is the key named "Playground", which we create for you the first time you generate in the online playground: our website keeps it encrypted so it can run your playground generations through the API. It appears in your console with your other keys.
• Task data: the inputs of each task (media URLs, prompt, mode, resolution and other parameters), the metadata you attach, the webhook_url, the key that created the task, the task's status, results, billing and timestamps.
• Webhook data: your webhook signing secret, and a record of each notification we send and each delivery attempt.
• Request data: technical information about each request, such as the time, endpoint, response status, request ID and the IP address it came from.

The media at the URLs you submit is fetched when the task runs and passed to the model provider that generates the result.

1.3 Playground content

The prompts, images and videos you upload or link to in the playground ("Inputs"), the videos generated for you ("Outputs"), the settings you choose and your creation history. Uploaded media may show people's faces or include their voices.

1.4 Recharges, balance and usage

Your recharge history, receipts, balance and ledger (recharges, frozen and released amounts, charges and adjustments), your tasks and your usage. Card and other payment details are collected and processed by Dodo Payments, the merchant of record for our payments. We receive only limited information from it, such as a payment identifier, the payment status and the amount.

1.5 Communications and confirmations

Messages you send us, such as support emails, reports and copyright or removal requests, including any contact details and information you include. We also keep records such as your agreement to our upload terms before uploading media in the playground.

1.6 Information collected automatically on our website

• Device and usage data. IP address, browser and device type, operating system, language, pages viewed, features used, referring pages, dates and times, and error and security logs. Your sign-in sessions record the IP address and browser they were created from. We may infer your approximate location (country or city) from your IP address.
• Cookies and similar technologies. We use cookies and local storage to keep you signed in, remember your preferences, protect the Service and understand how it is used. See our Cookie Policy.
• Campaign attribution. If you arrive through an ad or a link with campaign parameters, we store the source, campaign, referring site, landing page and click identifiers (such as gclid, fbclid or ttclid) in a first-party cookie for up to 30 days. If you sign up during that time, we save this information with your account so that we can measure which channels work.
• Analytics and advertising tools. We measure traffic with Plausible, which does not use cookies. We may also use Umami (also cookieless), Microsoft Clarity, which records interactions such as clicks and scrolling as heatmaps and session replays and sets cookies, and Google Ads conversion tracking, which sets cookies. When we run campaigns on other platforms, we may use advertising pixels from partners such as Meta and TikTok. See our Cookie Policy.

1.7 Faces and biometric information

Our models work with photos and videos of people. We process this media only to generate the result requested. We do not create or keep biometric identifiers (such as faceprints) to identify or recognize anyone, and we do not use media for identification. Only submit media of people who have agreed to its use.

1.8 Where your information is kept

• Our website keeps your account information (email address, name, profile photo and Google sign-in), your payments, your playground history and your encrypted Playground key on Cloudflare.
• Our generation backend keeps your hashed API keys, balance and ledger, tasks, usage records, webhook signing secret and webhook delivery records. It identifies you only by your account ID and does not receive your email address, name or profile photo.
• To generate your results, your task inputs are processed by the generation backend and the model providers it works with, and result files are stored by our storage providers.
• Payment data is handled by Dodo Payments, as described in Section 1.4.

2. How we use your information

We use personal information to:

• Provide the Service: create and manage your account, run your tasks, provide the API, the console and the playground, store your history, deliver results and the webhooks you set up, run Community and share links, and provide support;
• Process payments and your balance: process recharges, freeze, charge and release amounts for your tasks, handle refunds and adjustments, and prevent payment fraud;
• Keep the Service safe: authenticate API requests, enforce rate limits, detect and prevent abuse, fraud and security incidents, and find content that breaks our Terms of Service and Acceptable Use Policy, including through automated content checks;
• Improve the Service: understand how features are used, fix problems and develop new features, mainly using aggregated or de-identified data;
• Communicate with you: send service messages, such as sign-in, billing, security and API change notices, and, unless you have unsubscribed, product updates and offers. You are subscribed to product emails when you sign up, and you can unsubscribe at any time with the link in each email;
• Measure marketing: understand which campaigns and channels bring people to NanoAPI; and
• Meet legal obligations: comply with law, respond to lawful requests, enforce our terms and protect our rights and the rights and safety of others.

We do not train AI models on your content. We do not use your inputs or results to train or fine-tune AI models, and we do not use your content in our marketing without your permission.

3. Content you send about other people through the API

If you build a product on the API, the content you submit may include personal information about your own users or about people shown in their media. For that information:

• You decide what you send to us and why. We process it on your behalf, to run the tasks you request and to keep the Service safe, as described in this policy.
• You are responsible for telling those people how their information is handled, including that it is processed by third-party AI providers such as NanoAPI, and for having any consent or other legal basis the law requires.
• Send only what a task needs. Do not put personal information in metadata, and do not send sensitive information that a task does not require.
• If someone asks us about their information in content you submitted, we may refer them to you, and we will help you respond where we can.

4. How we share your information

We do not sell your personal information. We share it only as described below:

• AI infrastructure and model providers. To generate your results, your inputs (including the media at the URLs you submit) and settings are processed by our generation backend and sent to the infrastructure partners and model developers that run the model. They process them to produce your results under their own terms and policies.
• Content safety provider. In the playground, the prompts, images and videos you submit and the results generated there are checked by automated moderation models run by WaveSpeed AI. API requests are checked by our generation backend and model providers instead. See our Acceptable Use Policy.
• Your webhook endpoints. When you set a webhook_url, we send the task's data, including its inputs, metadata and result links, to that URL.
• Service providers. Companies that help us run the Service, such as Cloudflare (hosting, content delivery, database, file storage and security), Google (sign-in), Dodo Payments (payments), Resend (email delivery), our analytics providers, and tools we use for customer support and internal team notifications. They may use your information only to provide services to us.
• Advertising partners. Google, and Meta or TikTok when we run campaigns with them, may receive information collected by their tags and pixels, such as device data and the pages or actions related to a campaign, to measure ad performance.
• Public creations. Public playground creations appear in Community and on their share page. Anyone can view them, together with the source video, reference images and prompt used to make them, and use them as a starting point for their own videos. Share pages also show your display name and profile picture.
• Result links. Results are served from public URLs, so anyone who has a link can open the file. Do not share links you want to keep private.
• Legal and safety reasons. Authorities, courts or other parties, when we believe it is required by law or necessary to protect the rights, property or safety of NanoAPI, our users or others, including to prevent fraud and abuse.
• Business transfers. A buyer or successor, if NanoAPI is involved in a merger, acquisition, financing, reorganization or sale of assets, subject to this Privacy Policy.
• With your consent. In any other case where you ask us to or agree to it.

5. How long we keep information

We keep personal information only for as long as we need it for the purposes described in this policy:

• Account information is kept while your account is open.
• API keys are kept until you delete or reset them, or delete your account. Tasks keep the name and prefix of the key that created them. If you delete the Playground key, a new one is created the next time you generate in the playground.
• Tasks and their results are kept while your account is open, so that you can see your history, usage and billing. Result files are not currently deleted automatically; if we introduce a retention period, we will announce it in advance.
• Playground creations are kept until you delete them or your account.
• Webhook delivery records are deleted 30 days after the last delivery attempt.
• Technical and request logs are kept for up to 30 days, unless we need them longer to investigate a security incident or abuse.
• Recharge, balance and billing records are kept as long as needed for accounting, tax and legal purposes. Dodo Payments keeps its own records as required by law.
• Campaign attribution cookies expire after 30 days.

When you delete your account, we delete your account information, API keys, webhook secret and creation history without undue delay, except the payment, balance and task records we keep for accounting, tax and legal purposes. Copies in backups are removed as the backups are overwritten on their regular cycle. We may keep limited information when the law requires it, to resolve disputes or to prevent fraud and abuse, for example to stop banned users from signing up again. We may keep aggregated or de-identified information that cannot identify you.

6. Your choices and rights

• Access. You can see your balance, billing history, API keys, tasks, usage and playground creations in the console and your account.
• Correct. To correct your name or profile photo, email us and we will update it.
• Delete. You can delete API keys and playground creations yourself. To delete your whole account, email support@nanoapi.ai from the email address on your account.
• Content that shows you. If a public creation shows you, or someone you represent, without consent, use the Report link on it in Community or on its share page, or email support@nanoapi.ai with a link to it. We will remove it.
• Export and other requests. Email support@nanoapi.ai to request a copy of your data or to make any other privacy request. We may need to verify your identity before acting on it.
• Marketing emails. Use the unsubscribe link in any marketing email. We will still send you important service messages, such as billing, security and API change notices.
• Cookies and tracking. You can block or delete cookies in your browser settings, and use browser or device tools to limit tracking by third-party pixels. Some features may not work without essential cookies.

Depending on where you live, you may have additional rights, described in Sections 11 and 12. We will not treat you differently for exercising your privacy rights.

7. Security

We use technical and organizational measures to protect personal information, including encryption in transit (HTTPS), storing API keys only in hashed form (the Playground key only in encrypted form), signing the requests between our website and our generation backend, access controls and limiting staff access to what is needed for their work. No online service is completely secure, so we cannot guarantee absolute security.

You are responsible for keeping your API keys and webhook signing secret safe. If you believe one has been exposed, reset it in the console and tell us. If we become aware of a security breach that affects your personal information, we will notify you and the authorities where the law requires it.

8. International transfers

NanoAPI, our model providers and our service providers operate in several countries, including the United States, so your information may be processed outside the country where you live, where data protection laws may be different. When the law requires it, we use appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses.

9. Children

The Service is only for people aged 18 or older. We do not knowingly collect personal information from anyone under 18 who uses the Service. If you believe a minor has given us personal information, contact support@nanoapi.ai and we will delete it.

10. Third-party sites and services

The Service links to sites and services we do not control, such as Google sign-in and Dodo Payments' checkout pages. Their privacy practices are governed by their own policies, so please review them.

11. Users in the EEA, UK and Switzerland

Tekronix Inc is the controller of your account information and of how we run the Service. For content that developers submit about their own users through the API, the developer decides what is sent and why (Section 3). We process personal information on the following legal bases:

• Performance of a contract: to provide the Service, including the API, run your tasks and process payments;
• Legitimate interests: to keep the Service secure, prevent fraud and abuse, improve the Service and measure our marketing, where these interests are not overridden by your rights;
• Legal obligation: to keep records and respond to lawful requests; and
• Consent: where we ask for it, for example for certain cookies or marketing. You can withdraw consent at any time.

You have the right to access, correct, delete or receive a portable copy of your personal information, to restrict or object to its processing, and to withdraw your consent. To exercise these rights, contact support@nanoapi.ai. We usually respond within one month. You also have the right to lodge a complaint with your local data protection authority.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you. Automated safety checks may block a task, and you can contact us if you believe one was blocked by mistake.

12. Users in the United States

Residents of California and other U.S. states with comprehensive privacy laws may have the right to know what personal information we collect and how we use and disclose it, and to access, correct, delete and receive a copy of it. In the past 12 months we have collected the categories of information described in Section 1, for the purposes described in Section 2, and disclosed them to the recipients described in Section 4.

We do not sell personal information for money. When we use advertising pixels to measure campaigns, this may be considered "sharing" for cross-context behavioral advertising under some state laws. To opt out, email support@nanoapi.ai, or block third-party cookies in your browser. We do not knowingly sell or share the personal information of anyone under 18.

You or your authorized agent can submit a request to support@nanoapi.ai. We will verify your request and respond within 45 days, or tell you if we need more time as the law allows. If we deny your request, you may appeal by replying to our response.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If a change is material, we will notify you by email or in the Service before it takes effect. The date at the top of this page shows when it was last updated.

14. Contact us

For questions or privacy requests, email support@nanoapi.ai, or write to us at:

Tekronix Inc, 1500 N Grant St, Ste R, Denver, CO 80203, United States