Privacy Policy

Introduction

BananaImage ("we," "our," or "us") provides AI-powered image generation, editing, and related services through our website. This Privacy Policy explains what data we collect, how we use it, and the rights you have over your information. By using BananaImage, you agree to the practices described here.

Information We Collect

To provide and improve the service, we collect:

1. Account Information — Your name, email address, profile photo, and authentication credentials when you sign up. We may also collect your role and invite code if your account was provisioned by an admin.
2. Prompts and Inputs — Text prompts, reference images, and configuration parameters you submit for image generation. We store these alongside the generated outputs so you can find them later in your gallery.
3. Generated Outputs — The images produced by our AI providers (Kie AI and similar services). Image URLs are stored in your gallery history and are tied to your account.
4. Usage and Safety Data — Number of generations, credit balance changes, model selections, timestamps, moderation decision IDs, and opaque request identifiers. This is used to enforce credit limits, prevent abuse, document safety checks, and improve the service.
5. Payment Data — When you purchase credits or subscriptions, payment is handled by configured third-party processors. We do not store full card numbers; we receive order, transaction, customer, invoice, amount, currency, and status information needed to operate billing.
6. Device and Log Data — IP address, browser type, operating system, and request logs. Used to optimize compatibility, detect abuse, and respond to security incidents.
7. Cookies and Local Storage — Session cookies for authentication, locale preference, theme, and UI state. We do not use advertising cookies.

How We Use Your Information

We use the data described above to:

• Generate images and make results available through the dashboard and gallery.
• Screen text prompts for prohibited or high-risk content before sending them to an AI model.
• Authenticate your account, enforce credit limits, and process subscription/credit purchases.
• Process support tickets, refund requests, and abuse reports.
• Send important operational messages (security alerts, billing confirmations, policy updates). You cannot opt out of these because they are required to keep your account safe.
• Analyze aggregate, de-identified usage trends to improve model selection, default settings, and overall product experience.
• Comply with legal obligations, including responding to lawful requests from public authorities.

Third-Party Subprocessors

To provide the service, we share limited data with vetted third parties:

• Kie AI (and other AI model providers) — receives your prompts, reference images, and configuration parameters to generate images. Generated URLs are returned to us and stored in your gallery.
• Cloudflare R2 / S3 — stores uploaded reference images and generated outputs.
• Creem — processes payments and, when Creem is enabled, receives text prompts plus opaque request identifiers to return an allow, flag, or deny moderation decision before generation. This moderation endpoint does not receive uploaded reference images or generated outputs.
• Stripe / PayPal / Alipay / WeChat Pay — may process payments when configured; we do not see your full card or bank credentials.
• Resend — sends transactional emails such as receipts and password resets.
• Google Analytics / Plausible — anonymous usage analytics (only if explicitly enabled by the admin in the settings panel).

Each subprocessor is contractually required to protect your data with industry-standard safeguards.

Data Sharing

We do not sell your personal information. We share data only in these limited cases:

• With the subprocessors listed above, solely to provide the service.
• To comply with legal obligations or respond to lawful requests from public authorities.
• To protect our rights, property, or safety, or that of our users, including enforcing our Terms of Service.
• In connection with a corporate transaction (merger, acquisition, or sale of assets), in which case the successor entity will honor this policy.

Your Content and Generated Outputs

• Your prompts and reference images remain yours. You retain all rights you already had in inputs you upload.
• Generated outputs are produced by third-party AI models on your behalf. Usage rights vary by model provider and jurisdiction; review the applicable provider terms before relying on an output for commercial use.
• We may use anonymized, aggregate usage patterns to improve the service. Creem and third-party AI providers process submitted content according to their own terms and privacy policies.

Data Security

We use reasonable technical and organizational safeguards, including TLS in transit and scoped access controls. Storage encryption and retention controls depend in part on the infrastructure providers configured for the service. No method of transmission or storage is 100% secure.

Data Retention

• Account data is kept while needed to provide the service and for legitimate security, legal, tax, and fraud-prevention purposes.
• Generated outputs and prompts are retained to provide gallery history and may also be retained by configured storage or AI providers under their own policies.
• Billing records are retained for the period required by applicable tax and accounting law.

Your Rights

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of eligible account data.
• Request a copy of eligible account information in a reasonably available format.
• Object to or restrict certain processing, where applicable law provides these rights.

To exercise any of these rights, email support@banana-image.net. Response timing depends on applicable law and the scope of the verified request.

Children's Privacy

BananaImage is not directed to children under 13 (or under the age required by your local jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

International Data Transfers

We and our providers may process data in countries other than your own. Where required, transfers are handled using safeguards required by applicable law and the relevant provider agreements.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by updating the date at the top of this page and, where appropriate, by sending a notice through the service or by email.

Contact Us

If you have questions about this Privacy Policy or how we handle data, email support@banana-image.net.