1. Scope and privacy contact
This policy explains how personal information is processed when you use Spicy Mayo at spicymayo.co. It covers the website and creative studio, including visitors, account holders, and customers who contact us. It does not describe separate mobile applications.
nanobananastudio@gmail.comThis is an explanation of our practices, not a request for blanket consent. Where a particular activity requires consent, we must obtain it separately.
2. Information we process
- Account information: name, email, account identifiers, password hashes for password accounts, sign-in records, sessions, and associated security information.
- Google sign-in: the profile and account identifiers Google provides for authentication, such as your name, email, and profile image. We do not request access to your Gmail messages or Drive files.
- Creative activity: prompts, reference uploads, chosen settings, generation identifiers, output links, timestamps, processing status, errors, and creation history.
- Billing: customer and subscription references, plan, invoice and payment-event references, payment status, allowance, credit use, and renewal or cancellation information.
- Technical information: IP addresses, browser and device information, request timestamps, and diagnostic or security logs processed by our authentication and hosting infrastructure.
- Correspondence: the information you include in support, privacy, billing, or abuse reports, and optional cancellation reasons and written feedback.
Payment details are entered into Stripe's checkout or your payment wallet. Our application does not store full payment-card numbers or wallet credentials.
3. Why we use it and our legal bases
We use account, creative, and subscription information to provide the service you request: authenticate you, process images, show history, manage credits, and handle billing or support. Where the GDPR applies, processing necessary for these activities is based on performing our contract with you or taking requested steps before a contract.
We process security and diagnostic information to prevent abuse, troubleshoot failures, and protect the service. Our basis is our legitimate interest in a secure, functioning product, balanced against your rights. Records needed for accounting, taxes, legal requests, or other mandatory duties are processed to meet legal obligations. Where processing depends on consent, you may withdraw that consent without affecting earlier lawful processing.
We use optional cancellation feedback to improve the service, based on our legitimate interest in understanding customer needs. You can cancel without providing feedback. We do not sell personal information or use it for targeted advertising in the studio. We do not operate a system that uses your image content to make automated eligibility decisions about employment, credit, housing, or similar matters.
4. Prompts, uploaded images, and output links
Your prompts and reference images are sent to fal to run your selected image or video model. The model and the infrastructure used to provide it process the request, and output files are delivered through provider storage. Loading or downloading a provider-hosted image or video also involves requests to that storage provider.
Creation history is associated with your signed-in account and is not published as a public gallery by the studio. However, the underlying media URLs may be accessible to anyone who has the link. An account-protected history page does not make a provider URL private.
Only upload material you are entitled to use. Do not upload confidential documents or sensitive personal information that you do not want processed by the image provider. We do not run our own model-training pipeline using your uploads. We do not promise that every upstream provider has the same retention or processing terms; see fal's privacy policy for its published information.
5. Providers and other recipients
- fal: image processing, request handling, and file delivery.
- Vercel: website hosting, application requests, and operational diagnostics.
- MongoDB: storage of account, history, billing-reference, and credit records.
- Stripe: checkout, subscriptions, billing, fraud prevention, payment disputes, and customer billing management.
- Google: authentication when you choose Google sign-in.
- Apple Pay or Google Pay: wallet authorization when you select an eligible wallet at checkout.
- Email infrastructure: delivery and handling of messages you send to support. If a password-reset email service is enabled, the email provider processes your address and the reset message.
Providers receive information relevant to their role. Some, including payment and sign-in providers, also process information for their own purposes under their own policies. We may disclose necessary records to meet a valid legal obligation, protect legal rights, investigate abuse, or manage a business transfer, subject to applicable protections.
7. Optional website measurement
When usage measurement is enabled for this website, we ask before loading Vercel Web Analytics. You can decline or change your choice through Measurement choices. We also respect Do Not Track and Global Privacy Control signals. Declining does not affect account access, payments, or creation.
For visitors who opt in, we measure public page visits and actions such as opening the studio, creating an account during the measured visit, opening checkout, and seeing confirmed membership. Our event properties contain only a broad referral source, such as ChatGPT or Google, a page category, and the language of the landing page. We exclude query strings, private account pages, prompts, uploads, names, email addresses, account IDs, and payment secrets from our analytics events. Vercel processes requests and derives aggregate visitor statistics under its Web Analytics privacy documentation.
Your choice is saved in this browser. With permission, a broad referral source and event-deduplication state are kept in the current tab for up to 24 hours. New subscription checkout records may carry that broad source and page category, allowing us to associate confirmed invoice records with a referral channel. They never determine eligibility, pricing, or credits. Revenue reporting uses verified payment records; a checkout button click is not counted as a purchase.
Withdrawing permission stops future analytics events and clears the tab’s measurement state. Existing aggregated reports and payment records are not retroactively removed by that choice. Contact us for account-related privacy requests.
8. How long information is kept
Account records and generation history are kept to provide your account and history while needed for those purposes. You may request deletion. Billing and dispute records may remain for applicable accounting, tax, fraud-prevention, or legal-claim requirements after an account is closed. Support and security records are retained according to the purpose of the issue, investigation, or obligation.
Temporary upload-reference records in our application database are scheduled to expire after 24 hours. This removes the temporary database reference; it does not mean the provider's image file is deleted after 24 hours. Provider file retention, operational logs, and backup cycles can differ from application records. Download any output you want to retain.
When handling a deletion request, we assess which records must be removed, which providers must be involved, and which records we are legally required to retain. We can explain the applicable retention criteria for your request.
9. International processing and security
Our providers may process information outside Estonia or your country, including in the United States. Where European data-protection law restricts a transfer, applicable safeguards must be used, such as an adequacy decision or contractual safeguards. Contact us for information about the arrangements relevant to your data.
We use HTTPS, hashed passwords, authenticated access to account records, and checks designed to prevent unauthorized access or credit misuse. No online service can promise complete security. Keep your credentials safe and report suspected unauthorized access to us.
10. Your privacy rights and requests
Depending on the law that applies, you may request access, correction, deletion, restriction, or a portable copy of your personal information. You may object to processing based on legitimate interests and withdraw consent where consent is the basis. Some rights have exceptions, including records that must be kept by law.
Email nanobananastudio@gmail.com from your account address where possible and describe the request. You do not need to have made a purchase. We may ask for proportionate information to confirm identity before disclosing or deleting account data. Do not send a password or full card number. We respond within the time required by applicable law; under the GDPR this is normally one month, with extensions only where allowed and explained.
You may complain to your local data-protection authority. In Estonia, the authority is the Andmekaitse Inspektsioon. Contacting us first is welcome but is not required to exercise that right.
11. Children
The service is intended for adults aged 18 and over. We do not knowingly offer accounts to children. If you believe a child has provided personal information through the studio, contact us so we can investigate and take appropriate action.
12. Updates and third-party links
The version and date above identify this notice. We will update it when our practices change and provide additional notice of material changes where required. Linked third-party websites have their own privacy practices; review those before providing information directly to them.
For privacy questions or requests, contact nanobananastudio@gmail.com. Subscription cancellation and payment refunds are explained separately in our Refund Policy.