This policy explains what Red Nana collects when you use Red Nana, who it goes to, how long we keep it and what you can do about it. We have tried to describe exactly what the service does, not what a template says.
The data controller is Red Nana, a trade name (d/b/a) of AJV Entertainment LLC, 7200 Westpointe Blvd, Orlando, Florida 32835, United States. Reach us about anything in this policy at hello@rednana.ai.
If you are in the UK or the European Economic Area, section 13 sets out the legal basis for each thing we do with your data and the rights that come with it. If you live in a US state with a privacy law — California, Virginia, Colorado, Connecticut, Texas and others — section 12 is for you.
| Data | Why we have it |
|---|---|
| Email address | To identify your account, sign you in and contact you about billing and changes |
| Name, and company if you give one | To address you in the product and on invoices |
| Password (hashed) | To sign you in. It is stored hashed, so we cannot read it |
| Google, Microsoft or Apple account id | Only if you sign in that way, so we can recognise you next time |
| Profile picture link | Only if you sign in with Google or Microsoft. We store the web address of the picture on your provider account, not the image itself, and show it as your avatar |
| Prompts, reference images and links | To generate what you asked for |
| Generated images and videos | To store and show you your work |
| Credit, subscription and payment records | To run your balance and plan, and to meet tax and accounting obligations |
| Consent records | To prove which terms you accepted, and when, and whether you asked for marketing email |
| Support messages | If you email us, so we can answer and keep a record of what was agreed |
| Basic technical logs | To keep the service running, spot abuse and fix problems |
| The IP address you signed up from | To spot accounts created in bulk from one connection. Deleted after 30 days |
You do not have to give us any of this, but most of it is what makes an account work: without an email address we cannot sign you in or tell you about a failed payment, and without a prompt there is nothing to generate.
Almost everything above comes from you. Two things come from somewhere else:
Very little, and deliberately so.
Some people upload photographs of themselves or others as reference images. Because several laws treat measurements of a face or voice as a special category of data — Illinois' Biometric Information Privacy Act, the Texas and Washington biometric statutes, and the UK and EU GDPR among them — it is worth being exact about what happens to those images.
These are the companies that receive your data, what each one gets and why. Each acts for us under a contract, and none of them may use your data for their own purposes — with one exception, named as such at the end of the list.
We may also disclose data to professional advisers such as lawyers and accountants where they need it to advise us, where the law requires it — for example in response to a valid legal request — or to protect the safety of others. If the business is ever sold, merged or restructured, account data may pass to the buyer, who would be bound by this policy or one no less protective; we would tell you before that happened.
Nothing you generate is public unless you publish it yourself. If you choose Make public on something you made, it appears in Explore, the public gallery on rednana.ai, where anyone can see it along with its prompt; choosing Make private takes it down again. Before anything appears there it is checked automatically, by Google's Gemini model, against the rules in our Terms.
Red Nana is in the United States, and the providers above are in the United States or elsewhere, so using Red Nana means your data is transferred internationally.
For transfers out of the UK or EEA we rely on the safeguards those providers have in place: the European Commission's Standard Contractual Clauses and the UK Addendum, or, where a provider is certified under it, the EU-US Data Privacy Framework and its UK Extension. You can ask us at hello@rednana.ai which mechanism covers a particular provider.
Where we no longer need something but cannot delete it immediately — because it sits in a backup, for instance — we isolate it from further use until deletion is possible.
Two of these you can do yourself, right now, without emailing us or waiting for us:
Get a copy of your data — email hello@rednana.ai from the address on your account and we will send you a JSON file of what we hold, including your generations, credit history and payments.
You can also ask us to correct anything that is wrong, restrict or object to how we use your data, or give you your data in a portable format if that file does not cover what you need. Email hello@rednana.ai. We will respond within one month, or within 45 days if you are covered by a US state law, and we will tell you if we need longer. We may need to check who you are before we act, and we will never treat you worse for asking.
Red Nana sets one cookie holding your sign-in session, plus a short-lived one during sign-in to protect against cross-site request forgery. Both are strictly necessary to run the service and there is nothing to consent to.
Advertising cookies, unless you turn them off. Meta's pixel and Google's tag load when a page opens and each sets its own cookie, so Facebook and Google can tell that the same browser came back; the notice on your first visit says so. Turning them off means neither is set again in that browser. There are no other analytics or advertising cookies, from us or anyone else. To turn them off, or back on, use Turn off on the notice, Cookie choices at the foot of the home page; turning them off reloads the page without the tags. Clearing your browser's site data also clears the choice, and the tags load again until you turn them off again.
The app also keeps a small record in your browser's local storage so the page can restore itself when you come back. That includes the prompt you were writing, kept so that a refresh, a closed tab or signing out does not throw away work you have not generated yet. All of it stays in your browser and never reaches us. Clearing your browser data removes it, and emptying the prompt box removes that.
Global Privacy Control. If your browser sends that signal we treat it as a refusal before the question is asked: the banner does not appear, neither tag is ever loaded, and pressing Accept cannot override it. That applies wherever you are, not only where a law gives the signal effect. We do not respond to "Do Not Track", which has no agreed meaning.
This section supplements the rest of the policy for residents of states with a comprehensive privacy law — California, Virginia, Colorado, Connecticut, Texas and others.
What we collect and why is in sections 1 to 5, and who receives it is in section 7. In the categories those laws use, we collect identifiers (name, email, account id), commercial information (your plan, credits and purchases), internet activity in the limited sense of section 3, your own content in the form of prompts and generated files, and nothing else. We do not collect sensitive personal information for any purpose that would give you a right to limit its use, and we do not use or disclose it for inferring characteristics.
We do not sell your personal information, and we have never sold it. We do share it for cross-context behavioural advertising in two ways: Meta's pixel and Google's advertising tag, described in section 3, which load unless you turn them off. Once you turn them off, or if your browser sends Global Privacy Control, no sharing takes place. There are no other advertising partners and no other tags. We do not knowingly sell or share the data of anyone under 18.
Your rights. Subject to verification, you may ask us to tell you what we hold about you and why, give you a copy in a portable form, correct it, or delete it; you may opt out of sale, sharing and targeted advertising, which here means turning those two tags off — no email needed, it is Cookie choices in the footer, and a Global Privacy Control signal does it for you; and you may not be treated worse for exercising any of these.
How to exercise them. Use Settings, or email hello@rednana.ai. We respond within 45 days, and may extend once by a further 45 days if a request is complex, in which case we will tell you inside the first 45. An authorised agent may act for you with written proof. If we refuse a request you may appeal simply by replying to our answer and saying so; we will reconsider and reply within 45 days with our reasons. If you are still unhappy, you may complain to your state attorney general.
California "Shine the Light". California residents may ask once a year what personal information we disclosed to third parties for their own direct marketing. Our answer is none, and email us if you want that in writing.
If you are in the UK or the European Economic Area, the UK GDPR and the EU GDPR apply to you and Red Nana (AJV Entertainment LLC) is the controller of your personal data.
Our legal bases. The law requires us to have a reason for each thing we do with your data. Ours are:
| What we do | Our legal basis |
|---|---|
| Run your account, generate what you ask for, store your library, take payment | Contract — it is what you signed up for and we cannot provide the service without it |
| Send account, billing and security email | Contract, and our legitimate interest in keeping you informed about an account you hold |
| Keep the service secure, apply rate limits, investigate abuse | Legitimate interest in a service that works and is not misused. We use the least data that achieves it — an IP address in memory, the signup address for 30 days, and a pass or fail from the signup human check; never a profile |
| Keep payment and invoice records | Legal obligation under tax and accounting law |
| Send marketing email | Consent, given by ticking the separate box, and withdrawable at any time |
| Load Meta's pixel and Google's advertising tag, so we can tell which ads work | Our legitimate interest in knowing which of our ads work, balanced by an opt-out you can use at any time (Turn off on the notice, or Cookie choices in the footer) and by honouring a Global Privacy Control signal. Where the law where you live requires your consent for tags like these, we rely on that consent instead and you may withdraw it the same way |
| Answer a legal request, or establish or defend a legal claim | Legal obligation, or our legitimate interest in defending ourselves |
Your rights. You may ask us for access to your data, correction of anything wrong, deletion, a portable copy, restriction of how we use it, and you may object to any use we base on legitimate interest — including an absolute right to object to direct marketing. Where we rely on consent you may withdraw it at any time, and withdrawing does not affect what we did before. Settings gives you a copy and deletion immediately; email hello@rednana.ai for the rest.
We answer within one month and will tell you if a complex request needs longer. There is no charge unless a request is clearly unfounded or excessive.
Complaints. Please come to us first — most things are quicker to fix that way. You also have the right to complain to your data protection authority: in the UK the Information Commissioner's Office, and in the EEA the authority for the country you live in.
Transfers out of Europe are covered in section 8.
Automated decisions. We do not make decisions about you by automated means that produce legal or similarly significant effects.
Security. We take reasonable measures to protect your data, including hashed passwords, encrypted connections, row-level access controls on the database and restricted access to storage. No system is completely secure, and we cannot guarantee that data will never be lost or accessed without permission. We have a process for handling a breach, and where one affects you and the law requires it, we will tell you and the relevant regulator.
Children. Red Nana is for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you are a parent or guardian and believe a child has created an account, email us and we will delete it.
Other sites. Red Nana may link to sites we do not run — a model provider, a payment page, a reference you pasted. We are not responsible for what they do with your data, and their own policies apply once you leave us.
Changes. We may update this policy. The version you accepted is recorded against your account, and if we make a material change we will notify you before it takes effect. Where the law requires your consent to a change, we will ask for it.
Contact.
Red Nana, a trade name (d/b/a) of AJV Entertainment LLC
7200 Westpointe Blvd
Orlando, Florida 32835
United States
hello@rednana.ai