Nanta is the data controller for personal data processed through the Service, except where third parties act as independent controllers (e.g. Stripe for payment processing, TikTok when you use their platform directly).

Nanta AI is an AI media generation platform. Processing personal data is inherent to providing account access, billing, generation history, file uploads, optional social publishing, security monitoring, and product improvement.

This Policy should be read together with our Terms of Service, Cookie Policy, and Refund & Cancellation Policy.

Depending on how you use the Service, we may collect the following categories of data:

• Identity & account data — name, email address, username, hashed password, profile settings, locale/language preference, plan tier, and account status
• Billing & transaction data — subscription status, Stripe customer ID, payment method metadata (last four digits, brand), invoices, credit purchases, credit balance, usage ledger, tax identifiers where required
• Usage & generation data — prompts, model selections, parameters, generation history, timestamps, credit consumption, error logs, feature interactions, and workspace activity (Studio, Chat, Canvas, Characters, Script Studio, Library/Assets)
• Upload & content data — images, videos, audio, text, and other files you submit for processing, storage, or publishing, plus derived metadata (dimensions, duration, format)
• Technical & device data — IP address, browser type, operating system, device identifiers, session IDs, referral URLs, crash reports, and performance metrics
• Communications — support emails, feedback, abuse reports, and correspondence with info@nanta.pro
• Cookie & analytics data — as described in our Cookie Policy
• Integration data (optional) — OAuth tokens, connected account identifiers, and publish logs when you link third-party services such as TikTok
• Marketing preferences — if you opt in to promotional communications

We collect data directly from you when you register, purchase, upload content, configure settings, contact support, or connect integrations.

We receive data automatically through cookies, logs, and similar technologies when you use the Service.

We receive limited data from payment processors (Stripe) and integrated platforms when you authorize connections.

We do not knowingly purchase personal data from data brokers for profiling purposes.

We process personal data for the following purposes:

• Providing the Service — account creation, authentication, generations, storage, exports, and customer support (contract performance)
• Billing & subscription management — processing payments, renewals, refunds, fraud prevention, and accounting (contract; legal obligation)
• Security & abuse prevention — detecting fraud, enforcing Terms, protecting users and infrastructure (legitimate interests; legal obligation)
• Product improvement — debugging, analytics, feature development, and quality assurance using aggregated or pseudonymized data where possible (legitimate interests)
• Communications — transactional emails (receipts, security alerts, policy updates) and, with consent where required, marketing (contract; consent)
• Legal compliance — responding to lawful requests, tax records, and regulatory obligations (legal obligation)
• Optional integrations — publishing content you direct us to publish via connected accounts (contract; consent)

To fulfill your requests, we transmit prompts, uploads, parameters, and contextual metadata to third-party AI inference providers and infrastructure partners. These transfers are necessary to perform the Service you request.

Providers may temporarily cache inputs/outputs according to their policies. We select providers that contractually commit to confidentiality and data protection standards appropriate to the Service.

You should not submit special categories of personal data (health, biometric identifiers for identification, political opinions, etc.) or confidential third-party information unless you have lawful grounds and accept the associated risk.

We may use automated systems to detect prohibited content (e.g. CSAM, malware) for safety and legal compliance. Confirmed violations may be reported to authorities.

We do not sell your personal data. We share data only as described below:

• Service providers / processors — cloud hosting, databases, CDN, email delivery, customer support tools, AI/API providers, and security vendors under contractual data protection terms
• Payment processing — Stripe receives billing-related data to process transactions and prevent fraud
• Integrations you authorize — e.g. TikTok when you connect an account and request publishing
• Legal & safety — courts, regulators, or law enforcement when required by law or to protect rights, safety, and integrity
• Business transfers — in connection with merger, acquisition, or asset sale, subject to continued protection consistent with this Policy
• With your direction — when you explicitly request export, sharing, or publication

Your data may be processed in countries other than your own, including jurisdictions that may not provide the same level of data protection as your home country.

Where required, we implement appropriate safeguards such as Standard Contractual Clauses (SCCs), data processing agreements, and technical measures (encryption in transit, access controls).

You may contact info@nanta.pro for information about transfer mechanisms applicable to your region.

We retain personal data only as long as necessary for the purposes described in this Policy, unless a longer period is required or permitted by law.

Account data is retained while your account is active. After account deletion, we delete or anonymize personal data within a reasonable period, except where retention is necessary for legal, tax, fraud prevention, dispute resolution, or enforcement of our agreements.

Billing records may be retained for statutory accounting periods. Backup copies may persist for a limited time before automated purging.

Anonymized or aggregated data that cannot reasonably identify you may be retained indefinitely for analytics and product improvement.

We implement administrative, technical, and organizational measures designed to protect personal data, including HTTPS/TLS encryption, hashed password storage, role-based access controls, monitoring, and vendor security reviews.

No method of transmission or storage is completely secure. You are responsible for maintaining strong passwords and safeguarding your devices.

If we become aware of a personal data breach likely to affect your rights, we will notify you and regulators as required by applicable law.

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of personal data we hold about you
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion (also available via Profile → Personal → Delete account)
• Restriction — limit processing in certain circumstances
• Portability — receive data in a structured, commonly used format where technically feasible
• Objection — object to processing based on legitimate interests or direct marketing
• Withdraw consent — where processing is consent-based, without affecting prior lawful processing
• Complaint — lodge a complaint with your local supervisory authority
• To exercise rights, use in-app settings or email info@nanta.pro with sufficient information to verify your identity. We respond within applicable legal timeframes (typically 30 days under GDPR).

The Service is not directed to individuals under 18. We do not knowingly collect personal data from children. If you believe a child has provided data, contact info@nanta.pro and we will take appropriate steps to delete it.

We do not use automated decision-making that produces legal or similarly significant effects solely by automated means without human involvement.

Automated content moderation and fraud scoring may affect account features or access; you may contact us to review significant adverse decisions where required by law.

We may send product updates, offers, or newsletters if you opt in or where permitted by law based on existing customer relationship. You may unsubscribe via email links or by contacting info@nanta.pro.

Transactional and service-related messages (security alerts, billing receipts, policy updates) are not marketing and may still be sent.

We may update this Policy periodically. The "Last updated" date reflects the latest version. Material changes may be notified by email or in-app notice.

Continued use after changes constitutes acknowledgment. If you disagree, discontinue use and delete your account.

Data protection inquiries: info@nanta.pro. General contact: info@nanta.pro. Website: https://nanta.pro.