Privacy Policy

Information we collect

• Account information: your email address and, if you choose password sign-in, a securely hashed password. We never store plaintext passwords.
• Creative content you provide: project titles, character descriptions (canon prompts), scripts, dialogue, and any reference images you upload. You decide what to create.
• Generated content: panels, pages, and LoRA weights we create on your behalf, stored so you can revisit and export them.
• Payment information: handled entirely by Stripe. We receive only a customer identifier and subscription status — never your card details.
• Free use: a one-way hash of your email inbox, so the free credits are given once per inbox; daily usage counters by account and network address.
• Visits: a random visitor ID and where you first came from (stored in your browser), and the pages you open on our site.
• Contact form: your message is emailed to us and not stored on our servers.

How we use your information

• To generate and render panels, pages, and reference sheets for your projects.
• To operate your account, process subscriptions, and provide support.
• To send transactional emails (magic links, password resets, billing receipts).
• To keep the service secure and prevent abuse.

AI processing and GPU providers

To generate panel images, your prompts and reference images are sent to third-party GPU inference providers (fal.ai, with Replicate as a fallback) acting as processors on our behalf; panel animations are made by xAI. We send only what is necessary to generate your content. We do not use your creative work to train shared models.

IP and style

Style presets use original, internally-named weight bundles. We do not expose named-artist mimicry in the API. A denylist filters artist references in prompts before any GPU spend. Every export embeds C2PA provenance metadata. Output ownership is assigned to the creator in our Terms.

How we share information

We do not sell your personal information. Our processors: Amazon Web Services (hosting, storage, email), fal.ai and Replicate (images), xAI (animation), Stripe (payments), and Google if you sign in with Google. Some are in the United States; transfers rely on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. We use your data to provide the service (Art. 6(1)(b) GDPR) and to keep it secure and prevent abuse of free use (Art. 6(1)(f) GDPR).

Data retention and deletion

We keep your content while your account is active. You can delete your account on the Billing page: this cancels any subscription and then deletes your account, projects and images at once. Invoices are kept as tax law requires (up to 10 years).

Security

We protect your data with TLS encryption in transit, bcrypt-hashed passwords, short-lived JWT access tokens, and rotating refresh tokens with theft detection. Object storage assets are private by default and served via signed URLs.

Cookies and storage

One cookie, tf_refresh, keeps you signed in. Your browser's local storage holds the visitor ID and first-visit details. No advertising or third-party tracking cookies.

Server logs

Our web server logs each request: IP address, time, the address requested, the response, and your browser's user agent. We use the logs to keep the service running and secure (Art. 6(1)(f) GDPR); they are deleted automatically after at most 8 days.

Your rights

You can ask for access to, correction, deletion, restriction or export of your data, and object to processing based on legitimate interests: email info@nubri.co. You can also complain to a data protection authority, for example the Berlin Commissioner for Data Protection and Freedom of Information.

Contact

Questions about this policy? Email us at info@nubri.co or use our contact form.