Privacy Policy

Last updated: August 18, 2026

This Privacy Policy explains how onano.app ("we", "us", "our") collects, uses, stores, and protects personal data when you use our website, applications, AI-powered editing tools, and related services (the "Service").

By using the Service, you acknowledge this Privacy Policy.

1. What We Collect

We may collect the following categories of personal data:

• account details such as name, email address, login credentials, and profile information
• uploaded content including videos, audio, images, transcripts, subtitles, and project metadata
• connected third-party account data such as Google / YouTube, Meta / Instagram, and TikTok account identifiers, access tokens, profile metadata, and authorized content access
• payment and billing data processed through Stripe
• usage, diagnostic, and performance data, and analytics data where analytics is enabled
• device, browser, IP address, log data, and performance diagnostics
• customer support messages and feedback

When you use our desktop application with Premiere Pro, transcription runs locally on your device — your video and audio files are not uploaded to us. Only the resulting transcript and the text needed to generate clips, titles, and captions is sent to the Service.

2. How We Use Personal Data

We use personal data to:

• provide and operate the Service
• process uploaded media and generate AI-assisted outputs
• manage subscriptions, payments, and invoices
• improve performance, workflows, and product experience
• measure usage, engagement, and feature adoption
• provide customer support
• prevent fraud, abuse, and security incidents
• comply with legal obligations

To generate clips, titles, captions, and descriptions, transcripts and related text are processed by our third-party AI provider, OpenAI. This is processing to deliver the Service, not model training.

We do not use your uploaded content or personal data for AI model training unless you have explicitly opted in.

3. Legal Basis (GDPR)

Where GDPR applies, we process personal data based on one or more of the following legal grounds:

• performance of a contract
• compliance with legal obligations
• legitimate interests in operating and improving the Service
• your consent, where required, including AI training opt-in and cookies

4. AI Training and Opt-In

Your uploaded media, transcripts, captions, and generated outputs are not used for AI model training by default.

If you explicitly opt in, we may use selected content and related metadata to improve model quality, editing suggestions, and workflow performance.

You may withdraw this consent at any time, and future training use will stop from that point onward.

5. Sharing and Subprocessors

We only share personal data with trusted providers necessary to operate the Service, including:

• Stripe for payments and billing
• OpenAI for AI processing of transcripts and content to generate clips, titles, captions, and descriptions
• cloud hosting, storage, rendering, and infrastructure partners
• customer support and communication tools
• Google / YouTube connected account services
• Meta / Instagram connected account services
• TikTok connected account services
• Google Analytics, where you have accepted analytics cookies, to understand usage and improve the Service

These providers only process data on our behalf under appropriate contractual and security safeguards.

6. Data Retention

When content is deleted by you or upon account closure, uploaded media, generated outputs, and related project files are removed within a reasonable period, except where temporary retention is required for backups, security, fraud prevention, or legal compliance.

If your account remains inactive for 24 months, we may delete or anonymize the account and associated personal data.

Billing, tax, fraud prevention, and legally required records may be retained longer where required by law.

7. Cookies and Analytics

We use strictly necessary storage, such as browser local storage, to keep you signed in and to remember editor preferences.

We use Google Analytics 4 to measure how the Service is used, but only after you accept analytics cookies in our cookie banner. If you decline or ignore the banner, the Google Analytics script is never loaded. We do not use advertising or retargeting cookies.

You can change or withdraw your choice at any time from the Cookie Policy page. See that page for the specific cookies involved.

8. International Transfers

Your personal data may be processed outside the EU/EEA by trusted providers.

Where this happens, we use appropriate safeguards such as Standard Contractual Clauses or equivalent lawful transfer mechanisms.

9. Your Rights

If you are located in the EU/EEA or another jurisdiction with similar rights, you may request:

• access to your personal data
• correction of inaccurate data
• deletion of personal data
• restriction of processing
• data portability
• objection to processing based on legitimate interests
• withdrawal of consent at any time

You also have the right to lodge a complaint with your local supervisory authority, including Integritetsskyddsmyndigheten (IMY) in Sweden.

10. Security

We use reasonable technical and organizational measures to protect personal data, including access controls, encryption where appropriate, logging, and secure infrastructure providers.

No system can be guaranteed 100% secure.

11. Children

The Service is not intended for users under 18 years of age, and we do not knowingly collect personal data from minors.