Nanobanana

Users retain ownership of content they create, though they grant the service a limited license for processing and storage. The terms clearly state user ownership while allowing necessary operational use.

Users retain ownership of generated images and outputs. The service only maintains rights necessary for operational purposes like processing and storage.

The service may use anonymized and aggregated user data to improve AI models. While personal identifying information is removed, user interactions can still be used for model training purposes.

Data retention periods vary by type: account information until deletion, usage data for 2 years, and payment data as required by regulations. Users can request account and data deletion, though specific deletion timelines are not provided.

The service explicitly states they do not sell personal information and only share data with service providers, for legal compliance, safety, or business transfers. Sharing appears limited to operational necessities.

Users have several data rights including access, correction, deletion, and objection to certain processing. However, the policy doesn't explicitly mention opt-out rights for AI training or specific data collection practices.

The policies mention compliance with legal obligations and financial regulations but provide no specific regulatory frameworks, certifications, or standards. No mention of GDPR, SOC 2, or other major compliance frameworks.

No information is provided about model transparency, explainability features, or enterprise auditing capabilities. The AI technology is described as proprietary without disclosure of how decisions are made.

Basic security measures are mentioned including encryption in transit and at rest, access controls, and regular security assessments. However, no detailed security framework, third-party audits, or breach history is disclosed.

The policies reference both free and paid subscription tiers but don't clearly distinguish data handling practices between them. Enterprise-specific protections or different privacy treatment are not explicitly outlined.

The policy mentions processing content for compliance with policies and preventing misuse, which suggests potential human review capabilities. However, specific human access rights and review procedures are not clearly detailed.

The policy acknowledges sharing data when required by law or legal process and mentions dispute resolution through legal channels. However, specifics about government requests or law enforcement cooperation are limited.

The service collects standard PII including email, name, account credentials, IP address, device information, and usage patterns. Payment information is processed through third parties. No sensitive personal information appears to be collected beyond payment data.