Privacy Policy

1. Who we are

NanoPocket is the data controller for every personal-data category described below. For privacy questions, write to tech@nanopocket.ai. We are not a registered "publisher" or "data fiduciary" under any sector-specific regime; we operate as a software vendor.

2. What we collect, why, and for how long

Every category below is listed with its purpose, lawful basis under the GDPR, and retention period. If a category is not on this list, we do not collect it. We do not collect special-category data (health, biometric identifiers used for unique identification, political opinions, religion, sexuality) and we do not perform automated decision-making with legal effects on data subjects.

3. Subprocessors

We use the following subprocessors. Each maintains its own privacy policy; we link directly to the relevant page so it can be inspected without going through us.

4. Online demo handling — what happens to uploaded faces

The Image FaceSwap Pro 2.0 and Video FaceSwap Pro online demos are the only NanoPocket surfaces that receive user-uploaded face content. We treat that content as follows:

• Volatile processing only. Source files live in the demo GPU's working memory for the duration of one inference and are discarded immediately after the response is returned.
• No model training. Demo content is never used to train, fine-tune, evaluate, or red-team any model. There is no "opt-in to improve our AI" checkbox; training on user content is simply not part of any product surface.
• No persistence. Demo content is not copied to long-term object storage, a database, a content-moderation queue, or any human-review pipeline.
• No third-party sharing. Demo content is not transferred to advertising networks, model marketplaces, or any third party outside the subprocessor list above.
• Consent & lawful use. By submitting a face to the demo, the uploader confirms they hold all rights necessary to do so and that the use is lawful (no impersonation, no non-consensual likeness, no minors in adult contexts).

5. Cookies & web tracking

We use a single first-party session cookie for authenticated dashboards (set by Supabase's auth client). Google Analytics 4 sets analytics cookies for aggregate traffic measurement; IPs are anonymised at collection. We do not use advertising pixels (Meta Pixel, TikTok Pixel, LinkedIn Insight Tag, Google Ads conversion pixels, etc.) and we do not retarget visitors.

6. GDPR rights (EU / UK / EEA / Switzerland)

Data subjects have the following rights under the GDPR (and the UK GDPR / Swiss FADP equivalents). Email tech@nanopocket.ai from the address on the account; we respond within 30 days as required.

• Right of access (Art. 15) — receive a copy of personal data we hold.
• Right to rectification (Art. 16) — correct inaccurate or incomplete data.
• Right to erasure (Art. 17) — delete the account and associated data.
• Right to restrict processing (Art. 18).
• Right to data portability (Art. 20) — export in JSON format.
• Right to object to processing on legitimate-interest grounds (Art. 21).
• Right to lodge a complaint with a supervisory authority (e.g. CNIL, ICO, BfDI). We encourage users to contact us first; we will not retaliate against complainants.

7. CCPA rights (California)

California residents have the right to know, the right to delete, the right to correct, and the right to limit use of sensitive personal information under the CCPA (as amended by the CPRA). Submit verifiable consumer requests to tech@nanopocket.ai. We respond within 45 days.

We do not sell or share personal information for cross-context behavioural advertising. Our Global Privacy Control (GPC) signal handling: GPC has no effect on our processing because we do not engage in "sale" or "sharing" under the CPRA.

8. International data transfers

Account, license, and demo infrastructure runs primarily in US-East. EU-based users who use these services therefore transfer personal data to the US. We rely on the European Commission's Standard Contractual Clauses (2021/914) where required, and on the EU-U.S. Data Privacy Framework where the relevant subprocessor is certified.

9. Children's data

NanoPocket is not directed to children under 16 (under 13 in the United States). We do not knowingly collect data from children. If a parent or guardian becomes aware that their child has signed up, please email tech@nanopocket.ai and we will delete the account.

10. Security

We use TLS 1.2+ in transit and AES-256 at rest for managed-database content. Account passwords are stored as bcrypt hashes by Supabase. Vulnerability reports are accepted at security@nanopocket.ai; the full coordinated-disclosure policy is on the Security page.

11. Changes to this policy

Material changes will be announced via email to the address on the user's account at least 14 days before they take effect. Non-material edits (typo fixes, link updates, subprocessor list refreshes within the same category) are made silently and reflected in the version number above.