Nabi — Privacy Policy

1. Introduction and Scope

This Privacy Policy explains how Nabi ("Nabi," "we," "us," or "our") collects, uses, discloses, retains, and protects personal data when you use the Nabi websites, applications, and related services (the "Service"), and describes the choices and rights you have.

1.1This Policy applies to personal data we process about visitors, registered users, and other individuals who interact with the Service. It should be read together with our Terms of Service.

1.2"Personal data" (or "personal information") means information that identifies, relates to, or could reasonably be linked with a particular individual or household. It includes, in particular, photographs and images that depict identifiable people.

1.3By using the Service, you acknowledge that your personal data will be processed as described in this Policy. Where we rely on your consent, we will ask for it separately, and you may withdraw it as described below.

1.4If you do not agree with this Policy, please do not use the Service.

2. Who We Are and How to Contact Us

2.1Nabi is the controller responsible for the processing of your personal data described in this Policy, except where we act as a processor on behalf of another party or where a region-specific section states otherwise.

2.2For any privacy question, request, or complaint, you can contact us at privacy@flynabi.com, or by writing to us via the contact details published at flynabi.com.

2.3If we are required to designate a data protection officer or a representative in a particular region, their contact details will be made available as required by applicable law.

3. Summary of Key Points

This summary highlights important aspects of how we handle your data. It is not a substitute for the full Policy below.

3.1We process the photographs you upload to generate the images you request. We may also retain and store uploaded images and other content and use them for internal research, development, quality assurance, and to train or fine-tune our artificial-intelligence models, as described in this Policy.

3.2To generate images, your uploaded content is transmitted to and processed by third-party artificial-intelligence providers that operate the underlying models.

3.3We use limited technical and usage data to operate, secure, and improve the Service, to enforce usage limits, and to prevent abuse.

3.4Photographs of faces and bodies may be sensitive or biometric data in some jurisdictions; we handle them accordingly and ask for your confirmation of rights and consent before processing.

3.5You have rights over your personal data, including, depending on your location, rights to access, correct, delete, object to, or restrict processing, and to lodge a complaint with a regulator.

4. Categories of Personal Data We Collect

We collect the following categories of personal data, depending on how you interact with the Service.

4.1Information you provide directly: photographs and images you upload (which may depict you or other people), product images, style notes and text prompts, and any information you include in communications with us.

4.2Account information: where you create an account, information such as your name or display name, email address, and authentication identifiers.

4.3Transaction information: where you make a purchase, information necessary to process the transaction, such as your plan, purchase history, and billing-related identifiers. Full payment-card details are handled by our payment processors and are not stored by us.

4.4Usage and device information collected automatically: IP address, device and browser type, operating system, language, referring pages, pages viewed, features used, timestamps, generation counts, error and diagnostic logs, and similar analytics data.

4.5Cookies and similar technologies: identifiers and preferences stored on your device, as described in the "Cookies and Similar Technologies" section.

4.6Information from third parties: where you authenticate through a third-party provider, limited profile information from that provider; and information from payment processors, security providers, and analytics providers.

4.7Inferences and derived data: non-reversible technical derivatives, such as hashes generated from uploaded content, used for abuse-prevention, de-duplication, and quota-enforcement.

5. Photographs and Images

Because photographs are central to the Service and may reveal sensitive information, we describe our handling of them specifically.

5.1When you upload a photograph, we process it to produce the artificially generated images you request. This processing includes transmitting the image to third-party AI providers that operate the underlying models.

5.2In addition to generating your requested images, we may retain and store the photographs and other content you upload, together with related metadata and non-reversible hashes, and use them for security, abuse-prevention, de-duplication, quota-enforcement, legal-compliance, internal research and development, quality assurance, and the training, fine-tuning, and improvement of our artificial-intelligence models, for as long as necessary for those purposes and as permitted by applicable law.

5.3Generated images (Output) and limited associated records may be retained to provide the Service to you, to maintain safety and integrity, and as described in the "Data Retention" section. You are responsible for saving copies of Output that are important to you.

5.4You must only upload photographs of yourself or of people who have given you all necessary consent, as described in our Terms of Service. You are responsible for the lawfulness of the images you submit and for honoring the privacy rights of any person depicted.

5.5TODO: Confirm the exact retention behavior for uploaded images, derivatives, and Output, and align this section with the Service's actual configuration.

6. Sensitive and Biometric Data

6.1Photographs that depict faces or bodies may constitute sensitive personal data or biometric information under certain laws, which impose heightened requirements on their processing.

6.2We process such data to provide the Service you request, for the security and integrity purposes described in this Policy, and, where you have provided any legally required consent, to train, fine-tune, and improve our artificial-intelligence models; where applicable law requires explicit consent or another specific legal basis to process sensitive or biometric data for training or similar purposes, we will obtain it before doing so.

6.3We do not use facial or bodily features to identify or track individuals across sessions except as strictly necessary to operate the Service, and we do not sell biometric information.

6.4Where a law grants you specific rights over sensitive or biometric data, you may exercise them as described in this Policy or by contacting us at privacy@flynabi.com.

7. How We Use Personal Data

We use personal data for the following purposes.

7.1To provide the Service, including to generate the images you request from your uploaded content and instructions.

7.2To create and manage your account and to authenticate you.

7.3To process transactions, manage subscriptions and credits, and enforce usage limits and quotas.

7.4To operate, maintain, secure, debug, and improve the Service, including to monitor performance and diagnose problems.

7.5To conduct internal research, development, and quality assurance, and to train, fine-tune, evaluate, and improve our artificial-intelligence models and algorithms, using uploaded content and derivatives of it, subject to any consent required by applicable law.

7.6To detect, prevent, and respond to fraud, abuse, security incidents, prohibited uses, and violations of our Terms.

7.7To communicate with you, including to send service-related messages and, where permitted, marketing communications you may opt out of.

7.8To comply with legal obligations, respond to lawful requests, and establish, exercise, or defend legal claims.

7.9To analyze usage in aggregated or de-identified form, which does not identify you, in order to understand and improve the Service.

8. Legal Bases for Processing

Where data-protection law (such as the GDPR) requires a legal basis, we rely on the following, depending on the context.

8.1Performance of a contract: to provide the Service you request and to administer your account and purchases.

8.2Consent: for processing that requires it, such as processing of sensitive or biometric data where applicable, certain cookies, and marketing communications. You may withdraw consent at any time without affecting prior processing.

8.3Legitimate interests: to secure and improve the Service, prevent abuse and fraud, and operate our business, where those interests are not overridden by your rights and freedoms.

8.4Legal obligation: to comply with applicable laws and lawful requests.

8.5Vital interests or public interest: in the rare cases where processing is necessary to protect someone's life or to perform a task in the public interest, where applicable.

9. AI Processing and Third-Party Model Providers

9.1The Service depends on third-party artificial-intelligence providers that operate the machine-learning models used to generate Output. To provide the Service, your uploaded content and instructions are transmitted to and processed by these providers on our behalf.

9.2These providers process the content subject to their own terms and safeguards. We encourage you to review the privacy practices of the providers we use, which we will identify upon request or in a published sub-processor list where required.

9.3We select providers that we believe offer appropriate protections, and, where required, we put in place data-processing agreements and safeguards governing their processing of personal data on our behalf.

9.4TODO: Maintain and, where required, publish a current list of AI and infrastructure sub-processors, and confirm each provider's data-use and retention terms.

10. Use of Data for Model Training

10.1We may use the photographs and other content you upload, and derivatives of them, to train, fine-tune, evaluate, and improve our own artificial-intelligence models and algorithms, and for related internal research, development, and quality-assurance purposes, subject to any consent required by applicable law.

10.2Your uploaded content is also processed by third-party AI providers to generate Output. Whether any such provider uses submitted content for its own model improvement depends on that provider's terms; we select and configure providers with the intention that customer content is not used to train their models, and we will describe any exceptions here.

10.3Where you have a right under applicable law to object to or withdraw consent for the use of your content for model-training purposes, you may do so as described in the "Your Rights and Choices" section or by contacting us at privacy@flynabi.com.

10.4We may also use aggregated or de-identified analytics that do not identify you, and non-content operational data, to evaluate and improve the Service.

10.5TODO: Before training on user content — especially images of identifiable people — confirm the lawful basis and any required opt-in consent, and align this section and the in-product consent flow accordingly.

11. Cookies and Similar Technologies

11.1We and our service providers use cookies, local storage, and similar technologies to operate the Service, remember your preferences, authenticate you, maintain security, measure usage, and, where applicable and consented to, for analytics.

11.2Some technologies are strictly necessary for the Service to function; others are optional and, where required by law, are used only with your consent.

11.3You can control cookies through your browser settings and, where offered, through our cookie-preference controls. Disabling certain cookies may affect the functionality of the Service.

11.4TODO: Confirm the specific cookies and analytics tools in use and, where required, implement a consent mechanism and cookie list.

12. How We Share Personal Data

We share personal data only as described below. We do not sell your personal data for money.

12.1Service providers and processors: with vendors that perform services on our behalf, such as AI model providers, cloud hosting and storage, payment processing, analytics, customer support, and security, under obligations to protect the data and use it only for the services they provide to us.

12.2Payment processors: with payment providers to process your transactions; these providers handle your payment details under their own terms.

12.3Legal and safety: with authorities, regulators, or other parties where we believe disclosure is necessary to comply with law, enforce our Terms, respond to lawful requests, or protect the rights, property, or safety of any person.

12.4Business transfers: in connection with a merger, acquisition, financing, reorganization, or sale of assets, personal data may be transferred as part of that transaction, subject to appropriate protections and notice where required.

12.5With your direction or consent: where you ask us to share information or otherwise consent to sharing.

12.6Aggregated or de-identified information: which does not identify you and is not subject to this Policy's restrictions.

13. International Data Transfers

13.1We and our service providers may process personal data in countries other than the one in which you reside, including countries that may have different data-protection laws than your own.

13.2Where we transfer personal data across borders in a manner regulated by applicable law, we implement appropriate safeguards, such as standard contractual clauses or other lawful transfer mechanisms, to protect the data.

13.3You may contact us at privacy@flynabi.com for more information about the safeguards we use for international transfers.

14. Data Retention

14.1We retain personal data only for as long as necessary to fulfill the purposes described in this Policy, including to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements.

14.2As described above, we may retain uploaded photographs and other content, together with derivatives such as non-reversible hashes and limited technical and usage records, for security, abuse-prevention, quota-enforcement, legal-compliance, and internal research, development, and artificial-intelligence model-training and quality-improvement purposes, for as long as necessary for those purposes and as permitted by applicable law.

14.3Account, transaction, and log data are retained for the periods necessary for the purposes for which they were collected and as required by applicable law, after which they are deleted or de-identified.

14.4TODO: Specify concrete retention periods for each data category once finalized.

15. Security

15.1We implement reasonable technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, and destruction, including access controls, encryption in transit where appropriate, and monitoring.

15.2No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

15.3If we become aware of a personal-data breach that affects you, we will notify you and the relevant authorities as required by applicable law.

16. Your Rights and Choices

Depending on where you live and subject to applicable law, you may have some or all of the following rights regarding your personal data.

16.1Access: to obtain confirmation of whether we process your personal data and to receive a copy of it.

16.2Correction: to request that we correct inaccurate or incomplete personal data.

16.3Deletion: to request that we delete your personal data, subject to certain exceptions.

16.4Objection and restriction: to object to or request restriction of certain processing, including processing based on legitimate interests and processing for direct marketing.

16.5Portability: to receive certain personal data in a structured, commonly used, machine-readable format and, where feasible, to have it transmitted to another controller.

16.6Withdrawal of consent: to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing.

16.7Opt-out of marketing: to opt out of marketing communications at any time using the unsubscribe mechanism or by contacting us.

16.8Non-discrimination: to not be discriminated against for exercising your privacy rights, where such protection applies.

17. How to Exercise Your Rights

17.1You can exercise your rights by contacting us at privacy@flynabi.com, or, where available, through settings within the Service.

17.2We will respond to verifiable requests within the timeframes required by applicable law. To protect your privacy, we may need to verify your identity before acting on a request.

17.3You may use an authorized agent to submit a request where the law permits, subject to our verification of the agent's authority.

17.4If we decline a request, we will explain why, subject to legal restrictions, and you may have the right to appeal or to complain to a regulator.

18. Children's Privacy

18.1The Service is not directed to children, and we do not knowingly collect personal data from children below the minimum age described in our Terms of Service.

18.2If you believe that a child has provided us with personal data without appropriate consent, please contact us at privacy@flynabi.com, and we will take appropriate steps to delete such data.

19. European Economic Area, United Kingdom, and Switzerland

If you are located in the EEA, the UK, or Switzerland, the following additional information applies.

19.1The controller of your personal data is Nabi. Our legal bases for processing are described in the "Legal Bases for Processing" section.

19.2You have the rights described in the "Your Rights and Choices" section, as provided by the GDPR and equivalent laws, including the right to lodge a complaint with your local supervisory authority.

19.3Where we transfer personal data outside the EEA, the UK, or Switzerland, we rely on appropriate safeguards such as standard contractual clauses.

19.4Where processing is based on consent, you may withdraw it at any time; where it is based on legitimate interests, you may object as described above.

20. California Privacy Rights

If you are a California resident, the following additional information applies under the California Consumer Privacy Act, as amended.

20.1You have the right to know the categories and specific pieces of personal information we collect, use, and disclose; the right to delete personal information; the right to correct inaccurate personal information; and the right to opt out of the sale or sharing of personal information and to limit the use of sensitive personal information.

20.2We do not sell your personal information for money. To the extent any disclosure of personal information for cross-context behavioral advertising is considered a "sale" or "sharing" under California law, we will provide a mechanism to opt out where required.

20.3You have the right not to receive discriminatory treatment for exercising your privacy rights.

20.4You may exercise these rights as described in the "How to Exercise Your Rights" section, and you may designate an authorized agent to act on your behalf.

21. Other United States State Privacy Rights

21.1Residents of certain other U.S. states may have rights similar to those described above, including rights to access, correct, delete, and obtain a copy of personal data, and to opt out of targeted advertising, sale of personal data, and certain profiling.

21.2You may exercise these rights as described in this Policy, subject to verification and applicable exceptions.

22. Republic of Korea

If you are located in the Republic of Korea, the following additional information applies under the Personal Information Protection Act and related laws.

22.1We process personal data in accordance with the Personal Information Protection Act, and you retain your statutory rights, including rights to access, correct, delete, suspend processing of, and obtain a copy of your personal data.

22.2Where we process sensitive information, including biometric information used to identify an individual, or where we transfer personal data overseas or to processors, we do so on the legal bases and with the notices and consents required by applicable Korean law.

22.3You may contact us at privacy@flynabi.com to exercise your rights, and you may file a complaint with the Personal Information Protection Commission or the Korea Internet & Security Agency's privacy dispute mechanisms.

22.4TODO: Confirm any additional PIPA-specific disclosures required for your operations, including any required designation of a privacy officer and consent flows for overseas transfers and sub-processing.

23. Marketing Communications

23.1Where permitted by law, we may send you marketing communications about features, offers, or updates. You can opt out at any time by using the unsubscribe link in such communications or by contacting us.

23.2Opting out of marketing communications does not affect service-related communications that are necessary to provide the Service, such as transactional or security messages.

24. Automated Decision-Making

24.1The Service uses automated systems to generate images and to enforce safety and usage rules. These systems do not make decisions that produce legal or similarly significant effects about you within the meaning of applicable data-protection law.

24.2If we ever introduce processing that constitutes automated decision-making with such effects, we will provide the information and safeguards required by law, including, where applicable, the ability to obtain human review.

25. Third-Party Links and Services

25.1The Service may contain links to third-party websites, retailers, or services, including shopping links. This Policy does not apply to those third parties, and we are not responsible for their privacy practices.

25.2We encourage you to review the privacy policies of any third party before providing them with personal data.

26. Changes to This Privacy Policy

26.1We may update this Policy from time to time to reflect changes in our practices, the Service, or applicable law. When we make material changes, we will take reasonable steps to notify you, such as by posting the updated Policy with a new effective date or by other means within the Service.

26.2Your continued use of the Service after the updated Policy becomes effective constitutes acknowledgment of the updated Policy, except where additional consent is required by law.

27. How to Contact Us

If you have questions, requests, or complaints regarding this Policy or our handling of your personal data, please contact us.

27.1Nabi

27.2Website: flynabi.com

27.3Email: privacy@flynabi.com

27.4You also have the right to lodge a complaint with a competent data-protection authority in your jurisdiction.