Privacy Policy

Last updated: April 22, 2026

This Privacy Policy explains how Gunni ("we", "us", or "our") collects, uses, and protects your information when you use the Gunni API, website at gunni.ai, and related services (the "Service").

1. Information We Collect

Account Information

When you create an account, we collect your email address and authentication credentials. We use Supabase Auth for account management, which may also collect metadata such as login timestamps and IP addresses.

Payment Information

Payment processing is handled by Stripe. We do not store your credit card numbers or bank account details. We retain transaction records including purchase amounts, credit pack purchased, and Stripe payment identifiers. If you enable auto-purchase, Stripe stores your payment method on file; we store only your auto-purchase preferences (threshold and pack selection).

Usage Data

When you use the API, we log:

• Which operations you perform and when (e.g., image generation, video creation)
• Which models are used for each request
• Credit costs and billing events
• API key identifiers (hashed, not the raw key value)
• Request metadata (timestamps, response times, error codes)

Inputs and Outputs

When you make API requests, we process the prompts and media you provide as inputs. Generated outputs (images, video, audio) are stored in cloud storage for delivery.

• Transient outputs (generations you do not save): retained for up to 30 days for operational purposes, then deleted.
• Saved assets (outputs you name or pin to your library): retained until you delete them.

Generated media is stored at randomized, unguessable URLs with no authentication required. This means anyone you share a direct link with can access that file. We do not make your outputs publicly discoverable or indexable.

We do not use your inputs or outputs to train AI models.

Product Analytics

We use PostHog for product analytics to understand how the Service is used and to improve it. We collect events such as operations performed, models used, error rates, and feature usage. Analytics data is associated with your account identifier, not your name or email. Our client-side analytics respect your browser's "Do Not Track" setting. We do not use third-party advertising cookies or tracking pixels.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process transactions and manage your credit balance
• Authenticate API requests and prevent abuse
• Send transactional communications (e.g., purchase receipts, credit alerts)
• Monitor service performance and debug issues
• Analyze usage patterns to improve the product
• Enforce our Terms of Service and acceptable use policies

We do not sell your personal information. We do not send marketing emails unless you opt in.

3. Third-Party Services

We share data with third-party services to operate the Service:

• AI model providers (e.g., fal.ai, Google Vertex AI): receive your prompts and inputs to generate outputs. These providers process data according to their own privacy policies.
• Supabase: hosts our database, authentication, and file storage.
• Stripe: processes payments and stores payment methods for auto-purchase. See Stripe's privacy policy.
• PostHog: product analytics. Data is stored in the United States. See PostHog's privacy policy.
• Resend: delivers transactional emails (welcome, purchase confirmations, credit alerts). See Resend's privacy policy.

We select providers that maintain reasonable security practices. We do not share your data with providers for purposes unrelated to delivering the Service.

4. Data Storage and Security

Your data is stored on servers in the United States. We use industry-standard security measures including:

• Encryption in transit (TLS) for all API and website traffic
• API keys stored as SHA-256 hashes (we never store raw key values)
• Row-level security policies on database tables
• Randomized, non-enumerable storage paths for generated media
• Access controls limiting which personnel can access production data

No system is perfectly secure. If we discover a data breach affecting your personal information, we will notify you promptly.

5. Data Retention

• Account data: retained while your account is active, and for a reasonable period after deletion to comply with legal obligations.
• Billing records: retained for up to 7 years for tax and accounting purposes.
• Transient generated content (unsaved outputs): retained for up to 30 days, then deleted.
• Saved assets (pinned or named outputs): retained until you delete them from your library.
• API logs: retained for up to 90 days for operational monitoring.

6. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Export your data in a portable format
• Object to or restrict certain processing

To exercise any of these rights, email us at privacy@gunni.ai. We will respond within 30 days.

7. Cookies

We use essential cookies for authentication, session management, and remembering your active workspace. We do not use advertising or cross-site tracking cookies. You can disable cookies in your browser settings, though this may prevent you from using the dashboard.

8. Children

The Service is not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact us and we will delete it.

9. International Users

The Service is operated from the United States. If you access the Service from outside the US, your information will be transferred to and processed in the US. By using the Service, you consent to this transfer.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you via email or through the Service. The "last updated" date at the top reflects the most recent revision.

11. Contact

Questions about this Privacy Policy? Email us at privacy@gunni.ai.