Privacy Policy

The short version

• We collect what we need to run the studio: your account, your content, your jobs and payments, and basic device and log data.
• We don't sell your personal data or share it for cross-site advertising. We use no advertising or tracking cookies.
• We don't train AI models on your content unless your workspace opts in.
• Your content goes only to the companies that help us run your jobs, listed in section 6.
• People at Nineplane look at your content only when you ask for help, when it is flagged for safety, or when the law requires it.
• Face and voice data used to verify consent is kept only as long as needed and never sold.
• You can export your data and delete your account yourself, in settings. We purge a deleted account's content within 30 days.
• These rights apply to everyone, wherever you live.

1. Who we are and what this policy covers

[LEGAL ENTITY NAME] ("Nineplane", "we", "us"), of [ADDRESS], runs the Nineplane website and studio, Planes MCP and the Nineplane API (the "Service"). This policy explains how we handle personal data about people who use the Service, people who appear in content uploaded to it, and people who contact us.

We are the controller of the personal data described here: we decide why and how it is used. One exception: when a business uses a team workspace, the business controls the personal data in the content its team uploads, and we process that content for it. Business customers can sign our data processing agreement at /legal/dpa.

2. What we collect

We don't track whether you open our emails or click links in them.

3. How we use it

• To provide the Service: create and secure your account, run your jobs, store your content, show it to you and your team, take payments, and send service emails such as sign-in links, receipts, renewal and trial reminders, and job updates.
• To keep people safe and enforce our rules: scan inputs and outputs for content our Acceptable Use Policy bans, verify consent before a real person's face or voice is used, prevent fraud and abuse, and handle reports and appeals.
• To keep the Service working: fix bugs, monitor performance, prevent attacks, and reconcile charges with our providers.
• To improve the Service: learn which features are used and where jobs fail, from aggregate analytics and job metrics such as failure rates and run times, not by looking at your content.
• To talk to you: answer support requests and, only if you choose (section 10), send product news.
• To meet legal duties: keep tax and accounting records, respond to lawful requests, and report child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC).
• To train models: only if your workspace opts in (section 4).

4. Your content: what we do and don't do

• What we do with it. We use your content to run the jobs you ask for, store it, show it to the people you share it with, and scan it for safety.
• No training by default. We don't use your content to train or fine-tune AI models unless an owner or admin of your workspace turns on its training setting. While it is on, we may use content created in that workspace from then on to improve Nineplane's own models and tools. We never give it to other companies to train theirs. Turning the setting off stops future use and removes that content from our training data; models already trained are not retrained.
• Providers don't train on it either. We send content only to model providers that have agreed not to use it to train their models.
• Machines check quality, not people. We run automatic checks on outputs, for example for empty, black or corrupted files, so we can catch failures and refund them.
• When people see it. People at Nineplane look at your content only (a) when you ask for help with it, (b) when our safety systems flag it or someone reports it, (c) to review an appeal, (d) to investigate a security incident, fraud or abuse, or (e) when the law requires. Only trained staff bound by confidentiality have access, and every access is logged.
• No marketing use. We don't use your content in our marketing without your separate permission.
• Content credentials. Outputs carry C2PA metadata stating that they were made with AI, with the tool, model and date. It doesn't include your name or email unless you choose to add them. We keep a record linking each output's credentials to the job that made it, so we can investigate abuse reports.

5. Face and voice data

Some features use a real person's face or voice: subject swaps, motion transfer, trained characters, voice cloning and talking avatars. Before these features can use a real person, we verify that the person consented.

• What we collect. A short live capture of your face (a video selfie) or voice (you read a random phrase), or a release signed by the person shown; and templates, which are numerical descriptions of a face or voice made from them. Templates can be biometric data under laws such as the Illinois Biometric Information Privacy Act, the Texas and Washington biometric laws, and the GDPR.
• Why. To confirm that the person consented and is an adult, to check that the face or voice used matches the person who consented, and to block public figures. When you use these features, we compare the faces and voices in your inputs with the consents on file and with a list of public figures. We don't keep templates of people who haven't consented.
• Consent. We ask for your explicit written consent, given electronically, before we collect your face or voice data. When you upload someone else's likeness, their signed release must include their consent to this processing.
• How long we keep it. We delete live captures within 30 days after verification. We keep templates only while the character or voice they support exists, and delete them within 30 days after you delete it, withdraw consent or close your account, or after 12 months without use (we email you first). We keep releases and consent records while the character or voice exists and for 3 years after, so we can show consent if it is challenged.
• No sale. We don't sell, lease or trade face or voice data, or otherwise profit from it. We disclose it only to service providers that process it for us under contract, or when the law requires.
• Passkeys are different. When you sign in with a passkey using Face ID, Touch ID or a fingerprint, the check happens on your device. We never receive your face or fingerprint from it.

6. Who we share it with

We share personal data only as this section describes. We don't sell personal data, and we don't share it for cross-context behavioral advertising.

6.1 Service providers. These companies process data for us under contracts that limit them to providing their service:

The current list, with where each provider processes data, is at /legal/subprocessors. We update it before a new provider starts handling personal data. Stripe also uses payment data under its own privacy policy to prevent fraud and meet its legal duties.

6.2 Sign-in providers you choose. If you sign in with Google or Apple, they confirm who you are to us, under their own privacy policies.

6.3 Your team. Owners and admins of a team workspace can see its content, members, usage and credit history, including what you made there.

6.4 People you share with. Anyone who has the link can see public posts, profiles, Recipes and share links.

6.5 AI assistants you connect. If you use Planes MCP from an assistant such as Claude or ChatGPT, the assistant's provider receives what passes through the assistant, such as the results you ask it to show. Its own privacy policy applies.

6.6 Safety and the law. We report child sexual abuse material to NCMEC, which may share reports with law enforcement. We disclose personal data to authorities when the law requires it and we receive valid legal process, or in an emergency involving a risk of death or serious injury. We tell the affected user about a request unless the law forbids it or it is an emergency. We may also share information to protect people, the Service or our rights, for example to stop fraud.

6.7 If Nineplane changes hands. If Nineplane is merged or sold, personal data may pass to the new owner, who must honor this policy for data collected under it. We will tell you before that happens.

6.8 With your consent. We share personal data in other ways only if you ask us to or agree.

7. Cookies and similar technologies

We use only the cookies and browser storage the Service needs to work. We use no advertising or cross-site tracking cookies, and our analytics use no cookies at all. Because nothing we set is optional, we don't show a cookie banner. If we ever add optional cookies, we will ask first where the law requires it.

We treat a Global Privacy Control signal as a request to opt out of the sale or sharing of personal data, which we don't do anyway. Because we don't track you across sites, there is nothing for a Do Not Track signal to switch off.

8. How long we keep it

If the law requires us to keep something longer, or it is needed for an active legal claim, we keep it only for that purpose.

9. Security

We protect data with encryption in transit and at rest, least-privilege access controls, phishing-resistant passkey sign-in, separation between workspaces in the database, and logs of staff access. Stripe handles card data. No system is perfectly secure. If a breach affects your personal data, we tell you and the relevant authorities without undue delay, as the law requires.

10. Your rights and choices

We give these rights to everyone, wherever you live:

• Access and export. Download your account data and content from settings, in common machine-readable formats.
• Correction. Edit your details in settings, or ask us to correct them.
• Deletion. Delete content or your whole account in settings. We purge a deleted account's content within 30 days and keep only what section 8 says we must.
• Objection and restriction. Object to uses based on our legitimate interests, or ask us to limit use while we look into a request.
• Portability. Exports use standard formats: JSON for account data, and your content's original or exported formats.
• Withdrawing consent. Turn off the training setting or product emails, or delete your face or voice data, at any time. This doesn't affect what we did before.
• Human review. Ask a person to review any automated moderation decision about your content, using the appeal process in the Acceptable Use Policy.

How to make a request. Use settings, or email [PRIVACY EMAIL]. To protect your account, we confirm requests by asking you to sign in. Someone you authorize can make a request for you with your signed permission, and we may ask you to confirm your identity. We answer within 30 days. If a request is complex, we may need up to 60 more days and will tell you why within the first 30. Requests are free unless they are clearly unfounded or excessive. Using your rights never affects the price or service you get.

If we say no. Tell us, and a different person will review the decision. You can also contact your data protection authority or, in the US, your state attorney general.

Emails. While you have an account, we send service emails you can't turn off: sign-in links, receipts, renewal and trial reminders, and security and legal notices. Product emails, such as tips and news of features, are optional, and each has a one-click unsubscribe. Where the law requires consent, for example in the EEA and UK, they stay off until you turn them on.

11. US state privacy notices

11.1 California. In the last 12 months we collected these categories of personal information: identifiers; customer records; commercial information; biometric information; internet or other electronic network activity; approximate geolocation; audio, electronic and visual information; professional information for business accounts; and sensitive personal information (face and voice data used to verify consent). Sections 2 and 3 describe the sources and purposes, section 6 the service providers we disclose each category to, and section 8 how long we keep it.

• We don't sell or share personal information, as the California Consumer Privacy Act defines those terms, including that of consumers under 16, and have not done so in the last 12 months.
• We use sensitive personal information only to provide the features you ask for, to keep the Service secure and to meet the law, not to infer things about you. So there is nothing to limit, though you can still delete it.
• You have the right to know, access, correct and delete your personal information, and not to be discriminated against for using these rights. Section 10 explains how.
• We don't disclose personal information to third parties for their own direct marketing.

11.2 Other states. Residents of other states with consumer privacy laws, such as Colorado, Connecticut, Oregon, Texas and Virginia, have the rights in section 10. To appeal a decision on your request, reply to our answer or email [PRIVACY EMAIL] with "Appeal" in the subject. We answer appeals within 45 days. If we deny your appeal, you can contact your state attorney general.

12. EEA, UK and Swiss users

12.1 Controller and representatives. The controller is [LEGAL ENTITY NAME], [ADDRESS], [PRIVACY EMAIL]. Our representative in the EU is [EU REPRESENTATIVE], and in the UK is [UK REPRESENTATIVE].

12.2 Legal bases.

12.3 Automated decisions. Our moderation systems decide automatically whether to block content. You can always ask for a person to review a decision, give your view and contest it, using the appeal process.

12.4 International transfers. We are based in the United States, and our providers process data in the United States and other countries, including [DATA REGIONS]. Jobs sent to BytePlus are processed in [BYTEPLUS REGION]. When we transfer personal data out of the EEA, UK or Switzerland, we use the European Commission's Standard Contractual Clauses, with the UK Addendum and the Swiss amendments, or another lawful transfer mechanism. You can ask for a copy at [PRIVACY EMAIL].

12.5 Complaints. You can complain to your local data protection authority, or in the UK to the Information Commissioner's Office. We would appreciate the chance to fix the problem first.

13. Children

The Service is only for adults 18 and over. We don't knowingly collect personal data from anyone under 18. If we learn that an account belongs to someone under 18, we close it and delete its data. Our rules also block the use of any real child's face or voice. If you think a child has given us personal data, email [PRIVACY EMAIL].

14. Changes to this policy

When we update this policy, we change its version date. For material changes, we email you and show a notice in the studio at least 30 days before they take effect. We won't use personal data we already hold in a new way that needs your consent, such as training, without asking you first.

15. Contact

[LEGAL ENTITY NAME], [ADDRESS]. Privacy questions and requests: [PRIVACY EMAIL].