Privacy Policy
Last updated 6 September 2026. Version 1.1.
Who we are
Nixra is an AI creation platform for generating and editing images and video. The data controller is NIXRA LTD, company number 17432459, registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom ("Nixra", "we", "us"). For anything about your personal data write to privacy@nixra.ai.
What we collect
- Account data. Your email address and a password. Our authentication provider (Supabase) stores the password only as a secure hash; we never see it. If you turn on two-step verification, the authenticator secret is held by Supabase, not by us.
- Security data. The version of the Terms you accepted and when, your active sign-in sessions (device and time), and, if you set one, a monthly spend threshold.
- Billing data. Your plan, credit balance, and your Stripe customer and subscription identifiers. We never receive or store your card details; you enter them on Stripe's own pages.
- Content you create and upload. Prompts, generation settings, uploaded images and videos (for example photographs for saved characters and character swaps, wardrobe items, motion-reference videos, edit sources and LoRA training files), your editor documents and saved workflows, and the images and videos the platform generates for you.
- Messages to us. Anything you write in the in-app inbox, images you attach to it, and your feedback and reports on generated results.
- Usage records. Generation job history and status, and a credit ledger recording every reservation, charge and refund; your saved assets, collections, favourites and trash.
- Preferences. Your appearance and theme settings, stored in your browser and, when you are signed in, synced to your account.
- Abuse-prevention data. To rate-limit abuse we process your IP address and email transiently; the rate limiter stores only a truncated one-way hash of them, not the raw values.
- Page-view counts. Our host's aggregate analytics (Vercel Web Analytics) records which pages are visited, the referrer, and coarse device and country information derived from the request. It sets no cookie and does not identify you.
- Error reports. If something breaks in your browser, our error-monitoring provider (Sentry) receives a report with the error, your browser type and your IP address. Reports are masked before they leave your browser: no prompts, media URLs, tokens or personal content are included, and this masking is enforced by tests.
What we do not collect. No advertising pixels, no session recording, no cross-site tracking, no identifying analytics, and no marketing email. The only email you get from us is transactional: confirmation, password reset, two-step, and replies to messages you sent us.
Why we use it, and the legal basis
| Purpose | Data | Legal basis (UK GDPR) |
|---|---|---|
| Running your account and delivering generations | account, content, usage records | Contract (Article 6(1)(b)) |
| Taking payment and keeping the credit ledger | billing data, ledger | Contract; legal obligation for financial records (6(1)(c)) |
| Keeping the service safe: rate limits, safety filtering, abuse handling, error monitoring | abuse-prevention data, error reports, job records | Legitimate interests (6(1)(f)): protecting the service and other users |
| Answering your messages and reports | messages, feedback | Contract; legitimate interests |
| Complying with the law and responding to lawful requests | any of the above | Legal obligation |
We do not make decisions about you by automated means that have legal or similarly significant effects, and we do not profile you.
How your content is stored: please read this
Media you upload and generate, including images attached to inbox messages and files exported from the editor, is stored in storage buckets that are readable by anyone who has the exact URL. URLs are long and unguessable and directory listing is disabled, so content cannot be browsed or enumerated. But if you share a media URL, or share something that embeds one, anyone with that URL can open the file without signing in. Do not upload content you are not comfortable being reachable this way. If we move to private storage with signed links, this section will change and we will tell you.
Who processes your data, and where
| Provider | What they do | What they receive | Where |
|---|---|---|---|
| Supabase | Authentication, database, media storage | account data, content, media | London, United Kingdom |
| Vercel | Application hosting, some upload storage, aggregate page-view analytics | request logs including IP addresses, as any host does; character photographs; cookie-less page-view counts | United States |
| Stripe | Payments and the billing portal | what you enter on Stripe's own pages; your email | United States and EU |
| fal.ai | Runs most of the AI generation models | your prompts, generation settings and URLs of your input media; returns the output | United States |
| kie.ai | Runs a small number of video models fal.ai does not offer | the same categories as fal.ai, for the models routed through it | United States; its upstream model vendors include companies headquartered in China |
| Runway | Runs Runway's own video models | the same categories as fal.ai, for Runway models only | United States |
| Sentry | Error monitoring | masked error reports, browser type, IP address | United States |
Two honest notes about the generation providers. fal.ai's terms let it use usage data to improve its services and models, and it makes no promise that outputs are original. kie.ai has not published a data-processing agreement or a list of the vendors it passes prompts and media to; its published retention is about 14 days for media and about two months for logs. We route to kie.ai only for models our main provider does not have. Runway's standard terms include a licence to use inputs and outputs to improve its models; we will say here which terms cover our account once confirmed.
We never sell your personal data and we do not use your content to train AI models. We share data only with the processors above, to run the service; with your explicit consent; or where the law requires.
International transfers
Your account data, content and media are stored in the United Kingdom. Hosting logs, error reports and the AI providers that run your generations are in the United States. Where data leaves the UK we rely on the provider's standard contractual clauses recognised under UK law, or on the UK's adequacy regulations where they apply. kie.ai's onward transfers to its model vendors are not covered by a published agreement, which is why we limit what we send it and say so here.
How long we keep things
- Account, content, messages and usage data: for as long as your account exists.
- Abandoned uploads: upload sessions you start but do not finish are removed automatically, typically within 24 hours.
- Credit ledger and payment records: kept as financial records after deletion, with all content removed from them.
- After deletion: an anonymised, unlinkable record of the account remains so that the financial records still add up. It contains no personal data.
- Error reports: kept by Sentry for 90 days.
- Rate-limit hashes: short-lived operational data.
Your rights
- Export. Download every record we hold about you as one file from Settings.
- Delete. Delete your account from Settings. This cancels any subscription, deletes your content, media and messages, removes your personal data from every table, and leaves only the anonymised record and financial records described above. Deletion waits while a generation is still running, then completes.
- Correct. Change your email or password from Settings; write to us for anything else.
- Everything else. You can also ask us for any of the above, object to processing based on legitimate interests, or ask us to restrict processing, by writing to privacy@nixra.ai. We respond within one calendar month.
Complaints
If you think we have handled your personal data wrongly, tell us at privacy@nixra.ai or through any channel you can reach us on. We acknowledge every complaint within 30 days, look into it, keep you informed, and tell you the outcome and what we did. If you are not satisfied you can complain to the Information Commissioner's Office (ico.org.uk), or to your own supervisory authority if you are in the EU.
Age
The service is for people aged 18 or over. We do not knowingly collect data from anyone younger; if we learn we have, we delete it.
Cookies
The Cookie Policy lists the one cookie we set. It is short.
Changes
We post any material change to this policy before it takes effect, with its version and date, and email account holders about it.
NIXRA LTD · company number 17432459 · 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ · privacy@nixra.ai