Privacy Policy

Last updated: September 19, 2026 · Effective: September 19, 2026

This Privacy Policy describes how OLANA AI ("we", "us", "our") collects, uses, and protects your personal information when you use olana-ai.com (the "Service"). We are the data controller for personal data processed through the Service.

1. Who we are

OLANA AI is an AI-powered video and voice generation platform. You can contact us at privacy@olana-ai.com for any privacy-related request.

2. Information we collect

Account information. When you create an account we collect your email address and a hashed password. We never store plaintext passwords.

Authentication data. We use short-lived JWT access tokens and rotating refresh tokens to keep you signed in. Tokens are stored as secure HTTP-only cookies.

Photos and likeness. If you use Adult Photo Avatar mode (18+), you upload three photos: front, left profile, right profile. These photos constitute biometric data under GDPR Article 9 and similar laws. We process them only with your explicit consent.

Voice and audio. If you upload audio for lip-sync video, we process that audio to generate a talking-head video. We do not clone your voice unless you separately consent.

Generated content. Scripts, prompts, generated videos, and generated avatars.

Payment data. We do not store credit card numbers. Payments are processed by Stripe, Inc. We receive only a customer identifier and the amount paid.

Usage data. IP address, browser type, operating system, pages viewed, actions taken, and timestamps. We use this for security, fraud prevention, and service improvement.

Consent records. When you accept a consent, we store the version, the timestamp, your IP, and a hash of your typed signature.

3. How we use your information

Provide, operate, and improve the Service
Generate AI avatars, voices, and videos that you request
Authenticate you and keep your account secure
Process payments and issue credits
Detect fraud, abuse, and unauthorized access
Comply with legal obligations
Send service and transactional emails (verification codes, receipts)

4. Legal bases for processing (GDPR)

Contract — to provide the Service you requested
Explicit consent — for biometric data (photos, voice) and marketing
Legitimate interests — security, fraud prevention, service improvement
Legal obligation — tax, accounting, and regulatory requirements

5. Biometric data — special notice

Your photos and voice are biometric data. We treat them as a special category. We process them only:

With your explicit consent, recorded and versioned
To generate the avatar or video you requested
For the retention period you agreed to
Never for model training without a separate opt-in

You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

6. AI-generated content

All avatars and videos you generate are AI-generated. They are watermarked and carry C2PA provenance metadata. We disclose that content is synthetic. You must not use the Service to impersonate any real person without their consent, to create deceptive content, or for fraud or harassment.

7. Sharing your information

We share data only with processors who help us run the Service:

Stripe — payments
xAI — chat completions
D-ID — avatar video generation
Google Cloud — translation
AWS — hosting
Gmail SMTP — transactional email

We never sell your personal information.

8. International transfers

Some processors are located outside your country. Where required, we rely on Standard Contractual Clauses or an equivalent transfer mechanism.

9. Retention

We keep personal data only as long as needed:

Account data — until you delete your account plus a short legal retention window
Original photos — until you delete them or your account
Biometric templates — until you revoke consent
Generated media — until you delete it or your account
Payment records — as required by tax law
Audit logs — typically 12 months

10. Your rights

Depending on where you live, you have the right to:

Access your personal data
Correct inaccurate data
Delete your data ("right to be forgotten")
Restrict or object to processing
Port your data to another service
Withdraw consent at any time
Lodge a complaint with your local data protection authority

To exercise these rights, email privacy@olana-ai.com or use the delete-account button in your dashboard.

11. Account deletion

You may delete your account at any time from your dashboard. Deletion is immediate and irreversible. When you delete your account we:

Delete your account and login credentials
Delete all original photos and biometric templates
Delete all generated avatars and videos stored on our systems
Delete all consent records except those we must keep for legal defense
Keep payment records where tax law requires
Issue a deletion certificate to your email

12. Security

We use TLS 1.3 in transit, AES-256-GCM at rest, HTTP-only secure cookies, JWT rotation, rate limiting, fraud detection, and audit logging. No system is perfectly secure; report issues to security@olana-ai.com.

13. Children

The Service is not intended for anyone under 13. Users under 18 may not upload photos or clone voices. If we learn a minor has provided biometric data, we will delete it immediately.

14. Changes to this policy

We may update this policy. Material changes will be announced in the dashboard or by email. Continued use after the effective date means you accept the change.

15. Contact

Privacy questions: privacy@olana-ai.com
Security issues: security@olana-ai.com