Privacy Policy
Effective November 4, 2026. This page says what we collect, why, who sees it and how long we keep it. The retention schedule has the exact timings. It also serves as our Washington consumer health data privacy policy, because face imagery counts as biometric data under the Washington My Health My Data Act.
What we collect
| Data | Why |
|---|---|
| Email, sign-in codes, account settings | Your account, receipts, security |
| Your chats with the agent, plans and jobs | Making what you asked for, showing your history, support |
| Uploads (photos, faces, clips) and outputs | The swap or video itself, safety checks, your library |
| Face analysis results: boxes, estimated age ranges, celebrity matches, nudity flags | The hard lines in the Acceptable Use Policy. We never store face templates or embeddings. |
| Payment status from Stripe (never your card number) | Plans, credits, refunds, tax |
| Device, browser, IP address, usage events | Security, rate limits, product analytics (PostHog), affiliate attribution (Tolt) |
Faces and biometric data: your consent
Before your first upload we ask, once, for your consent to process the faces, people and scenes in what you upload, and to share those uploads with the providers that run the models and the safety checks for that job. Nothing is analyzed before you agree. You can withdraw by deleting your uploads or your account. Face data from a job is deleted once the job has settled; saved characters stay until you delete them.
Who sees your data
Only the providers needed to do the job, each for that job: model providers (Runware, OpenAI), the chat agent (Anthropic), safety and media readers (Google Gemini, OpenAI Whisper for captions), hosting (Vercel, Supabase, Cloudflare), payments (Stripe), email (Resend), analytics (PostHog) and affiliates (Tolt). We do not sell your data and we do not use it to train models. We share hashes of removed intimate imagery with StopNCII.org and NCMEC so it stays down elsewhere, and we report child sexual abuse material to NCMEC as the law requires.
Your rights
Export or delete your data from Settings at any time. If you are in the EU, UK, California or another place with privacy rights you can also ask us to access, correct or restrict, and complain to your authority. Email hello@gasolina.ai; we answer within 30 days. Our EU representative, once appointed, will be named here.
Cookies
One session cookie keeps you signed in, one remembers an affiliate link for 30 days, and analytics cookies measure the product. We do not run ad trackers.
Security and children
Data is encrypted in transit and at rest; access is limited to the people and services that need it. Gasolina is for adults; we do not knowingly collect data from anyone under 18.