Privacy & GDPR Policy

Rhino Banana is operated by RhinoBanana ApS. Rhino Banana is a product name and not a separate legal entity.

Contact (including GDPR requests): app@rhinobanana.com

Rhino Banana processes the following categories of personal data:

Personal data is processed under the following legal bases:

• Contract necessity (Art. 6(1)(b)) to provide access to the service, fulfill render/upscale requests, and manage user accounts.
• Consent (Art. 6(1)(a)) to store saved prompts (so they are available across devices).
• Consent (Art. 6(1)(a)) to send newsletter communication when you have explicitly subscribed.
• Legitimate interest (Art. 6(1)(f)) for service operation, security, delivery reliability, referral reward integrity, and fraud prevention.
• Legitimate interest (Art. 6(1)(f)) to enforce one starter-credit allocation per account history and prevent reuse of redeemed credit codes.
• Legal obligation (Art. 6(1)(c)) where accounting and transaction records must be retained under applicable law.

You can withdraw newsletter consent at any time from the Account section. Rhino Banana stores the current preference and the time it was last changed to determine whether newsletter communication is permitted.

If you join the testing pool for the next version of Rhino Banana, Rhino Banana records your account identity, participation status, feedback-contact consent version and dates, and testing credits granted. This is separate from newsletter consent. You can leave from the testing page at any time to stop testing feedback requests. Surveys and calls are optional. Your current and former participation records remain with your account until account deletion; enrollment and testing credit-event records are then deleted.

Rhino Banana currently uses:

• Google Gemini API for image generation.
• OpenAI Image 2 / OpenAI API image models for image generation and editing.
• Claid API for image upscaling.

• Rhino Banana sends prompts/images/metadata required to complete your request to the selected provider.
• Rhino Banana does not use your prompts or outputs to train its own models.
• Rhino Banana stores generated/upscaled images only temporarily in secure cloud storage so downloads are reliable.
• Download links are short-lived, and temporary image files are deleted automatically after a short period.
• OpenAI API image endpoints, including the GPT Image model family, are documented by OpenAI as not used for training and as having no application-state retention for image generations or edits, but OpenAI may retain abuse-monitoring logs by default for up to 30 days and may retain image/file inputs for manual review in rare safety cases, such as suspected CSAM.
• Other third-party providers may retain and process request data under their own legal terms and privacy policies.

Provider terms: https://ai.google.dev/gemini-api/terms, https://openai.com/policies/services-agreement/, https://openai.com/policies/data-processing-addendum/, https://claid.ai/terms, and https://claid.ai/privacy-policy/.

Where AI processing involves transfers outside the EU/EEA, Rhino Banana relies on available contractual safeguards (for example, EU Standard Contractual Clauses) where applicable.

Personal data is hosted using Google Cloud / Firebase infrastructure and stored within the EU (European region).

Temporary image files are stored in a separate private area with restricted access and delivered through secure download links. They are not public.

Third-party processing providers (including Google, OpenAI, and Claid) may process data outside the EU/EEA. Where applicable, transfers rely on safeguards in accordance with GDPR Chapter V.

For optional referral phone verification, Google states that phone numbers are sent to and stored by Google to improve spam and abuse prevention across Google services. Rhino Banana removes the number from its Firebase Auth user record after reward processing, but this does not delete data that Google independently retains under its service terms and policies. See Firebase phone authentication documentation and Firebase privacy and security information.

• Account data is retained for as long as the user maintains an active account.
• Saved prompts are retained until you delete them or delete your account.
• Generated/upscaled image files are retained only temporarily to support reliable download delivery and are deleted automatically after a short period.
• Request records and related technical metadata are kept only for a limited time for operations, billing integrity, and support (currently about 48 hours by default).
• When an account-deletion request is accepted, the active profile is removed and a retryable process disables authentication and revokes sessions. After that lock succeeds, final cleanup waits about 65 minutes so previously issued one-hour tokens and in-flight requests can expire, then removes saved prompts and presets, verification/reset records, stored prompt and community images, image-request records, diagnostics linked to the account, community activity, and the Firebase Authentication account. Due jobs are retried automatically, and deletion is normally completed within 48 hours.
• After completion, the deletion job no longer contains your email or a user-ID field. Its remaining operational status record temporarily uses your former Firebase user ID as its document key and is scheduled for automatic deletion after about 24 hours.
• A keyed HMAC fingerprint of your normalized email—not the readable email—remains with your remaining credit balance, redeemed credit codes, and whether a one-time testing welcome grant has already been received. This is used only to restore the balance and prevent another starter-credit allocation or credit-code reuse or a second testing welcome grant if the same email signs up again. It is retained while this one-time credit and restoration programme operates, reviewed at least annually, and deleted when no longer necessary for those purposes.
• During account deletion, Rhino Banana deletes your active Stripe customer profile and saved payment-method linkage. Direct account fields such as email, company name, CVR number, and billing address are also removed from Rhino Banana’s retained checkout record; transaction, invoice, refund, and accounting records may remain where legally required.
• Accounting and transaction records that must be retained under Danish bookkeeping rules are kept for at least five years from the end of the relevant financial year, and longer only where continued retention is necessary for another applicable legal obligation or legal claim.
• Referral claim and credit records are retained for accounting and reward integrity. The keyed pseudonymous phone fingerprint is retained while the referral program operates and, after the program ends, plus 12 months before deletion.
• The raw referral phone number is removed from Rhino Banana’s Firebase Auth user record after reward processing or an interrupted verification flow. Cleanup is scheduled before SMS verification and retried automatically while a reward is pending.
• The essential first-touch referral cookie and same-origin recovery storage expire after 30 days, unless used or cleared earlier.

Data is retained only as long as necessary to provide the service or comply with legal obligations.

Rhino Banana uses the following third parties:

• Stripe — payment processing and invoicing (independent data controller)
• Google — hosting (Firebase / Google Cloud), optional referral SMS and phone verification (Firebase Authentication / Google Cloud Identity Platform), and AI processing (Gemini API)
• OpenAI — AI image generation and editing API processing
• Claid (Let's Enhance, Inc.) — image upscaling API processing

No personal data is sold or shared for advertising purposes.

Rhino Banana does not use automated decision-making or profiling that produces legal or similarly significant effects on users (GDPR Art. 22).

Under the GDPR, you have the right to:

• Access your personal data.
• Rectify inaccurate data.
• Request deletion of your data.
• Restrict or object to processing.
• Request data portability.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement. In Denmark, this authority is Datatilsynet.

Requests can be sent to: app@rhinobanana.com

Rhino Banana does not use advertising cookies or third-party tracking technologies. Only essential technical storage required for authentication and service operation may be used. If you open a referral link, Rhino Banana stores first-touch referral attribution in an essential same-origin cookie, with local storage as a recovery fallback, for up to 30 days so the invitation can survive a later return to the normal website address.