Privacy Policy

UniverseAI Studio ("we", "us", or "our") operates the website nonax.site (the "Service"). This page explains how we collect, use, disclose, and safeguard your information when you use the Service.

By using the Service, you agree to the collection and use of information in accordance with this policy.

When you sign up using Google OAuth, we receive:

• Your Google account email address
• Your name as registered on your Google account
• Your Google profile picture URL
• A unique Google account identifier

We do not access your Gmail, Google Drive, contacts, or any other Google service data.

When you use the video generation feature, you upload images and videos. These are temporarily stored in our cloud storage (Cloudflare R2) and automatically deleted after the generation task completes or expires.

Bring-Your-Own-Key (BYOK) users provide their own third-party API keys (e.g., Freepik). These keys are encrypted at rest in our database and used only to forward your generation requests to the respective AI provider on your behalf.

We automatically collect:

• Generation history (prompts, model selection, timestamps)
• Account balance transactions (for Pay-As-You-Go users)
• Login activity logs
• Browser type and basic device information for security purposes

Pay-As-You-Go top-ups are processed by third-party payment providers (Lynk.id). We do not store credit card numbers or full payment credentials. We receive only confirmation that a payment was successful and the corresponding amount.

• To create and maintain your account
• To process your video generation requests
• To deduct credit balance for Pay-As-You-Go usage
• To send notifications related to generation status
• To prevent fraud, abuse, and unauthorized access
• To improve and debug the Service

We share data with the following categories of third parties strictly to operate the Service:

• AI Providers (Freepik, Magnific, Geminigen, etc.): We forward your prompts, uploaded media, and generation parameters to these providers to fulfill your generation request.
• Cloud Infrastructure (Vercel, Cloudflare R2, Neon Database): For hosting, storage, and database services.
• Payment Provider (Lynk.id): For processing top-up payments.

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

• Account data: Retained for as long as your account is active.
• Generated videos: Available for 30 minutes after completion, then automatically deleted.
• Source files (images/videos you uploaded): Deleted immediately after the generation task completes or fails.
• Generation history metadata: Retained for analytics and account history.
• Balance transactions: Retained for accounting and dispute resolution purposes.

We implement industry-standard security measures including:

• HTTPS/TLS encryption for all data in transit
• AES encryption for sensitive data at rest (e.g., third-party API keys)
• Session-based authentication with JWT tokens
• Daily automated database backups
• Restricted database access via private connection strings

While we strive to protect your information, no method of transmission or storage over the internet is 100% secure. You acknowledge that you provide your data at your own risk.

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Withdraw consent and stop using the Service at any time
• Export a copy of your generation history

To exercise these rights, contact us at the support channels listed in your account settings.

We use a session cookie to keep you logged in. We do not use third-party advertising or analytics cookies. The session cookie is HTTP-only, secure, and automatically expires.

The Service is not intended for users under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided personal data, please contact us immediately so we can delete it.

The Service relies on third-party AI providers and infrastructure services. Each provider has its own privacy policy. We recommend reviewing the policies of:

• Google (for OAuth login)
• Freepik (for video generation)
• Cloudflare (for storage and CDN)
• Vercel (for hosting)

Your data may be processed and stored in servers located outside Indonesia, including the United States and the European Union, where our infrastructure providers operate. By using the Service, you consent to this transfer.

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the updated policy on this page with a new "Last updated" date. Continued use of the Service after changes means you accept the updated policy.

If you have questions or concerns about this Privacy Policy or our data practices, please contact us via the support channel available in your account dashboard or through the contact information published on nonax.site.