Draft
This document needs legal review before launch.
Privacy notice
Last updated:
This notice explains what personal data GoBanana collects, why, how long we keep it, who processes it for us, and the rights you have. We wrote it with the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations in mind.
Controller: [legal entity name, commercial registration number, address in Saudi Arabia]. Contact: privacy@example.com.
Data we collect
- Account data: your email address and your WorkOS user id, created when you sign in.
- Canvas content: canvas titles, briefs, notes, layout, palettes, and the links and titles of references you save.
- Your uploads: images you choose to upload to your own canvases (Pro plans).
- Usage counts: the number of searches and canvases per month, used for plan limits.
- Billing data: your plan and your Paddle customer id. Paddle collects your payment details; we never see your card number.
- Share links: a random token for each canvas you share.
- Takedown requests: the name, email and details you send in the takedown form.
- Technical data: IP address and request details that our hosting provider processes to deliver the service and block abuse.
Reference images are not stored
GoBanana does not download, store or host images found on other sites. We store only links and basic details such as the title, size and source site. The image loads in your browser straight from the source site, so that site may see your IP address and browser details under its own privacy policy.
To pick colors, GoBanana may read a small preview image in memory for a moment and then drop it. It is never saved.
Why we use your data and our lawful basis
- To run your account, save your canvases and provide the features you ask for. Basis: performing our agreement with you.
- To apply plan limits and process payments through Paddle. Basis: performing our agreement with you.
- To keep the service secure and prevent abuse. Basis: our legitimate interest in a safe service, which does not override your rights.
- To handle takedown requests and meet legal duties. Basis: legal obligation and legitimate interest.
- We do not sell personal data, do not use it for advertising, and do not use it to train AI models.
Your AI agent
GoBanana makes no AI calls. When you use GoBanana from Claude, ChatGPT, Cursor or another agent, that agent receives the results of each tool call. The agent's own privacy policy applies to what it receives.
How long we keep data
- Account data, canvases, uploads and usage counts: while your account is open. When you delete your account, we delete these records and your uploaded files.
- References found by search but not placed on a canvas: deleted automatically after 30 days.
- Database backups: overwritten within [30] days of deletion.
- Takedown requests: kept while the block is in place and for up to [3] years after, to show how we handled the request.
- Billing records: Paddle keeps them as required by tax law, under Paddle's own privacy notice.
Who processes data for us
We use these providers. Each one processes data only to provide its service to us, under a data processing agreement.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Cloudflare | Hosting, network, storage of your uploads | Request data, uploads, all data in transit | Global network, including outside Saudi Arabia |
| Neon | Database | Account data, canvases, references, usage | [Region to confirm], outside Saudi Arabia |
| WorkOS | Sign in | Email, WorkOS user id, sign-in events | United States |
| Paddle | Payments, tax and invoices | Name, email, billing address, payment details, Paddle customer id | United Kingdom and United States |
| Serper | Web image search | Search terms made from your brief, with no account details | United States |
Transfers outside Saudi Arabia
The providers above process data outside the Kingdom. We transfer only the data each one needs, and we rely on the conditions in the Regulation on Personal Data Transfer outside the Kingdom, such as appropriate safeguards and standard contractual clauses. [Legal review: confirm the transfer basis for each provider.]
Your rights
- Know how your data is used (this notice).
- Access your data and get a copy in a readable format.
- Correct data that is wrong or incomplete.
- Delete your data. You can delete your account at any time from the account page.
- Withdraw consent where we rely on it.
- Complain to the Saudi Data and AI Authority (SDAIA).
To use a right, email privacy@example.com. We reply within 30 days. We may ask you to confirm your identity first.
Takedown requests
If a reference links to your work and you want it removed from GoBanana, use the takedown form. We review each request, usually within 5 working days. If approved, we block the link or the whole domain, so it no longer shows in search results or on any canvas, including shared ones. The image itself stays on the site that hosts it.
Security
Data travels over HTTPS. Access to the database and storage is limited to the service. We never log sign-in tokens, API keys or image bytes. If a breach puts your data at risk, we will tell you and the authority as the law requires.
Cookies
We use only the cookies needed to keep you signed in and to complete checkout. We do not use advertising cookies.
Children
GoBanana is not meant for people under 18, and we do not knowingly collect their data.
Changes to this notice
If we make an important change, we will update the date above and tell signed-in users before it takes effect.
Contact
Questions or requests about your data: privacy@example.com.