What we collect
Account data from Google sign-in (name, email, avatar). Your content — prompts, uploads, generated media, projects, and chats — stored so the product works. What you tell us at sign-up — optionally, what you mainly make, your experience with AI video and who the work is for; you can change or clear these in Settings. Usage & billing data — credit balance, generation history and costs, and purchase records (payments are processed by Stripe; we never see your card number).
How we use it
To run Nolan: generate the content you ask for, keep your workspace, meter credits, prevent abuse, and provide support. Prompts and reference media are sent to the third-party AI models that perform the generation (via Kie.ai) solely to produce your output. We do not sell your data and we do not use your content to train models.
Email we send you
About your account: a welcome message when the account is created, and anything we need to tell you about sign-in, security or billing. These are part of the service. Tips and reminders, only if you ask for them: an occasional email when something in your account is unfinished — a project not yet started, a generation waiting for your approval — and tips for using Nolan. These are off unless you turn them on, in the welcome or in Settings → Notifications; we keep a record of when you did. To decide whether one is relevant we look at records of your activity (for example, whether a project has a script yet, and when you were last here); the content of your projects is never put in an email. We record that an email was sent, whether it was delivered and whether its link was opened. You can stop them at any time from the link in any such email or in Settings; account and billing email is not affected.
Cookies and measurement
Always: the cookie that keeps you signed in and, if you arrive through a referral link, a 30-day referral cookie. Only if you allow measurement in the consent banner: Google Analytics, and a first-party cookie that remembers which campaign or site first brought you to Nolan, for 90 days. Only if you allow marketing: advertising measurement — the Meta Pixel and Google's advertising features — so we can tell which of our ads lead to an account, a first generation or a purchase, and the click identifier an ad platform adds to a link. You can change your choice at any time: .
If you allow marketing, we also tell Meta from our servers when a few things happen in your account — it was created, its first image or video was generated, a checkout was started, a purchase was made (with its amount) — together with a hashed (SHA-256) copy of your email address, so that Meta can match the event to an ad without us sending the address itself. Google receives the same kind of events through Google Analytics, and a hashed email address only if you allowed your data to be used for advertising. If you allow measurement, a few of those events (a first generation, a purchase) are sent to Google Analytics from our servers when they happen, together with the identifier Google Analytics gave your browser, so they can be counted against the visit that brought you; we keep that identifier only while you allow measurement. What you make with Nolan — your prompts, scripts, characters and media — is never sent to an advertising or analytics provider. If you do not allow marketing, none of this happens.
Without any cookie, we count page views on our public pages in aggregate (page, referring site, campaign labels) with no identifier attached. When you create an account we store, in our own database, the source that brought you (for example a campaign name or a referring site — never a full address you came from), so we can tell which of our efforts reach people.
Storage & security
Nolan runs on infrastructure provided by Railway. Our database and the media files you upload or generate are stored on Railway servers that are currently located in the United States. If you use Nolan from another country, your data is transferred to and stored in the United States. Media files are private — they are served only to the signed-in account that owns them; Nolan staff can access stored content when that is needed for moderation or support. Data in transit is encrypted (TLS).
Other providers process data for specific purposes, each in its own locations and under its own terms: Google (sign-in), Stripe (payments), Kie.ai and the AI model providers behind it (generating your images and video, and Nolan's replies, from what you send), Resend (email we send you), iubenda (recording your cookie choice), — only if you allow measurement — Google Analytics, and — only if you allow marketing — Meta and Google's advertising services (measuring our advertising, as described above).
Retention & deletion
We keep your data while your account is active. Email hello@trynolan.io to delete your account — content and personal data are removed within 30 days, except minimal billing records we must keep for tax/accounting law.
Your rights
Depending on your location (e.g. GDPR), you may have rights to access, correct, export, or erase your data, and to object to processing. Contact us and we'll honour them.