Privacy Policy & User Data Disclosure
This Privacy Policy governs the collection, handling, storage, and sharing of information across the official web platform (https://autorender-ai-6txy.vercel.app) and the official Chrome Extension: “AutoRender AI - Bulk AI Image Generator for Google Flow (Nano Banana 2/Pro)” (Extension ID: eokaibkcnbodecalhhmchhegamikekke).
Four Pillars of User Data Privacy (Google Policy Adherence)
In strict adherence to Google Chrome Web Store User Data Guidelines, this policy covers all mandatory pillars without omission:
Only necessary account credentials, local project preferences, and technical browser permissions required for automation are utilized.
Prompts and image references are handled locally in your browser memory and DOM. We never inspect or process creative assets on our servers.
Queues remain in local client IndexedDB. Account and license verification records are encrypted at rest with SOC 2 compliant infrastructure.
Zero data sale. We never sell, rent, or transfer user data to third parties, data brokers, advertising networks, or for AI model training.
User Data Collection
AutoRender AI adheres to strict data minimization principles. We collect only the information strictly necessary to provide authentication, license management, and companion automation services for Google Flow creators:
A. Account & Authentication Data (Web & Extension)
When you sign in through Google OAuth, GitHub OAuth, or an email magic link, we receive your account name, verified email address, avatar URL, and OAuth provider identifier. This enables persistent authentication across our web portal and Chrome Extension.
B. Licensing, Subscription & Device Metadata
To prevent unauthorized software piracy and manage daily tier quotas, our backend records your subscription plan (e.g., Free, Starter PRO, Standard PRO, Ultimate PRO), daily generation count counters, license activation timestamps, and an anonymized device lock hash (deviceLockId).
C. Payment & Transaction Verification Records
When purchasing a subscription, we collect payment verification references provided by our authorized payment gateways:
- Chapa (telebirr, CBEBirr, Local Cards): Transaction reference (
tx_ref), settlement amount in ETB, and payer email for instant webhook fulfillment. We do not store sensitive payment card numbers, CVVs, or PINs. - PayPal: PayPal Order ID and capture timestamp.
- Binance Pay: Order ID or Transaction Hash along with verification screenshots when manual confirmation is requested.
D. Extension Local Generation Data (Local-First)
The extension processes your batch prompts, style configurations, aspect ratios, model selections (Nano Banana 2.1 / Pro / FlowPass), and uploaded reference images (Subject, Scene, Style). This data is stored solely in your local browser storage (IndexedDB and chrome.storage.local) and is NEVER transmitted to AutoRender AI external servers.
E. Chrome Browser Permissions Collected & Technical Justification
The Chrome Extension requests specific browser permissions under Manifest V3 to execute its single purpose: automating batch image rendering inside Google Flow. Each permission has an explicit operational justification:
Stores prompt queues, execution delay settings, and project records locally on your device without premature browser quota pruning.
Detects open Google Flow workspaces (flow.google.com) and safely injects DOM companion scripts to automate text prompt typing.
Renders the AutoRender companion control center seamlessly docked alongside your Google Flow workspace.
Automatically downloads generated high-resolution assets into designated project directories with sequential numbering (1.png, 2.png).
Used strictly on-demand to clear stale Google Flow cache and service workers when resetting sessions to prevent memory leaks and UI freezing.
Dispatches simulated hardware-level mouse events via Chrome DevTools Protocol (CDP) to reliably click Google Flow render controls when standard synthetic clicks are intercepted by complex web canvas components.
Coordinates background batch timer intervals and keeps automation tasks reliably scheduled without consuming unnecessary CPU or battery power.
Scoped strictly to Google Flow endpoints (flow.google.com/*) and its authentication/content CDNs (*.google.com/*, *.gstatic.com/*, flow-content.google/*) plus our API (autorender-ai-6txy.vercel.app/*) and checkout endpoints.
User Data Handling & Processing
AutoRender AI handles and processes user data strictly to deliver its core, single-purpose functionality: automated batch generation and asset management for Google Flow creators. We handle data in accordance with the following rules:
A. Local-First Processing Architecture
Creative text prompts, negative prompts, seed numbers, and reference imagery are handled strictly in-memory within your active browser tab. The extension simulates keystrokes and dispatches inputs directly into the Google Flow DOM on your machine. At no point are your creative assets streamed, copied, or processed through external AutoRender AI servers.
B. Account Authentication & Entitlement Verification
When you launch the extension, your session token is verified against our backend (https://autorender-ai-6txy.vercel.app/api/extension/auth) over an encrypted HTTPS connection to confirm your active subscription tier and daily generation quota balance.
C. Diagnostic Logging & Operational Health
Automation execution logs (e.g., prompt index counters, retry queue counts, elapsed processing seconds) are displayed in the extension's “Logs” tab and stored in local volatile memory. Users can inspect or clear these diagnostic logs at any time with a single click.
D. Single Purpose Requirement Fulfillment
Every data handling process is directly connected to the single purpose of facilitating batch image rendering on Google Flow. We do not engage in background browsing analysis, cross-site behavioral profiling, or irrelevant data harvesting.
User Data Storage, Security & Retention
We implement comprehensive technical, physical, and architectural safeguards to protect your data across all storage locations:
A. Client-Side Storage (Browser Sandbox)
Prompt queues, image reference buffers, and project download folders are stored locally in your browser using chrome.storage.local and browser IndexedDB. This data resides exclusively on your local hard drive within Chrome's sandboxed profile. You have complete control: clearing extension history or uninstalling the extension permanently wipes all locally stored records.
B. Server-Side Storage & Infrastructure Security
Account profiles, tier subscriptions, and payment references are stored in Neon PostgreSQL serverless cloud databases located in secure data centers with SOC 2 Type II certification. All database connections enforce TLS 1.3 encryption with strict connection pooling (sslmode=require).
C. Cryptographic Protections
License invoices and transaction receipts are cryptographically signed using HMAC-SHA256 digests (AR-INV-...), preventing tampering, unauthorized modification, or invoice forgery.
D. Data Retention & Deletion Schedule
Account credentials and subscription metadata are retained for as long as your account remains active. Financial transaction reference codes are retained as required by tax and accounting regulations. You may request immediate and permanent deletion of your account and all associated data at any time; upon receipt, all records are permanently purged within 14 calendar days.
Your Privacy Rights (GDPR, CCPA & Global Frameworks)
Regardless of your jurisdiction, you have full ownership and authority over your personal information:
Right to Access & Data Portability
Request a complete machine-readable copy of your profile data, subscription tier status, and transaction history at any time.
Right to Rectification
Request correction of any inaccurate account details, billing contact addresses, or license allocations.
Right to Erasure (“Right to be Forgotten”)
Request permanent deletion of your account, authentication tokens, and server records. Deletion is executed within 14 calendar days.
Right to Withdraw Consent
Revoke consent at any time by uninstalling the Chrome Extension and disconnecting your account in the web dashboard.
Contact Information & Data Protection Officer
For inquiries regarding this Privacy Policy, your privacy rights, Chrome Web Store compliance, or to request data deletion, please contact our Data Protection Team: