Privacy Policy

1. About this policy

This Privacy Policy explains how Silent Partner Technology Co., Ltd. (“Opennan”, “we”, “us”) collects, uses, shares and protects personal information when you use opennan.com, the Opennan Studio and video editor, the AI chat assistant, our public API, MCP server and playgrounds, our tools such as voice cloning, live transcription and translation, video to captions and 3D, and our free tools such as song to MIDI and the Roblox clothing maker (together, the “Service”).

It works together with our Terms of Service, Acceptable Use Policy and Cookie Policy. Questions are welcome at [email protected].

2. Information we collect

2.1 Your account

When you sign up we collect your email address and display name and, if you sign in with Google, your profile photo. Sign-in is handled by Google Firebase Authentication, which holds your password and, if you turn it on, your authenticator-app two-factor setup. We never see your password.

2.2 Content you give us

Prompts, scripts, text and chat messages; images, video, audio and documents you upload; links you paste (for example a web page or a YouTube video) and the content we fetch from them; and the projects, characters, avatars, voices, memories and other assets you create. Files are stored in Cloudflare R2 and served from our content delivery network.

2.3 What the Service makes for you

The images, video, audio, music, 3D models, MIDI files, captions, transcripts, translations and text the Service generates, together with the prompt, model or tool and settings used to make them, and any ratings or feedback you give on results.

2.4 API and MCP use

When you use the public API or connect an AI agent through our MCP server, we also keep:

API keys: we show a key only once. We store a one-way hash of it, plus its name, its first and last few characters, when it was last used and when it expires.
Task records: for each request, the model or tool called, your prompt and settings, the input links you send (we download them so the request can be processed) or a one-way fingerprint or short summary of a file you upload, the result links and text results such as transcripts and caption lines, price, status and timestamps. The text in a task record is removed after 90 days (see section 7).
Results: finished outputs are copied to our content delivery network and the links are returned to you. Anyone who has a result link can open the file, so share links with care.
Webhooks and callbacks: the URLs you register, the signing secret we create for them, and a log of each delivery attempt, including what we sent and how your server responded.

2.5 AI chat assistant

When you use the AI assistant in a project, we store the conversation, the media you attach, and notes the assistant saves about the project. The assistant works in an isolated workspace on our servers for that project and sends your messages, project details and the relevant media to AI model providers so it can plan and carry out your request. An automated safety check screens messages for attempts to misuse the assistant, and we strip secrets such as keys and passwords from its replies.

2.6 Face and voice features

Some features work with a person's face or voice, which some laws treat as biometric information:

Face swap and face animation: to swap or animate a face, our processing reads facial features from the images or video you provide. We use them only to make the result you asked for and do not keep a separate face template after the job finishes. The files you uploaded and the results are kept as described in section 7.
Voice cloning in the Studio: the voice sample you upload is stored in your account and sent to a speech processing partner, which creates a voice model so text can be spoken in that voice. The partner holds that voice model for us until it is deleted. Voices cloned through the API or the voice tools on our website work differently: see section 2.7.

Use these features only with your own face or voice, or with the clear permission of the person, as our Terms and Acceptable Use Policy require. We do not sell biometric information or use it to identify people.

2.7 Voice, captions and 3D tools

These tools work through the API, the MCP server and the playgrounds on our website:

Clone your voice: you send a voice sample (15 to 60 seconds) and a recording of the speaker reading a consent sentence that contains two random code words. We transcribe both to check that the recording says the sentence and that the same person speaks in the sample and in the consent recording, and we send the sample to our speech processing partners, which create the voice model. We do not store either recording ourselves. We keep a consent record with the voice and, separately, a consent proof: your account and the API key used, the sentence, the transcript of the consent recording, how closely it matched, the result of the same-speaker check, the length of each recording, a one-way fingerprint (SHA-256) of each file and the time you agreed (the consent record also holds the voice name). Neither contains any audio, voice model or voiceprint. A cloned voice can be used only by the account that made it.
Speak or translate in your voice: the text you send, or the audio file you link to for translation, is sent to our speech and AI processing partners to transcribe, translate and speak it. The translated audio is stored on our content delivery network, and the transcript and translation are kept in the task record for 90 days.
Live transcribe and live translate: the audio you stream is passed to our speech and AI processing partners as it arrives. We do not record or store the audio, the transcripts, the translations or the spoken replies; they are sent back to you during the session. We keep the session's length, the time billed and the cost with your usage records.
Voice Translator: the audio you stream passes through our server to our speech recognition partner as it arrives; the text, and your voice sample if you choose your own voice, go to the private GPU you rented. We don't keep or look at what you say: we do not record, store or log the audio, the transcripts, the fixed or translated text, the spoken replies or the voice sample. The voice sample is kept only in memory during the session and deleted when it ends; the GPU is erased when the rental ends. Before your own voice is used, the recording is transcribed once to check that it reads the consent sentence, and we keep the same consent proof as for a cloned voice (no audio). We keep the rental's times, options and cost.
Video to captions: the video you upload or link to is kept on our server only while it is processed and is deleted when the run ends; files left behind by an interrupted run are deleted once they are about three hours old, by a check that runs every 30 minutes. Its sound is sent to our speech processing partners and, if you ask for a translation, the caption text to our AI processing partners. The caption files and the video with burned-in captions are kept as results on our content delivery network; the transcript and the caption lines are kept in the task record for 90 days, together with the link you sent or a one-way fingerprint of the file you uploaded.
3D, T-pose and Roblox 3D tools: the image and prompt you send are passed to our 3D and image processing partners. The T-pose image (your own picture, copied as it is, when it already was a T-pose), the 3D models, animation clips and thumbnails are stored on our content delivery network as results. The task record keeps the image link you sent; an image sent inline to the Roblox 3D tool is only summarized there, not stored.

2.8 Payments, balance and referrals

Payments: you add funds on Stripe's hosted checkout page. Stripe collects your card details; we receive your email, the amount, the payment status and Stripe's reference numbers, never your full card number.
Balance and usage: we keep your prepaid balance, every top-up, charge and refund, and a usage log of each paid request (what it was, the model, the price, the duration and whether it succeeded).
If you joined through a referral link: a cookie remembers the referral code for 30 days. When you sign up we record which referrer you came from, apply your referral discount to each paid request, and calculate the referrer's reward from what you spend. Referrers see totals and anonymized activity, never your name or email.
If you are a referrer or sell copies of your projects: we keep your referral code, country, earnings and withdrawals. Payouts go through Stripe Connect, and Stripe collects the identity and bank details it needs to pay you.

2.9 Sharing and the Explore gallery

If you publish a project, share a link to a project or a memory, or submit a project to the Explore gallery, the content you share and your display name can be seen by anyone with the link or by all visitors, depending on what you chose. For gallery submissions an AI model suggests a category and a short summary, and our team reviews the submission.

2.10 Support

Support tickets you open, including your messages and any screenshots you attach, and our replies.

2.11 Technical and log data

When you use the Service we receive your IP address, browser and device type, the pages and API endpoints you request, timestamps and error details. We keep a sign-in history (time, IP address, browser and whether you signed in with your account or an API key), which you can see in Settings. We use IP addresses to apply rate limits, including on our free tools.

2.12 Free tools you can use without an account

Song to MIDI: you can upload an audio or video file, paste a YouTube link or type a song name. We download and process the audio, on our own servers or a GPU server we rent, and delete the job and its files within about two hours.
Roblox clothing maker: we process your prompt or artwork and return the clothing images without saving them. To draw a design from a prompt, the prompt may be sent to an image processing partner.
Roblox avatar look-up: if you enter a Roblox username, we fetch that player's public avatar from Roblox and keep it in memory for about ten minutes.

3. Cookies and browser storage

We use a small number of cookies and browser storage that the Service needs: your language, a referral code from a referral link, the app sidebar layout, sign-in (stored by Firebase), your theme, drafts and preferences. We do not use advertising or analytics cookies; we count page visits with Cloudflare Web Analytics, which does not use cookies. Details are in our Cookie Policy.

4. How we use information

We use the information above to:

Run the Service: generate what you ask for, run the AI assistant, store and show your projects, and deliver API results and webhooks.
Handle billing: charge and refund your balance, apply referral discounts, calculate referral and project-copy earnings, pay out withdrawals, and keep accounting and tax records.
Keep the Service safe: apply rate limits, prevent fraud and abuse, check consent before a voice is cloned, enforce our Terms and Acceptable Use Policy, and investigate reports.
Answer support tickets and other requests.
Send service emails, such as a note when a video finishes, according to your notification settings.
Improve the Service: we review generation records, errors and the feedback you give (such as ratings and which results you keep) to improve our prompts, quality checks and reliability. When a failure teaches us a fix that we apply for everyone, we store only the rule, with links, email addresses and credentials removed.
Meet legal obligations and respond to lawful requests.

We do not sell your personal information, we do not use it for targeted advertising, and we do not train AI models of our own on your content.

We share personal information only as needed with:

AI, speech and 3D processing partners that run the generation, transcription, translation, voice, captions, 3D, chat and analysis you request. They receive the prompt, inputs and media that request needs, including the voice sample when you clone a voice.
Cloud GPU providers whose servers run some of our processing, such as face swap, lip sync, audio separation and song to MIDI.
Infrastructure providers: server hosting, Cloudflare (file storage, content delivery, network protection and cookie-free page-visit analytics), Google Firebase (sign-in) and an email delivery service for service emails.
Web-fetching services that retrieve pages and media from links you give us.
Stripe, for payments and referral payouts.
Roblox, which receives only the username you look up.
People you choose to share with: content you publish, share by link or submit to the gallery.
Your own systems: we send task results to the webhook and callback URLs you register.
Legal and safety reasons: when the law requires it, or to protect people, our rights and the Service, including reporting unlawful content to the authorities.
A buyer or successor if Opennan is involved in a merger, acquisition or sale of assets, subject to this policy.

6. Where we process data

Our main servers and database are in Singapore. Files are stored with Cloudflare and delivered through its global network, and AI model, GPU and other providers may process data in the United States and other countries. When personal information moves between countries, we rely on the safeguards the law requires, such as Standard Contractual Clauses where they apply.

7. How long we keep information

Account: while your account is open. When you delete your account, we deactivate it, replace your email, name and photo with placeholders, remove your sign-in, turn off your API keys and webhooks, and delete the voices you cloned through the API or our voice tools (see Voices below). 30 days later we delete its cloud data: all its projects, including those in the trash, with the files stored with them; the files uploaded to its projects, its media library or as temporary inputs; and the result files of its API and tool tasks. Until then, we can restore the account if you ask us.
Projects and files: until you delete them, with the limits below. A project you delete in the web app is deleted at once. A project deleted through the API first goes to the trash, where it can be restored for 7 days before it is deleted (it can also be deleted permanently sooner). Deleting a project deletes the files stored with it. A file in your account's media library, which several projects can share, is deleted once none of your projects has used it for 7 days. A temporary upload (an input for a paid tool, which can't be used in a project) is deleted once every task that used it has finished, and 24 hours after the upload at the latest. The result files of an API or tool task that is not linked to a project (including captions, translated audio and 3D models) are deleted 7 days after the task finished, unless one of your projects uses them; the API gives that date as the task's expires_at, and deleting the task removes them sooner (see below). Results of tasks created before this 7-day rule took effect, results of tasks linked to a project, and older uploads stay available at their links until you delete them (for a task's results, by deleting the task) or ask us to delete them.
API task records and webhook logs: kept with your account, with these limits. 90 days after a task is created we automatically remove the text it holds, such as transcripts, translations, caption lines, prompts and other text you sent; we keep what billing needs (the model or tool, price, status and timestamps) and the links to the result files. Webhook delivery logs older than 90 days keep only the event, the task id, its status and your server's response code. You can delete a finished task at any time with a DELETE request to /v1/tasks/ and the task id (or the delete_task tool of our MCP server): we delete its result files from our storage and content delivery network and remove its text at once, while its billing details stay. Copies our content delivery network has already cached can stay reachable at the same link for some time after deletion.
Chat: until you clear the chat or delete the project. The assistant's workspace for a project is deleted with the project.
Voices: a voice cloned through the API or our voice tools is kept until you delete it (on the voice tools page, or with a DELETE request to /v1/voices/ and the voice id) or delete your account. It stops working at once; the copies held by our speech partners are then deleted, retried automatically until they are gone, and the voice and its consent record are removed. We keep the consent proof described in section 2.7, which holds no audio, for three years after the voice is deleted, so we can answer a claim that a voice was cloned without consent, and then erase it. The charge for creating the voice stays in your billing history. A voice cloned in the Studio is kept until you delete it from your account, and deleting your account does not delete it; to also remove its sample file and the voice model held by the speech partner, email us.
Live sessions: the audio, transcripts and translations are not stored. Each session's length and charges are kept with billing records.
Video to captions: the input video is deleted when the run ends; after an interrupted run, it is deleted once it is about three hours old (we check every 30 minutes). Caption files and the captioned video are kept like other API results; the transcript and caption lines are removed from the task record after 90 days.
Billing, usage and referral records: as long as we need them for accounting, tax, refunds, disputes and fraud prevention, including after an account is deleted.
Sign-in history and server logs: sign-in history is kept with your account; server logs are kept for a limited time for security and troubleshooting.
Free tools: song to MIDI imports are deleted within about two hours; Roblox clothing designs are not saved; Roblox avatar look-ups are held in memory for about ten minutes.

8. Your choices and rights

You can:

See your data: your projects, files, usage, API logs, billing history and sign-in history are in the app and the console. Ask us for a copy of anything else.
Correct it: edit your display name in Settings, or ask us to fix anything else.
Delete it: delete projects, voices and other items at any time (a cloned voice on the voice tools page or with the API; an API or tool result with a DELETE request to /v1/tasks/ and the task id), or delete your account in Settings by typing DELETE. This deletes the voices you cloned through the API or our voice tools at once, and the account's projects, uploaded files and task results 30 days later (see section 7). To have anything else erased, such as older uploads or a voice cloned in the Studio, email us.
Control emails: turn email notifications on or off in Settings.
Withdraw consent for face or voice processing by deleting the related files and voices and letting us know.

Depending on where you live (for example in the EU or UK, California or Thailand), you may also have the right to object to or restrict processing, to receive your data in a portable format, and to complain to your data protection authority. We do not sell personal information or share it for cross-context behavioral advertising, and we will not treat you differently for using your rights.

Where the GDPR or similar laws apply, we rely on: performing our contract with you (running the Service and billing), our legitimate interests (security, abuse prevention and improving the Service), your consent (face and voice features, where the law requires it) and our legal obligations (such as tax and accounting).

If you live in Illinois or another place with biometric privacy laws: we do not sell, lease, trade or otherwise profit from biometric information, and you can ask us at any time to delete it.

To make a request, email [email protected] from the email address on your account. We may need to confirm your identity, and we will respond within the time the law requires.

9. Security

We use HTTPS for all traffic, store API keys only as one-way hashes, sign webhook deliveries, run the AI assistant in an isolated, locked-down workspace, let a cloned voice be used only by the account that made it, and limit staff access to what support, safety and operations need. Files are kept with a storage provider that encrypts them at rest.

No system is perfectly secure. Keep your password, API keys and result links private, and tell us at [email protected] if you think something is wrong.

10. Children

The Service is for people 18 and older. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

11. Changes to this policy

We will post any changes here and update the date at the top. If a change is significant, we will tell you by email or in the app before it takes effect.

12. Contact

Silent Partner Technology Co., Ltd. For privacy questions or to use your rights, email [email protected]. To report misuse of your likeness or copyright, see our DMCA & Takedown Policy.