Privacy policy
Who operates Pipa
Finnmart, Finland, operates Pipa Cartoons and is responsible for the personal data described here. Contact us about privacy or support at savolainen.alexey@gmail.com. Updated: 12 October 2026.
Account and Google sign-in
Messages submitted through the feedback form, including your name (if provided) and email, are stored and sent to the operator to respond to your enquiry. The operator receives an email notification about new registrations and successful payments, containing the account email and, for payments, the amount and credited balance. We store your email, verification status, a password hash if you use a password, and sign-in sessions. For optional Google sign-in we request your Google account identifier and verified email, to identify your account and sign you in. We do not request Gmail messages, contacts or Google Drive files. Google access tokens are used during sign-in and are not stored for ongoing access.
Your creative work
We store projects, stories, character cards, uploaded images and audio, generated images, speech and video, selected versions and generation history. We also record generation status, duration, provider usage and costs to operate the service and measure production costs. Materials you submit may contain personal data; only upload materials you have the right to use.
Why we process data
We process account and project data to provide the service you request, including saving projects, generating cartoons and recovering access. We process limited technical information to prevent abuse, troubleshoot failures and protect accounts. The corresponding legal bases are performance of the service contract and our legitimate interest in operating a secure service. Where legally required, records are retained to meet legal obligations.
Service providers
Render hosts the application and database. Google provides optional sign-in and Gmail SMTP sends account verification and recovery emails. When you request generation, the relevant text, character references, images or audio are sent to the selected generation service. Only the materials needed for that request are sent; Google sign-in identifiers are not included in generation requests. Providers may process data outside the EEA. International transfers require an applicable lawful transfer mechanism; provider terms and arrangements govern their processing. We do not sell your Google account data or use it for advertising.
Payments and credits
Stripe processes payments on its hosted checkout page. Pipa stores payment identifiers, payment status, amount, currency and credit balance entries to provide purchased credits and keep payment records. Pipa does not store full card numbers or security codes. Stripe also processes the payment information you enter on its checkout page.
Cookies and security
Essential cookies maintain your login and protect the Google sign-in flow. Your browser also remembers interface preferences. Passwords are stored as hashes, not readable passwords; recovery and confirmation links expire. Keep these links private. Project access is restricted to the signed-in owner.
Retention and deletion
Projects and account records are kept while needed to provide your account and saved work. You can request account and project deletion by email. We may retain limited records where necessary for legal obligations, security or resolving disputes. Backups and provider-held copies may remain until their applicable retention periods expire. Deleting your Pipa account does not delete your Google account.
Your rights
Contact us to request access, correction, deletion, restriction or a portable copy of your personal data, or to object to processing based on legitimate interests. We may need to verify that a request comes from the account owner. You can also complain to the Finnish Data Protection Ombudsman: tietosuoja.fi. These rights apply subject to the conditions of applicable law.
Changes
This notice describes the current service. Material changes to data use will be disclosed in the application or by email. Additional Google permissions will not be requested without an updated disclosure and your authorization.
savolainen.alexey@gmail.com · Finnish Data Protection Ombudsman