Privacy Policy
Last Updated: September 8, 2026
This Privacy Policy explains what data Panel Haus collects, why we collect it, and what your rights are. We wrote it in plain language because legal fog helps nobody.
1. Who We Are
Panel Haus is a web-based comic creation studio operated as an independent project. We are not a corporation. We're a solo-founded product built for writers and storytellers.
- Product: Panel Haus (panelhaus.app)
- Contact: support@panelhaus.app
- Governing Law: Ontario, Canada
2. The Short Version
We collect what we need to run the service, and we store the work you make so you can reach it from any device. We don't sell your data. Ever.
- We collect your email or wallet address, your plan, and your credit balance
- Your projects, images and AI history are saved on our servers so they sync across devices. That means we can technically access them
- AI features send your content to third party AI providers. We name every one of them below
- What you type to our AI assistants is saved to your account and kept for as long as your account exists
- We use Google Analytics to understand how the product is used
- Stripe handles your card. We never see the number
- If you register a comic as IP, that publishes it permanently and publicly. It cannot be undone, by you or by us. See Section 6
3. What Data We Collect
Data You Provide Directly
- Email address: account creation, sign in, and service messages
- Wallet address: Ethereum or Solana, for wallet based sign in and for NFT checks
- Creator Program details, if you join: your mint wallet address, and optionally your Discord account, X handle and a reminder email
- Shipping details, if you order a printed book: name, address, phone and contact email. These go to our print partner to fulfil and deliver the order
The Work You Create
Saved to our servers so it syncs across your devices:
- Projects and pages: panels, layout, text and settings
- Images: everything you upload and everything you generate
- Custom assets: fonts, blueprints, style profiles, poses, bubble styles and layouts
- Notes, snippets and Drafting Table boards
What You Type Into AI Features
- Image prompts, saved with the image they produced, in your generation history
- Story chats: your full conversation with the Ink assistant, both sides
- Board chat: what you send to Smudge, saved to your account with a timestamp and a note of which model answered
Data Created by Using the Service
- Credit balance, and a dated log of every AI action you spend credits on, including which feature it was
- Usage counters: sessions, exports, pages created and similar
- How you found us: the site that referred you, campaign tags on the link you arrived through, and the first page you landed on
- IP address: used to apply rate limits and to stop automated signup abuse. Kept as short lived counters, not as a browsing history
- Session token
Data We Do NOT Collect
- Payment card details. Stripe processes payments. We receive your subscription status, not your card number
- Precise location. We do not use GPS or any location API. Your IP address tells us roughly where a request came from, as it does for every website
- Your own API keys. If you supply your own, they stay in your browser and never reach our servers
4. How We Use Your Data
- Authentication: Your email or wallet address verifies your identity and manages your session
- Service delivery: Your subscription tier determines which features you can access
- Rate limiting: We track API usage to prevent abuse and enforce fair usage limits
- Communications: We may email you about account-related matters (subscription changes, security alerts). We will never send marketing emails without your explicit opt-in
- Legal compliance: We may retain data as required by law (tax records for payments, fraud prevention)
- Storing and syncing your work, so your projects open on any device you sign in from
- Improving the product. We look at how features are used, and at what people ask our AI assistants, to decide what to build and fix. We do not use your prompts or your artwork to train AI models, and we do not sell them
5. Your Content and AI Features
Important: when you use an AI feature, the content you are working on is sent to a third party provider to process. Here is exactly who receives what.
Who Receives What
- Google (Gemini): image generation and editing, story and panel text, chat. Receives your prompts and reference images
- Anthropic (Claude): Drafting Table assistant. Receives your prompts and board context
- xAI (Grok): dialogue and caption suggestions. Receives your prompts and story text
- fal.ai: pose generation, background removal, image cleanup. Receives images you supply
- Replicate: image models. Receives prompts and images
- ClipDrop and remove.bg: image cleanup and background removal. Receive images you supply
- ElevenLabs: spoken dialogue. Receives the dialogue text and a voice selection
Custom model training. If you train a custom character or style model, the images you select are packaged and sent to fal.ai to produce it.
When You Use Our Keys
Requests route through our server. Credits and rate limits apply. We keep a copy of the prompt and the result as part of your history, and board prompts are also saved separately to your account.
When You Use Your Own Keys
You can supply your own key for Google Gemini, Anthropic, OpenAI or DeepSeek in Settings. Your key stays in your browser, calls go straight from your browser to that provider, and we never see the request or the response. Two of those, OpenAI and DeepSeek, are only ever reachable this way. We hold no keys for them, so nothing goes to either unless you set one up yourself.
We do not use your content to train our own models, and we do not license it to anyone. Providers handle content under their own terms, linked below.
AI Provider Privacy Policies
6. Registering Your Work as IP (permanent and public)
This is the most important thing in this policy, so read it before you use the feature.
Panel Haus lets you register a comic as an IP asset. If you choose to do this:
- Your cover image, and the full comic if you include it, are uploaded to IPFS, a public distributed storage network
- The title, the description and your wallet address are published alongside them
- An entry is written to the Story Protocol blockchain, recording the asset and the licence terms you picked
This is permanent and public, and it cannot be undone. Not by you, and not by us. IPFS content and blockchain records are designed so that no single party can withdraw them. Once you confirm the transaction, that publication is final.
What this means for your other rights. Everywhere else in this policy, you can ask us to delete your data and we will. Registered IP is the one exception. We can delete our own copy, but we cannot remove anything from IPFS or from the blockchain. Please be sure before you register.
This is entirely optional. Nothing is published anywhere unless you open the registration window, pick your licence terms, and confirm the transaction from your own wallet.
7. Cookies, Local Storage and Analytics
Staying signed in. Your session token is stored in your browser's local storage, and our authentication provider (Clerk) sets its own cookies to keep you signed in.
Analytics. We use Google Analytics 4 to understand how the product is used: which features get opened, where people stop, and which pages bring people in. It sets cookies and identifies a browser rather than a person. Any tracker blocker will stop it, and the product works normally when it does. Google retains the detailed event data under the retention setting on our property, and keeps aggregated reports for longer.
We never send Google Analytics your email, your wallet address, your prompts, your project names, or any other content you create.
What We Do Not Use
- No advertising or retargeting cookies
- No social media tracking pixels
- No third party cookie for advertising
8. Where Your Data Is Stored
- Account, billing and usage records: Neon (PostgreSQL), United States. This is the master record
- Your projects, images and files: Cloudflare R2 object storage, plus a copy cached in your browser for speed
- Account cache, usage counters and rate limits: Upstash (Redis), United States. This holds a copy of your account basics, your plan and your credit balance so pages load quickly, plus counters for things like exports and session time
- Payment records: Stripe, and OxaPay for crypto payments
- Print orders: Lulu, our print on demand partner, plus our own records of the order. Kept for as long as needed to fulfil and support it
- Registered IP: IPFS and the Story Protocol blockchain, permanently and publicly. See Section 6
- Session token: your browser
9. Who We Share Data With
We share data only with the providers needed to run Panel Haus.
- Infrastructure: Vercel (hosting), Neon (database), Cloudflare (file storage), Upstash (caching), Clerk (authentication)
- AI and media processing: the providers named in Section 5
- Payments: Stripe, and OxaPay for crypto
- Email: Brevo and Resend. Signing up adds your address to our mailing list. Every message has an unsubscribe link, and you can ask us to remove you at any time
- Printing: Lulu receives your name, address, phone and contact email when you order a printed book, so it can print and deliver it
- Community: Discord, if you choose to connect your account. We ask permission to read your Discord username and server list and to add you to our server. You can disconnect at any time
- Blockchain checks: Alchemy and Helius receive your public wallet address to verify wallet and NFT ownership
- IP registration: Pinata and the Story Protocol network, only if you use that feature. See Section 6
- Analytics: Google Analytics
Our other apps. Panel Haus shares one credit balance with our mobile app, so credits you spend in either appear in the same records.
We Will NEVER
- Sell your personal data to anyone
- Share your data with advertisers
- Use your data for targeted advertising
- Share your data with data brokers
We May Disclose Data If
- Required by law (court order, subpoena)
- Necessary to prevent fraud or abuse
- Needed to protect the rights, property, or safety of Panel Haus or its users
10. Data Retention
- Account data: kept while your account is active
- Your projects and files: kept until you delete them. Items you move to trash are permanently removed after 30 days
- AI prompts, chats and generation history: kept for as long as your account is active. When your account is deleted, these are deleted with it
- Usage and credit records: kept as long as your account exists, because they are the record of what you were charged for
- Payment records: kept as tax law requires, typically 7 years
- Rate limit counters: expire automatically, typically within hours and at most a few days
- Analytics data: retained by Google under the retention setting on our property
- Registered IP: permanent. See Section 6
- When you ask us to delete your account: we remove your account record, your projects and files, your prompts and chats, and your usage history. Two things are kept: payment records, because tax law requires it, and anything you have registered as IP, which we cannot withdraw. See Section 6
11. Your Rights (GDPR & CCPA)
Regardless of where you live, we extend these rights to all users:
You Have the Right To
- Access: Request a copy of all personal data we hold about you
- Correction: Request that we fix inaccurate personal data
- Deletion: Request that we delete your personal data ("right to be forgotten")
- Portability: Request your data in a machine-readable format
- Restriction: Request that we limit how we process your data
- Objection: Object to data processing based on legitimate interests
- Withdraw consent: Withdraw any previously given consent at any time
For California Residents (CCPA)
- You have the right to know what personal information we collect and how it's used
- You have the right to request deletion of your personal information
- You have the right to opt out of the sale of your personal information, though we don't sell it
- We will not discriminate against you for exercising your CCPA rights
For European Residents (GDPR)
- You may lodge a complaint with your local data protection authority if you believe your rights have been violated
One exception, stated plainly. Work you have registered as IP is published to IPFS and to a public blockchain, and we cannot delete it. We will delete our own copies, but the public record stays. Section 6 explains this before you use the feature.
Our legal basis. We process your data to provide the service you signed up for (contract), to keep it working and free of abuse (legitimate interest), and to improve it by reviewing how AI features are used (legitimate interest). Where we rely on legitimate interest you can object at any time, using the contact details below.
How to Exercise Your Rights
Email support@panelhaus.app. We respond within 30 days.
- For an access or portability request we will send you your account record, your projects and files, your usage history, and your saved prompts and chats
- For a deletion request we will delete your account and its data, and confirm to you when it is done. Deletion is handled by our team rather than by a button in the app, so please allow up to 30 days. It is permanent, and there is no undo
- After deletion, signing in again with the same email or wallet creates a brand new, empty account. It does not restore the old one
- To cancel a subscription, you can do that yourself at any time from your account, through the Stripe billing portal. Cancelling and deleting are separate, so cancel first if you want both
12. Children's Privacy
Panel Haus is intended for users aged 16 and older, or 13 and older where local law allows and a parent or guardian consents.
- If you are under that age, do not use Panel Haus or provide any personal information
- If we discover we have collected data from a child below it, we will delete it immediately
- If you believe a child has provided us with personal information, contact us at support@panelhaus.app
13. Security
We take reasonable measures to protect your data:
- All data transmitted over HTTPS
- Sign in tokens are short lived and refreshed automatically
- Files in object storage are private and served through expiring signed links, never public URLs
- OTP codes use cryptographically secure random generation
- Admin endpoints require separate authentication with audit logging
- Rate limiting on all authentication endpoints
No system is 100% secure. If we discover a data breach that affects your personal information, we will notify you within 72 hours as required by GDPR.
14. International Data Transfers
Your data may be processed in countries outside your own, including the United States and Canada. Our service providers (Vercel, Neon, Cloudflare, Upstash, Clerk, Stripe and Pinata among them) operate globally. By using Panel Haus, you consent to this transfer.
For EU residents: We rely on Standard Contractual Clauses and the data processing agreements of our service providers to ensure adequate data protection.
15. Changes to This Policy
- We may update this Privacy Policy from time to time
- Changes will be posted on this page with an updated "Last Updated" date
- For material changes that affect how we use your data, we will notify you by email at least 30 days before the changes take effect
- Continued use of Panel Haus after changes take effect constitutes acceptance of the updated policy
16. Contact
Questions, concerns, or requests about your privacy?
- Email: support@panelhaus.app
- Response time: Within 30 days
By using Panel Haus, you acknowledge you've read and understood this Privacy Policy.