1. Introduction
THUMBEAST ("we", "us", or "our") operates the thumbeast.com website and AI thumbnail generation service. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.
By using THUMBEAST, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.
2. Information We Collect
2.1 Account Information
When you create an account, we collect information provided by your identity provider (e.g., Google, email/password):
- Name and email address
- Profile picture (if provided by your identity provider)
- Unique account identifier
2.2 Payment Information
Payments are processed by Stripe. We do not store your full credit card number. Stripe provides us with limited billing information such as the last four digits of your card, card brand, and billing country. Please review Stripe's Privacy Policy for more details.
2.3 Uploaded Content
When you use our Service, you may upload images including facial photographs, objects, and background images. These are stored securely in our cloud storage and are used solely to generate thumbnails as directed by you.
2.4 Generated Content
Thumbnails and images generated through the Service are stored in your account gallery. We retain these until you delete them or close your account.
2.5 Usage Data
We automatically collect:
- IP address (for rate limiting and abuse prevention)
- Browser type and device information
- Pages visited and features used
- Generation prompts and settings
- Credit usage and transaction history
3. How We Use Your Information
We use collected information to:
- Provide, maintain, and improve the Service
- Process payments and manage subscriptions
- Generate thumbnails based on your inputs
- Prevent abuse, fraud, and enforce our Terms of Service
- Send transactional emails (billing, account changes)
- Respond to support requests
- Analyze aggregate usage patterns to improve our AI models and Service quality
4. Third-Party Services
We share information with third-party services necessary to operate THUMBEAST:
- AI Providers (Replicate, fal.ai, Google Vertex AI, kie.ai) — Your prompts and uploaded images are sent to these providers to generate thumbnails. They process data according to their own privacy policies and data processing agreements.
- Stripe — For payment processing and subscription management.
- Cloud Infrastructure — We use cloud storage (S3-compatible) and databases hosted in the EU to store your data.
- Authentication — Self-hosted identity management via Keycloak.
We do not sell your personal information to third parties. We do not share your data for advertising purposes.
5. Data Retention
- Account data: Retained as long as your account is active.
- Generated images: Retained until you delete them or close your account.
- Uploaded face/object images: Retained until you delete them or close your account.
- Payment records: Retained for 7 years for tax and legal compliance.
- Usage logs: Retained for up to 90 days for debugging and security.
When you delete your account, we permanently remove your personal data, uploaded images, and generated content within 30 days. Anonymized, aggregated usage data may be retained indefinitely.
6. Data Security
We implement industry-standard security measures including:
- Encryption in transit (TLS/HTTPS) and at rest for stored data
- Parameterized database queries to prevent injection attacks
- Rate limiting and CSRF protection on all API endpoints
- Content Security Policy (CSP) headers to mitigate XSS attacks
- NSFW content detection to prevent misuse
- Role-based access controls for internal systems
While we strive to protect your information, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.
7. Your Rights
Depending on your location, you may have the following rights:
- Access: Request a copy of the personal data we hold about you.
- Rectification: Request correction of inaccurate data.
- Deletion: Request deletion of your account and associated data.
- Portability: Request your data in a machine-readable format.
- Objection: Object to processing of your data for specific purposes.
To exercise any of these rights, contact us at contact@thumbeast.com. We will respond within 30 days.
8. Cookies
THUMBEAST uses essential cookies only:
- Session cookies: To keep you logged in and maintain your authentication state.
- CSRF tokens: To protect against cross-site request forgery.
We do not use tracking cookies, advertising cookies, or third-party analytics cookies.
9. Children's Privacy
THUMBEAST is not intended for users under 16 years of age. We do not knowingly collect personal information from children. If we learn we have collected data from a child under 16, we will delete it promptly.
10. International Data Transfers
Your data may be processed by AI providers located outside your country of residence. When this occurs, we ensure appropriate safeguards are in place, including standard contractual clauses and data processing agreements with our providers.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.
12. Contact Us
If you have questions about this Privacy Policy or our data practices, contact us at contact@thumbeast.com.