1. Overview and who we are
The data controller for the ThumbsGen website and service is ThumbsGen [LEGAL ENTITY NAME, PLACEHOLDER], [REGISTERED ADDRESS, PLACEHOLDER] (“ThumbsGen”, “we”, “us”). You can reach us at support@thumbsgen.com. This policy applies to the website, the demo workspace and the paid service. It does not apply to third-party sites we link to.
In short: we collect what is needed to run your account and generate your thumbnails, we do not sell your personal data, and you decide whether your uploads may be used to improve our models.
2. Information we collect
Information you give us
- Account data: your name, email address and password (stored as a hash, never in plain text) or the identifier returned by a sign-in provider.
- Content you upload or enter: photos (which may show your face), video links, video titles, hook text, brand colors, fonts and logos, and the thumbnails generated from them.
- Billing data: your billing name, country and tax details where required. Card details are collected and held by Stripe. We receive your plan, subscription status, the last four card digits, card brand and expiry, and invoice records, but not your full card number.
- Messages: what you send through the contact form, by email or in support requests, including attachments.
- Preferences: settings such as the training opt-out, theme and notification choices.
Information collected automatically
- Usage data: pages and features used, credits spent, generation and export events, errors and timestamps.
- Device and log data: IP address, browser type and version, operating system, screen size, referring page and approximate location derived from the IP address.
- Cookies and similar technologies: described in the Cookie Policy.
What we do not ask for
We do not ask for government IDs, health data or other special-category data. Photos of faces can still reveal sensitive information, which is why the rules in section 6 apply.
3. Where data comes from
Mostly from you. Some data comes from our payment processor (subscription status, payment success or failure), from sign-in providers if you use one, and from your browser or device when you visit the site. If you paste a public YouTube link, we read the public title and description of that video to suggest layouts and hooks. We do not collect data from YouTube accounts.
4. How we use data and our legal bases
| Purpose | Data | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Create and run your account, generate, edit and export thumbnails | Account data, uploads, usage data | Performance of a contract |
| Take payments, issue invoices, keep accounting records | Billing data | Performance of a contract; legal obligation |
| Provide support and respond to messages | Messages, account data | Performance of a contract; legitimate interests |
| Keep the service secure, prevent fraud and abuse, debug problems | Log and device data, usage data | Legitimate interests |
| Understand how the product is used and improve non-content features | Usage data | Legitimate interests; consent where cookies require it |
| Send service messages (receipts, security notices, changes to terms) | Account data | Performance of a contract; legal obligation |
| Send product news (only if you opt in) | Email address | Consent, which you can withdraw at any time |
| Improve our image models with your uploads (only if you have not opted out) | Uploads | Legitimate interests, subject to your opt-out |
| Comply with law and respond to lawful requests | Any data needed | Legal obligation |
We do not sell personal data, and we do not use your uploads for advertising.
5. Training opt-out
You choose whether your uploads may be used to improve ThumbsGen models. At sign-up there is a switch labelled “Don't use my uploads to improve ThumbsGen models”. If you turn it on, your uploaded images are used only to produce your own thumbnails and are never added to any training or evaluation set.
- You can change the setting at any time in your account settings, or email support@thumbsgen.com and we will apply it for you.
- A change applies from the moment it is saved. It does not undo processing that already took place, but we will exclude your existing uploads from future training runs.
- Opting out does not reduce the features, credits or quality you receive.
- Generated thumbnails and text you enter follow the same setting as your uploads.
6. Photos and faces
Only upload faces you have the right to use. If a photo shows another person, you must have their permission for the uses described in the Terms of Service. A face cutout is created from a photo you upload, used to build your thumbnail, and kept for 30 days after upload unless you delete them sooner unless you delete it sooner. We do not use faces to identify people, build face databases or match faces across accounts. We may remove content that appears to impersonate someone or that someone has asked us to take down.
7. How we share data
- Service providers (sub-processors): companies that host the service, process payments, run image models and send email, listed in the next section. They may use data only to provide their service to us.
- Legal and safety: authorities or other parties where we are legally required to, or where needed to protect rights, safety or the security of the service.
- Business transfers: a successor if ThumbsGen is involved in a merger, acquisition or sale of assets, with notice to you and the same privacy protections.
- With your direction: for example, when you export a thumbnail and upload it elsewhere, that is your action.
We never sell personal data and never share your uploads with other users.
8. Sub-processors
The current list, with purposes, locations and transfer safeguards, is on the Security page. We update it when providers change and require each provider to protect data under a written agreement.
9. International transfers
ThumbsGen and its providers operate in several countries, including the United States, so your data may be processed outside the country where you live. Where the law requires a safeguard for such transfers, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, adequacy decisions or comparable measures, as shown in the sub-processor table.
10. Retention
| Data | How long |
|---|---|
| Uploaded images and face cutouts | 30 days after upload unless you delete them sooner |
| Generated thumbnails | While your account is active, or until you delete them |
| Account data | While your account is active, then deleted or anonymised after closure, subject to the rows below |
| Billing and tax records | As long as the law requires (commonly 6 to 10 years) |
| Support messages | Until your request and related follow-ups are resolved, then up to 24 months |
| Server and security logs | Up to 90 days, longer only if needed to investigate abuse |
| Backups | Overwritten on a rolling schedule, generally within 90 days |
We may keep data longer where needed for legal claims, to resolve disputes or to enforce our agreements.
11. Security
We use administrative, technical and organisational measures to protect personal data, including encryption in transit, access controls and monitoring. No system is completely secure, so we cannot guarantee absolute security. More detail is on the Security page. If a breach affects your data in a way the law requires us to report, we will notify you and the relevant authority in the required time.
12. Cookies
We use a small number of cookies and similar storage, described in the Cookie Policy, including how to control them.
13. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and get a copy;
- correct data that is wrong or incomplete;
- delete your data (“right to be forgotten”);
- export your data in a portable format;
- object to processing based on legitimate interests, and to direct marketing;
- restrict processing while a dispute is resolved;
- withdraw consent at any time, without affecting earlier processing;
- lodge a complaint with your local data protection authority.
To use a right, email support@thumbsgen.com from your account email. We may ask you to confirm your identity and will reply within 2 business days, and in any case within one month, extendable where the law allows. Requests are free unless they are clearly excessive. You can also delete uploads and thumbnails yourself from your account.
14. Regional notes
EEA, UK and Switzerland
The legal bases above apply. You may complain to your national supervisory authority.
California and other US states
We do not sell personal information or share it for cross-context behavioural advertising. Residents of states with privacy laws can request access, correction, deletion and portability, and will not be treated differently for exercising these rights. You may use an authorised agent, and we may need to verify the request.
Other regions
If your local law gives you additional rights, we will honour them where they apply.
15. Automated decisions and AI
ThumbsGen uses AI models to suggest and generate thumbnail drafts. These outputs do not produce legal or similarly significant effects on you, and you review and edit every result. We do not make automated decisions about your account that have legal effect without human review.
16. Children
ThumbsGen is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, contact support@thumbsgen.com and we will delete it.
17. Third-party links
The site links to external services such as YouTube and Stripe-hosted checkout pages. Those services have their own privacy policies, and we are not responsible for them.
18. Changes to this policy
We may update this policy as the service or the law changes. We will post the new version here and update the date at the top. For material changes we will also notify you by email or in the product before they take effect.
19. Contact
Privacy questions, requests or complaints: support@thumbsgen.com, or write to ThumbsGen [LEGAL ENTITY NAME, PLACEHOLDER], [REGISTERED ADDRESS, PLACEHOLDER]. See also the contact page.