Security & Data Handling

1. Our approach

Your photos, titles and brand assets are the raw material for your thumbnails, so we aim to collect only what the service needs, keep it only as long as needed, and protect it while we hold it. This page describes those practices. It is not a certification: ThumbsGen is a new service and does not currently claim SOC 2 or ISO 27001 status.

[Owner: confirm every statement on this page matches your real setup before launch, and remove or change anything that does not.]

2. Upload handling

• Images you upload are used to generate and edit your thumbnails. Face cutouts are made only from photos you choose to upload.
• Only upload faces you have the right to use. See the Terms for details.
• Files are checked for type and size on upload, and stored in a private location that is not publicly listed. Access is limited to your account and to the processes that generate your thumbnails.
• Whether uploads may be used to improve our models is your choice. See the training opt-out in the Privacy Policy.
• We do not use faces to identify people, and we do not sell or share uploads with other users.

3. Deletion

You can delete any upload or generated thumbnail from your account at any time. Deleted files are removed from active storage straight away. You can also ask us to delete your account and data by emailing support@thumbsgen.com; we act on verified requests within 30 days. Copies in backups and logs are overwritten on their normal schedule, generally within 90 days, and are not used for anything else in the meantime. Records we must keep by law, such as invoices, are retained as the Privacy Policy explains.

4. Retention

Uploaded images are kept for 30 days after upload unless you delete them sooner. After that period they are deleted automatically. Generated thumbnails stay in your account until you delete them. The full retention table is in the Privacy Policy.

5. Encryption

• In transit: all traffic between your browser and ThumbsGen is encrypted with TLS 1.2 or later (HTTPS), and plain HTTP requests are redirected.
• At rest: stored files and databases are encrypted at rest using the encryption features of our infrastructure providers.
• Passwords: if you sign in with a password, it is stored only as a salted hash.

6. Access controls

• Access to production systems and customer data is restricted to people who need it to run the service, on a least-privilege basis.
• Administrative access uses strong authentication, and access is removed when it is no longer needed.
• Secrets and API keys are stored outside the code and are not exposed to the browser.
• Support staff access your content only when needed to help you, and normally only with your request.

7. Infrastructure

ThumbsGen runs on established cloud and edge providers, listed in the sub-processor table below. These providers maintain physical and network security controls and independent audits of their own. The website is served as static files from a global network, which also gives protection against common network attacks such as DDoS.

8. Monitoring and logging

We monitor the service for errors and suspicious activity, and keep audit and security logs for up to 90 days to help detect and investigate problems. Logs avoid storing the contents of your uploads.

9. Payments

Payments are handled by Stripe, a PCI DSS Level 1 certified payment processor. Your full card number goes to Stripe and is never stored on our servers. We receive only limited payment metadata, such as plan, status, card brand and the last four digits.

10. Secure development

• Dependencies are reviewed and updated regularly, and security patches are applied in a timely way.
• Changes are reviewed before release, and the public site keeps the attack surface small by not exposing server-side API routes for checkout.
• Environment configuration is separated between development and production.

11. Backups and continuity

Data stores are backed up on a regular schedule and backups are encrypted. We test our ability to restore from backups periodically. Because the service relies on third-party providers, a provider outage can briefly affect availability.

12. Incident response

If we become aware of a security incident that affects your data, we will investigate and contain it, fix the cause, and tell affected customers and the relevant authorities without undue delay and within the time the law requires. Our notice will describe what happened, what data was involved and what you can do.

13. Sub-processors

These providers process data on our behalf, under written agreements that limit what they can do with it. We update this list when providers change. Entries in square brackets are not finalised yet.

14. Your responsibilities

Security is shared. Please use a strong, unique password, keep your devices updated, sign out on shared computers, and do not share your login. Only upload images you have the right to use, and tell us at once if you think your account has been accessed without permission.

15. Reporting a vulnerability

If you find a security issue, email support@thumbsgen.com with a description, the steps to reproduce it and any proof of concept. Please:

• give us reasonable time to investigate and fix the issue before disclosing it publicly;
• avoid accessing or changing other users' data, degrading the service or running denial-of-service tests;
• only test against your own account.

We will acknowledge your report within 2 business days and keep you updated. Good-faith research that follows these rules will not lead to legal action from us. We do not run a paid bug bounty at the moment. See also the Privacy Policy and the contact page.