Privacy Policy

Last updated: October 03, 2026

Thumbfa.st ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered thumbnail generation service.

1. Information We Collect

1.1 Information You Provide Directly

We collect information you provide when using our service:

• Account Information: Email address, display name, and password when you create an account
• Payment Information: Payment details processed securely by Waffo Pancake (we do not store credit card numbers)
• Face Images: Photos you upload for thumbnail generation (stored securely for consistent identity)
• Prompts and Preferences: Text prompts, template choices, and style preferences for thumbnail generation
• Communications: Messages sent to our support team

1.2 Information Collected Automatically

When you use our service, we automatically collect:

• Usage Data: Pages visited, features used, time spent, and generation history
• Device Information: IP address, browser type, operating system, device identifiers
• Log Data: Server logs, access times, referring URLs, and error reports
• API Usage: API calls made, quota consumption, and error rates

1.3 Cookies and Similar Technologies

We use cookies and similar tracking technologies to:

• Authenticate users and maintain sessions
• Remember preferences and settings
• Analyze usage patterns and improve our service
• Prevent fraud and enhance security

You can control cookie settings through your browser, but disabling cookies may limit your ability to use certain features.

2. How We Use Your Information

We use the collected information for the following purposes:

2.1 Service Delivery

• To provide, maintain, and improve our thumbnail generation service
• To process payments through Waffo Pancake
• To generate AI thumbnails with consistent face identity
• To store and manage your generation history

2.2 Communication

• To send service-related notifications (account updates, feature announcements)
• To respond to your support requests and inquiries
• To send administrative information (terms changes, policy updates)
• To send marketing communications (with your consent, where required)

2.3 Security and Compliance

• To detect and prevent fraud, abuse, and security incidents
• To enforce our Terms of Service and Acceptable Use Policy
• To comply with legal obligations and respond to legal requests
• To protect the rights, property, and safety of Thumbfa.st and our users

2.4 Analytics and Improvement

• To analyze usage patterns and user behavior
• To test and optimize features and functionality
• To develop new features and services
• To measure and improve the quality of AI-generated content

3. Data Sharing and Disclosure

We do not sell your personal data. We share your information only in the following circumstances:

3.1 Service Providers

We share data with third-party service providers who perform services on our behalf:

• Waffo Pancake (Merchant of Record): Payment processing and customer billing
• Replicate: AI model inference for thumbnail generation (face images and prompts are processed)
• Hosting Providers: Cloud infrastructure and database hosting (e.g., AWS, Google Cloud)
• Email Services: Transactional email delivery (e.g., SendGrid, Postmark)
• Analytics Providers: Usage analytics and performance monitoring

3.2 Legal Requirements

We may disclose your information if required by law or in response to:

• Court orders, subpoenas, or legal process
• Government or regulatory requests
• Requests to prevent harm or illegal activity
• Protection of our legal rights and property

3.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction. We will notify you via email or prominent notice on our website before your information becomes subject to a different privacy policy.

3.4 With Your Consent

We may share your information with third parties when you explicitly consent to such sharing.

4. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes outlined in this policy:

• Account Data: Retained while your account is active and for 30 days after deletion
• Face Images: Stored as long as your account is active; deleted within 30 days of account deletion
• Generation History: Retained indefinitely for your access unless you delete individual items
• Payment Records: Retained for 7 years for tax and accounting purposes (handled by Waffo Pancake)
• Log Data: Retained for up to 90 days for security and debugging purposes

When you delete your account, we delete or anonymize your personal data within 30 days, except where retention is required by law.

5. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

• Encryption: Data encrypted in transit (TLS/SSL) and at rest (AES-256)
• Access Controls: Role-based access and multi-factor authentication for staff
• Secure Storage: Face images and sensitive data stored in encrypted databases
• Regular Audits: Security assessments and vulnerability testing
• Staff Training: Privacy and security training for all employees

While we strive to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

6. Your Privacy Rights

Depending on your jurisdiction, you may have the following rights:

6.1 Access and Portability

• Request access to your personal data
• Receive a copy of your data in a structured, machine-readable format
• Request transmission of your data to another service provider

6.2 Correction and Deletion

• Request correction of inaccurate or incomplete data
• Request deletion of your personal data ("right to be forgotten")
• Delete your entire account and associated data

6.3 Restriction and Objection

• Request restriction of processing in certain circumstances
• Object to processing of your personal data
• Withdraw consent for processing (where processing is based on consent)

6.4 Opt-Out Rights

• Opt-out of marketing communications (via unsubscribe link)
• Disable cookies through browser settings
• Request deletion of face images and generation history

To exercise these rights, contact us at support@yourdomain.com. We will respond within 30 days.

7. International Data Transfers

Thumbfa.st operates globally, and your data may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by regulatory authorities
• Data Processing Agreements with service providers
• Certification under privacy frameworks (e.g., Privacy Shield for US transfers, where applicable)

8. Children's Privacy

Thumbfa.st is not intended for children under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child without parental consent, we will delete it promptly. If you believe a child has provided us with personal data, please contact us.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

• Posting the updated policy on our website with a new "Last Updated" date
• Sending an email notification to your registered email address
• Displaying a prominent notice on our website or application

Your continued use of Thumbfa.st after the effective date constitutes acceptance of the updated Privacy Policy.

10. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email: support@yourdomain.com
Response Time: We respond to all privacy-related inquiries within 3 business days
Data Protection Officer: If applicable, contact our DPO at dpo@yourdomain.com

You also have the right to lodge a complaint with your local data protection authority if you believe we have violated your privacy rights.