Privacy Policy
1. Who we are
Thumblore is operated by Monday Canvas ("we", "us"). This Privacy Policy explains what personal data we collect, how we use it, and your rights.
2. Data we collect
- Account data: email, display name, password hash, authentication provider IDs.
- Usage data: prompts, uploaded reference images, generated outputs, credit transactions, feature interactions, device and browser metadata, IP address.
- Billing data: handled by Dodo Payments as merchant of record. We receive transaction metadata (plan, amount, country, last 4 digits of card, invoice ID) but do not store your full payment card details.
- Support data: any information you send us when contacting support.
3. How we use data
- Provide and operate the Service (generate thumbnails, manage credits, render the dashboard).
- Process payments, prevent fraud, and comply with tax and accounting obligations (via Dodo Payments).
- Improve product quality, debug issues, and monitor abuse.
- Communicate service updates, billing notices, and security alerts.
We do not sell your personal data, and we do not use your prompts or outputs to train foundation models.
4. Subprocessors
We rely on the following processors to deliver the Service:
- Dodo Payments — payments, subscriptions, tax (merchant of record).
- Supabase — authentication, database, storage.
- Cloudflare — hosting, CDN, DDoS protection.
- Google Cloud (Vertex AI / Gemini) — AI generation.
- Cloudflare R2 — generated asset storage.
5. International transfers
Your data may be processed in countries outside your own, including the United States and the European Union. Where required, transfers are protected by appropriate safeguards such as Standard Contractual Clauses.
6. Retention
- Account data: kept while your account is active and for up to [12] months after deletion for legal/audit purposes.
- Generated thumbnails and uploads: retained until you delete them or close your account.
- Billing records: retained for the period required by applicable tax law (typically 7–10 years), managed by Dodo Payments.
7. Your rights
Depending on your jurisdiction (e.g. EEA/UK GDPR, California CCPA), you may have the right to access, correct, delete, port, or restrict the processing of your personal data, and to object to certain processing. To exercise these rights, email support@thumblore.com
8. Cookies
We use strictly necessary cookies for authentication and session management, and minimal analytics to understand usage. We do not use advertising cookies.
9. Security
We use industry-standard technical and organisational measures (TLS in transit, encryption at rest, role-based access, RLS on the database). No system is perfectly secure; you use the Service at your own risk.
10. Children
The Service is not intended for children under 13. We do not knowingly collect data from children under 13.
11. Changes
We may update this Policy. Material changes will be notified in-app or by email.
12. Contact us
Privacy questions: support@thumblore.com