Privacy Policy

1. Controller

[Full name], [Street and number], [Postal code, City], Germany (“we”, “us”). Contact: info@usethumbstop.ai. This policy explains how we process personal data when you use Thumbstop (the “Service”) in accordance with the EU General Data Protection Regulation (GDPR).

2. Data we process

• Account data — name, email address, and password hash when you create an account (Art. 6 (1)(b) GDPR).
• Billing data — subscription status and payment history. Card details are processed exclusively by our payment provider Stripe; we never store card numbers (Art. 6 (1)(b) GDPR).
• Content you provide — brand information, product data, images, text, and website URLs you submit to create ad creatives (Art. 6 (1)(b) GDPR).
• Usage and log data — IP address, browser information, and error diagnostics needed to operate and secure the Service (Art. 6 (1)(f) GDPR). Requests you send to the AI generation features (prompts and outputs) may be logged for debugging and quality assurance.

Account and billing data are required to provide the Service — without them we cannot offer it. We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

3. Cookies and analytics

We use strictly necessary cookies to keep you signed in (session cookies) and to remember your cookie choice (§ 25 (2) TDDDG). For web analytics we use DataFast (datafa.st), a privacy-friendly service. Unless you accept cookies, it runs in cookieless mode: it counts page views without storing anything on your device and without identifying you (Art. 6 (1)(f) GDPR). If you accept via the cookie banner, DataFast additionally sets first-party cookies (valid for up to twelve months) so returning visits can be recognised (Art. 6 (1)(a) GDPR).

Videos on our marketing pages are delivered by Wistia. The player works without cookies; Wistia’s cookie-based viewing analytics are only enabled after you accept via the cookie banner. If you decline, no tracking cookies are set (Art. 6 (1)(a) GDPR). You can withdraw consent at any time by clearing the consent cookie.

4. Processors and third-party services

We share data with the following processors under data-processing agreements, only to the extent needed to run the Service:

• [Hosting provider] — application and database hosting.
• Hetzner Online GmbH (Germany) — object storage for your uploaded and generated media, stored in the EU.
• Stripe — payment processing and subscription billing.
• Resend (Resend, Inc.) — transactional email (e.g. sign-in and billing emails).
• AI model providers (FAL.ai, OpenRouter) — processing of the content you submit for generation. Your content is transmitted to these providers solely to produce the requested output.
• Firecrawl — retrieval of the website URLs you submit when importing a brand or product.
• Wistia — video hosting on our marketing pages (see section 3).

Some providers process data outside the EU/EEA (in particular in the United States). Where that is the case, transfers are safeguarded by EU Standard Contractual Clauses or an adequacy decision (e.g. the EU–US Data Privacy Framework).

5. Retention

We keep personal data for as long as your account exists. When you delete your account, we delete or anonymize your data unless statutory retention obligations (e.g. tax law) require us to keep billing records for up to 10 years. Server and generation logs are kept only as long as needed for security and debugging.

6. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). Where processing is based on consent, you may withdraw it at any time with future effect. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority of the German federal state in which we are established.

7. Contact

For any privacy request, contact us at info@usethumbstop.ai.