Privacy Policy

1. Data Controller and Scope

This Privacy Policy ("Policy") describes how ViralThumblify ("Provider," "we," "us," or "our") collects, uses, processes, and discloses personal data when you use the ViralThumblify Service — including our website at www.viralthumblify.com and application at app.viralthumblify.com.

1.1 Data Controller

ViralThumblify is the data controller responsible for the processing of your personal data described in this Policy. We operate the Service from the United States.

1.2 Contact Information

Designated contact: viralthumblify@gmail.com

Our Terms of Service govern your use of the Service.

2. Personal Data We Collect and Use

We collect and process data necessary to provide the Service. Depending on your location, we rely on contractual necessity, legitimate interests, consent where required, and legal obligation as applicable.

2.1 Account and Registration Data

We collect your email address, authentication identifiers, and profile fields you provide (or integration details when you sign in with a third party such as Google).

Purpose: Create your account, authenticate access, and provide the Service. Legal basis: Contractual necessity.

2.2 Financial and Transaction Data

We collect credit balance, usage ledger entries, pack purchased, and checkout email. Full payment card information is processed by third-party payment processors and is not stored by us.

Purpose: Process payments, deliver credits, and comply with accounting and tax obligations. Legal basis: Contractual necessity and legal obligation.

2.3 Operational Content Data

This includes YouTube URLs you submit, uploaded videos, scripts, text prompts, template choices, and User-Uploaded Images (including photos of your face or likeness) used for thumbnail generation.

Purpose: Execute the core function of the Service — generating the specific thumbnails you request. Legal basis: Contractual necessity.

2.4 Usage and Technical Data

This includes IP address, device type, browser information, pages visited, referring URLs, approximate location derived from IP, and features utilized (including analytics events such as sign-up or purchase steps).

Purpose: Operate, secure, and improve the Service, monitor performance, and understand how the product is used. Legal basis: Legitimate interest (balanced against your rights) and, where required, consent for non-essential cookies or advertising tags.

2.5 Support Communications

When you contact us, we collect your email, name, message content, and related metadata.

Purpose: Respond to your requests and provide customer support. Legal basis: Contractual necessity and legitimate interest.

2.6 Automatic Information Collection

We and our providers may collect information automatically through cookies, local storage, and similar technologies for session management, preferences, and analytics (including Google Tag Manager, Google Analytics, Google Ads, and hosting analytics where enabled). You can control many cookies through your browser settings.

3. Processing of Operational Content Data (Strict Limitations)

To be clear about the handling of your uploads:

3.1 Strict Use Limitation

Operational Content Data, including face images, is not used for external model training, marketing, promotional activities, or any purpose unrelated to delivering the specific ViralThumblify Service you requested.

3.2 AI Processing

To generate thumbnails, we send relevant portions of your inputs (prompts, reference images, video frames, transcripts, metadata) to third-party AI and infrastructure providers that process data on our instructions solely to provide the Service.

3.3 Retention

We retain Operational Content Data for as long as needed to maintain your projects and Generated Content within your active account (so you can access, refine, and export them), or as required by law. You may delete projects or face references in the app where those features are available.

4. Data Sharing and Disclosure

We may share your personal data with:

• Third-party service providers — cloud hosting (for example Vercel), authentication and database (for example Supabase), payments (for example Stripe), AI routing (for example OpenRouter and underlying model providers), analytics, email, and support tooling. These providers process data on our behalf under contractual confidentiality and security obligations;
• Platform APIs — such as YouTube-related services when you submit a link or we fetch public metadata or transcripts needed for generation;
• Professional advisers — lawyers, accountants, and auditors under confidentiality obligations;
• Legal and regulatory compliance — when required by law, subpoena, court order, or to protect the rights, property, or safety of the Provider, our users, or the public;
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to appropriate protections.

We do not sell your personal information and we do not share it for cross-context behavioral advertising as those terms are defined under applicable U.S. state privacy laws.

5. Data Security and International Transfers

5.1 Security Measures

We implement technical and organizational measures designed to protect personal data against unauthorized access, loss, destruction, or disclosure. No method of transmission or storage is completely secure.

5.2 International Data Transfers

Your data may be transferred to and processed in the United States and other countries where our providers operate. If you access the Service from outside the U.S., including the UK or EEA, we use appropriate safeguards where required by applicable law (such as standard contractual clauses).

6. Data Retention

We retain personal data only as long as necessary for the purposes described above:

• Account and studio data — while your account is active and for up to twenty-four (24) months after closure, unless a longer period is required by law or needed for disputes;
• Billing and accounting records — as required for tax and payment compliance (often up to seven (7) years where applicable);
• Support communications — as long as needed to resolve your request.

When we have no ongoing legitimate need to process personal data, we delete or anonymize it where possible. Data in backup archives may be retained until deletion is feasible.

7. Your Data Protection Rights

7.1 United States

Depending on your state of residence (including California, Virginia, Colorado, Connecticut, Utah, and others), you may have rights to know, access, correct, delete, or obtain a copy of personal information, to opt out of certain processing, and to non-discrimination for exercising privacy rights. To exercise these rights, contact viralthumblify@gmail.com. We will verify your request as required by law.

7.2 EEA and UK

If you are in the European Economic Area or United Kingdom, you may have rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with a supervisory authority. Submit requests to viralthumblify@gmail.com.

7.3 Marketing

You may opt out of marketing emails at any time using the unsubscribe link in those messages or by contacting us.

8. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Users must be 18+ under our Terms. If you believe a child under 13 provided us personal information, contact us and we will take appropriate steps to delete it.

9. Biometric and Likeness Notice

Face reference images may be considered sensitive under laws such as Illinois BIPA. By uploading a face reference, you confirm you have the right to do so and consent to our processing solely to provide the Service. Do not upload another person's likeness without their permission.

10. Policy Updates

We may update this Policy periodically. We will post the revised Policy on this page and revise the effective date above. Material changes may be communicated in the Service or by email where required by law.

11. Contact

For privacy requests and questions about this Policy, contact us at viralthumblify@gmail.com.