Privacy Policy

[YOUR FULL NAME], trading as Thumbn, is the data controller for personal data processed through Thumbn. Contact: [SUPPORT@THUMBN.SO]. This notice is written under the UK GDPR and the Data Protection Act 2018.

• Account data — your name, email address and profile picture, received from Google when you sign in.
• Content you upload — the videos, links and reference images you give us, plus the thumbnails generated from them.
• Usage data — projects, credit transactions and the prompts you send the editing agent.
• Billing data — your subscription status and payment history. Card details go to Stripe and are never seen or stored by us.
• Provider API keys — if you add your own, they are encrypted at rest with AES-256-GCM and are never returned to the browser after saving.
• Technical data — IP address and request metadata, used for rate limiting and abuse prevention.

• To provide the service (uploads, generation, your project history) — performance of our contract with you.
• To take payment — performance of a contract, and legal obligation for tax records.
• To prevent abuse (rate limits, credit accounting) — our legitimate interest in keeping the service usable and not being defrauded.
• To answer support emails — legitimate interest.

We do not sell your data, we do not use it for advertising, and we do not use your videos or thumbnails to train our own models.

To generate a thumbnail we necessarily send your video and prompts to AI providers. These are our processors and sub-processors:

• Cloudflare, Inc. — Hosting, storage (R2), database (D1) and CDN (Global).
• Stripe, Inc. — Payment processing and subscription billing (US / EU).
• Google LLC — Sign-in with Google, and video analysis via the Gemini API (US).
• OpenAI, L.L.C. — Image generation, when that model is selected (US).
• Anthropic PBC — The editing agent (US).

Some are outside the UK. Those transfers rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or on adequacy regulations where they apply.

Projects, uploads and generated images are kept until you delete them or close your account. When you close your account we delete your content within 30 days, except records we must keep for tax and accounting — invoices are retained for six years, as UK law requires.

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another provider. Email [SUPPORT@THUMBN.SO] and we will respond within one month.

If you think we have got it wrong you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would rather you told us first.

Thumbn sets one essential cookie, to keep you signed in. There is no analytics, advertising or third-party tracking on this site, which is why you are not being asked to accept anything.

Traffic is encrypted in transit. Your own provider API keys are encrypted at rest. Access to the production database is limited to the operator. No system is perfectly secure; if a breach affects your rights we will tell you and the ICO within 72 hours, as required.

Thumbn is not for under-18s and we do not knowingly collect their data. If you believe a child has an account, email us and we will remove it.