Privacy Policy

The controller of your personal data is:

• •Operator: VOXEN Dawid Grabowski
• •Registered address: ul. Jana III Sobieskiego 26A/90, 15-014 Białystok, Polska
• •Tax ID (NIP): 9662217453
• •Business register (REGON): 543889591
• •Contact: support@thumblaunch.com
• •Registered as a sole proprietorship in Poland (CEIDG).

For any privacy matter, including exercising your rights, write to support@thumblaunch.com.

• •Account data: your e-mail address and the identifier from the sign-in provider you chose (Google, Discord or e-mail magic link).
• •Content you provide: scene descriptions and prompts, Roblox usernames you search for, reference images and screenshots you upload.
• •Content we generate for you: generated images, cutouts and stickers, plus the settings used to create them.
• •Technical data: your IP address, session cookie, and counters used for rate limiting.
• •Payment data: order and subscription status received from our payment provider. We never receive or store your card number.

• •To provide the Service you asked for — creating your account, generating and storing images, keeping your project history: performance of a contract, Art. 6(1)(b) GDPR.
• •To keep the Service working and prevent abuse — rate limiting, one-starter-bonus-per-IP, blocking automated abuse: our legitimate interest, Art. 6(1)(f) GDPR.
• •To meet accounting and tax obligations connected with sales: legal obligation, Art. 6(1)(c) GDPR.
• •To answer your messages: our legitimate interest in handling enquiries, Art. 6(1)(f) GDPR.

We do not use your data for advertising profiling, and we do not sell it.

To run the Service we rely on the following providers, which process data on our instructions and only for the purposes described above: Google, Polar, Supabase, Vercel.

Two points worth knowing about how this affects you:

• •Your account data and generated image files are stored on servers located in the European Union (Frankfurt).
• •Your scene descriptions and any reference images you upload are sent to an artificial intelligence provider for processing — that is how the images are created.

Polar has a different role from the others: it acts as Merchant of Record for every order, which means it is the seller shown on your receipt and a separate controller for the payment data it collects. Its own privacy policy applies to that data. We never see or store your card details.

We do not sell your data and we do not share it with anyone beyond the providers listed above.

Where data is transferred outside the European Economic Area, it is done on the basis of the European Commission's Standard Contractual Clauses or another mechanism permitted by Chapter V GDPR.

• •Generated image files: 14 days on free accounts, 180 days on paid accounts. Character cutouts on paid accounts are kept without a time limit.
• •Project history and settings: until you delete the project or your account.
• •Account data: until you delete the account. Deletion is requested from the account panel and carried out 14 days later, so that a change of mind costs one click; after that period the account, its images and any unused credits are removed permanently. If you need it done immediately, write to us.
• •Anonymous sessions that never generated anything: deleted automatically after 30 days.
• •Rate-limiting counters: deleted automatically once the time window expires.
• •Accounting records relating to purchases: for the period required by tax law.

You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable format. Where processing is based on our legitimate interest, you may object to it at any time.

To exercise any of these rights, write to support@thumblaunch.com. You also have the right to lodge a complaint with the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa.

We do not use advertising cookies and we do not track you across other websites. We only store what the Service needs to work and to know which channel brought us visitors:

• •bt_session — an essential cookie that identifies your session and links your work to your account (valid for one year).
• •Authentication cookies set when you sign in, so you stay signed in between visits.
• •bt_attr — records how you first reached us (for example the campaign tag in the link you clicked, or the domain of the site that linked to us, such as "youtube.com"). It holds no personal data, is set only on your first visit and is never used to track you elsewhere. Valid for 180 days.
• •bt_lang in your browser's local storage — remembers your language choice.

We also measure traffic to our pages using Vercel Analytics, which works without cookies and without identifying individual visitors.

The Service is intended for users aged 16 and over. We do not knowingly collect data from children under that age without the consent of a parent or legal guardian. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this policy, for example when we change a provider. The date at the top of this page shows the current version.