Privacy Policy

1. What We Collect

When you use All My Mascots^™, we collect the following data:

• Account information: Email address and hashed password (via Supabase Auth)
• Mascot inputs: School levels, mascot names, style preferences, and percentage weightings you provide
• Generated prompts: AI-generated text prompts used to create your mascot images
• Image preferences: Which generated image you select when presented with multiple options (used for AI training when active)
• Timing data: Timestamps of generation requests and selections
• Usage metadata: Request IDs, generation costs, and error logs (without personal content)
• Technical identifiers: Your IP address and browser user-agent string, recorded when you create an account, accept our terms, or re-confirm consent — kept as evidence that consent was given (GDPR Art. 7(1)). Your IP address is also used transiently to rate-limit abuse; your user-agent string is not.

We do not collect your name, physical address, payment information, or browsing history outside of All My Mascots.

2. How We Use Your Data

• Image generation: Your mascot inputs are sent to AI models to generate blended mascot images
• AI improvement (DPO training): When training mode is active, your image preference selections (which image you chose, not your personal information) are used to train a student prompt model via Direct Preference Optimization (DPO)
• Service operation: Debugging errors, tracking usage for credit management, and preventing abuse

3. Legal Basis for Processing

Under GDPR Article 6(1), we process your data on:

• Contract performance (Art. 6(1)(b)): Generating mascot images as the core service you requested
• Legitimate interest (Art. 6(1)(f)): Collecting preference data for AI model improvement. We have conducted a Legitimate Interest Assessment (LIA) confirming that this interest does not override your rights, given the non-personal nature of preference data and the availability of an opt-out mechanism

Per CNIL guidance and EDPB Opinion 28/2024, legitimate interest is the appropriate basis for AI training on non-sensitive, anonymizable preference data with a clear opt-out.

4. AI Models Used

All My Mascots uses the following third-party AI models:

• GPT-4o (OpenAI) — Primary prompt engineering for standard generation
• DeepSeek-V3 and V3.1 (via OpenRouter) — Prompt generation for the training pipeline (DeepSeek-V3: DeepSeek License Agreement v1.0; V3.1: MIT license)
• Qwen 2.5 72B and Qwen3 (via OpenRouter) — Prompt generation for the training pipeline (Qwen 2.5 72B: Qwen License; Qwen3: Apache 2.0)
• Llama 3.3 70B (via OpenRouter) — Prompt generation for training pipeline (Meta Community License)
• Flux 2 Klein 9B (via Fal.ai) — Primary image generation for both standard and training flows
• Flux 2 Klein 4B (via Replicate) — Fallback image generation when the primary Flux path fails
• Gemini 3.1 Flash Image (Google) — Second image generation on every standard generation, alongside Fal.ai, so you can compare two results

Model versions and providers may change. See our Terms of Service for current details.

5. Third-Party Data Processors

We share data with the following processors solely for service operation:

6. International Data Transfers

Your data may be processed in the United States by our third-party processors. For transfers from the EEA/UK, we rely on the EU-US Data Privacy Framework (DPF) where available, and Standard Contractual Clauses (SCCs) as the fallback mechanism. We are completing our data protection agreements with the processors listed above; Fal.ai and Replicate provide theirs on request rather than publicly. The AI providers receive text prompts only, never your account identity — and Replicate states that it deletes prediction inputs, outputs and logs one hour after generation.

7. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the data we hold about you
• Deletion: Request deletion of your account and associated data
• Opt-out of training: Disable AI training data collection via your Settings page
• Portability: Request your data in a machine-readable format
• Rectification: Correct inaccurate data
• Object: Object to processing based on legitimate interest

To exercise these rights, contact us at the address in Section 12.

8. Opt-Out Mechanism

You can opt out of AI training data collection at any time via the toggle in your Settings page. When opted out, your image generation requests will still work normally, but your preference selections will not be used for AI model training. The opt-out takes effect immediately for all subsequent generations.

9. Data Retention

• Account data: Retained while your account is active. Deleted upon account deletion request.
• Generated images: Retained while your account is active for your gallery access.
• Training data (preferences): Retained for as long as it remains useful for improving our models, unless you request deletion. Opting out stops any future use of your data for training; it does not delete what is already stored.
• Backups: We back up our database and images daily. On our primary backup storage, routine daily backups are kept for 90 days, and backups taken before a planned change or manually for 1 year. Two full backups from September 2026, taken before launch and holding only team and test accounts, are kept indefinitely. Copies also exist on an encrypted external drive, which holds about two months of history, and in an encrypted offsite cloud backup (IDrive), where removal is not yet time-bounded. When you delete data it is removed from the live service immediately. Backups are not searched or edited per user — regulator guidance treats backup copies as “beyond use” — so your data leaves our primary backup storage as the backups holding it reach the end of their retention period; data in the two pre-launch backups above stays there for as long as they are kept. We have never restored the live service from a backup; if we ever need to, we will re-apply any deletions made since that backup before the service returns to use.
• Logs and metadata: Retained for debugging. Our hosting and error-monitoring providers apply their own retention limits to the copies they hold; we have not yet implemented automatic expiry of the timing and usage metadata in our own database, and are working to add it.

10. Children's Privacy (COPPA)

All My Mascots is not intended for children under 13. We require users to self-certify their age during signup. We do not knowingly collect personal information from children under 13. If we learn that we have inadvertently collected such data, we will delete it promptly. If you believe a child under 13 has created an account, please contact us.

11. California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: What personal information we collect and how we use it
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out of Sale: We do not sell your personal information
• Non-discrimination: We will not discriminate against you for exercising your rights

Per California AB 2013 (effective January 2026), we disclose that AI-generated content on this platform is produced using the models listed in Section 4, trained on publicly available datasets. User preference data collected with consent (or legitimate interest with opt-out) may be used to fine-tune a student prompt model.

12. Contact

For privacy inquiries, data requests, or to exercise your rights, contact us at: privacy@allmymascots.com

We will respond to verified requests within 30 days (45 days for complex requests, per CCPA).

13. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated via a banner notification on the site. Continued use of All My Mascots after changes constitutes acceptance of the updated policy. The "Last updated" date at the top reflects the most recent revision.