Privacy Policy

1. What We Collect

When you use All My Mascots, we collect the following data:

• Account information: Email address and hashed password (via Supabase Auth)
• Mascot inputs: School levels, mascot names, style preferences, and percentage weightings you provide
• Generated prompts: AI-generated text prompts used to create your mascot images
• Image preferences: Which generated image you select when presented with multiple options (used for AI training when active)
• Timing data: Timestamps of generation requests and selections
• Usage metadata: Request IDs, generation costs, and error logs (without personal content)

We do not collect your name, physical address, payment information, or browsing history outside of All My Mascots.

2. How We Use Your Data

• Image generation: Your mascot inputs are sent to AI models to generate blended mascot images
• AI improvement (DPO training): When training mode is active, your image preference selections (which image you chose, not your personal information) are used to train a student prompt model via Direct Preference Optimization (DPO)
• Service operation: Debugging errors, tracking usage for credit management, and preventing abuse

3. Legal Basis for Processing

Under GDPR Article 6(1), we process your data on:

• Contract performance (Art. 6(1)(b)): Generating mascot images as the core service you requested
• Legitimate interest (Art. 6(1)(f)): Collecting preference data for AI model improvement. We have conducted a Legitimate Interest Assessment (LIA) confirming that this interest does not override your rights, given the non-personal nature of preference data and the availability of an opt-out mechanism

Per CNIL guidance and EDPB Opinion 28/2024, legitimate interest is the appropriate basis for AI training on non-sensitive, anonymizable preference data with a clear opt-out.

4. AI Models Used

All My Mascots uses the following third-party AI models:

• GPT-4o (OpenAI) — Primary prompt engineering for standard generation
• DeepSeek V3 (via OpenRouter) — Prompt generation for training pipeline (MIT license)
• Qwen 2.5 72B (via OpenRouter) — Prompt generation for training pipeline (Apache 2.0 license)
• Llama 3.3 70B (via OpenRouter) — Prompt generation for training pipeline (Meta Community License)
• Flux 2 Klein 9B (via Fal.ai / Replicate) — Image generation (standard mode)
• Flux 2 Klein 4B (via Fal.ai / Replicate) — Image generation (training mode)
• Gemini 2.5 Flash (Google) — Fallback image generation

Model versions and providers may change. See our Terms of Service for current details.

5. Third-Party Data Processors

We share data with the following processors solely for service operation:

6. International Data Transfers

Your data may be processed in the United States by our third-party processors. For transfers from the EEA/UK, we rely on the EU-US Data Privacy Framework (DPF) where available, and Standard Contractual Clauses (SCCs) as the fallback mechanism. All processors listed above maintain appropriate data protection agreements.

7. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the data we hold about you
• Deletion: Request deletion of your account and associated data
• Opt-out of training: Disable AI training data collection via your Settings page
• Portability: Request your data in a machine-readable format
• Rectification: Correct inaccurate data
• Object: Object to processing based on legitimate interest

To exercise these rights, contact us at the address in Section 12.

8. Opt-Out Mechanism

You can opt out of AI training data collection at any time via the toggle in your Settings page. When opted out, your image generation requests will still work normally, but your preference selections will not be used for AI model training. The opt-out takes effect immediately for all subsequent generations.

9. Data Retention

• Account data: Retained while your account is active. Deleted upon account deletion request.
• Generated images: Retained while your account is active for your gallery access.
• Training data (preferences): Retained indefinitely for AI model improvement, unless you request deletion.
• Logs and metadata: Retained for 90 days for debugging, then automatically purged.

10. Children's Privacy (COPPA)

All My Mascots is not intended for children under 13. We require users to self-certify their age during signup. We do not knowingly collect personal information from children under 13. If we learn that we have inadvertently collected such data, we will delete it promptly. If you believe a child under 13 has created an account, please contact us.

11. California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: What personal information we collect and how we use it
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out of Sale: We do not sell your personal information
• Non-discrimination: We will not discriminate against you for exercising your rights

Per California AB 2013 (effective January 2026), we disclose that AI-generated content on this platform is produced using the models listed in Section 4, trained on publicly available datasets. User preference data collected with consent (or legitimate interest with opt-out) may be used to fine-tune a student prompt model.

12. Contact

For privacy inquiries, data requests, or to exercise your rights, contact us at: privacy@allmymascots.com

We will respond to verified requests within 30 days (45 days for complex requests, per CCPA).

13. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated via a banner notification on the site. Continued use of All My Mascots after changes constitutes acceptance of the updated policy. The "Last updated" date at the top reflects the most recent revision.