01. Information We Collect

When you register, place thumbnail orders, or connect your channel to AI Thumbnail Studio, we collect the following categories of information:

• Account Information: Your full name, email address, profile avatar, account role (Creator, Designer, or Admin), and password hash.
• Thumbnail Request Data: Video working titles, conceptual outlines, target audiences, visual hook descriptions, and raw assets (subject cutouts, screenshots, background references).
• Billing & Transaction Data: Subscription tier, credit balance, transaction IDs, payment statuses, and invoice records. Full payment card details are collected directly by our PCI-compliant payment gateways (Razorpay / Stripe) and are never stored on our servers.
• Technical & Usage Telemetry: Log timestamps, browser device headers, and session tokens necessary for authenticated dashboard security.

02. Google OAuth & YouTube Data

If you choose to authenticate via Google OAuth or connect your YouTube channel for CTR performance telemetry:

• Google Authentication: We receive your Google profile email, verified email status, name, and profile picture to create and authenticate your account without requiring manual email verification.
• Minimal Read-Only Scopes: We request strictly read-only permissions (youtube.readonly, yt-analytics.readonly). We never request upload, delete, comment, or channel management write permissions.
• Synchronized Metrics: We retrieve public channel title, handle, subscriber count, video metadata (IDs, titles, publish dates), and YouTube Analytics metrics (impressions, views, watch time, impressions CTR) solely to compute your pre-studio baseline CTR and evaluate CTR Lift performance.
• Token Encryption: OAuth access tokens and refresh tokens are encrypted using AES-256-GCM before database persistence and are never exposed to client-side bundles.
• Disconnection & Revocation: You can disconnect your YouTube channel at any time via your dashboard or revoke access in your Google Account Security settings.

03. How We Use Your Information

We use the collected information exclusively to:

• Authenticate your account and maintain session integrity.
• Process your thumbnail design requests and deliver high-resolution variants.
• Manage your monthly subscription credits, on-demand add-ons, and payment history.
• Send critical transactional communications (order delivery notifications, revision updates, verification links, and billing receipts) via our verified email provider (Resend).
• Calculate CTR Lift benchmarks and display your performance telemetry.
• Enforce tenant isolation so no other creator can view your private thumbnail briefs or channel data.

04. Payment Processing (Razorpay & Stripe)

All financial transactions on AI Thumbnail Studio are processed through authorized, PCI-DSS Level 1 certified payment gateways:

• Domestic (INR): Razorpay Software Private Limited.
• International (USD): Stripe, Inc.

Payment transactions are authenticated server-side with HMAC-SHA256 cryptographic signatures. We never store credit card numbers, CVV codes, or banking PINs.

05. Asset Storage & Cloud Infrastructure

Your creative assets (source images, subject cutouts, PSD project files, and final exports) are stored in private Cloudflare R2 object storage buckets:

• Uploads and downloads utilize time-bounded, cryptographically signed presigned URLs.
• Raw assets and working concepts are strictly confidential and restricted to assigned studio production designers and quality-review administrators.

06. Third-Party Service Providers

We work with trusted infrastructure providers who adhere to strict data security standards:

07. Cookies & Session Management

We use strictly necessary HTTP-only, secure session cookies to keep you signed in to your creator portal. We do not use intrusive third-party cross-site advertising trackers.

08. Data Retention & Your Rights

You have the right to access, export, or delete your account information:

• Account Deletion: You may request permanent deletion of your profile, thumbnail requests, and uploaded assets by contacting support.
• Data Retention: We retain active project records and invoice history as required for accounting compliance and ongoing subscription fulfillment.