Privacy Policy

The controller of your personal data is [to be filled], EDRPOU [to be filled], address: [to be filled]. For any privacy question, write to [to be filled] or support@4thumb.com.

• Account data: name, email address, password (stored only as a hash) and — if you sign in with Google — the name, email and profile picture provided by Google.
• Content you upload: face photos for identity profiles, reference thumbnails, your existing thumbnails, logos, editor images and support attachments. EXIF metadata, including location, is removed on upload.
• Content you create: prompts, video titles and descriptions, thumbnail texts, generation settings, generated images, editor documents and versions.
• Payment data: amount, currency, status, date, order reference and data returned by WayForPay, such as a masked card number (for example 41****8217) and the payment method. We never receive or store the full card number, the expiry date or the CVV.
• Usage and technical data: IP address and browser user agent (for security, sessions and rate limiting), logs of actions, errors and generation statuses.
• Analytics: first-party product events (for example, that a generation started or a page was viewed) without images, names or email addresses; for visitors who aren’t signed in — only with consent.
• Communications: support tickets, contact-form messages and your email preferences.

• You upload face photos only of yourself or with the explicit permission of the person shown, and you confirm this for every upload.
• Photos are used only as references for generations you start. We don’t use them to identify people, build biometric templates or train AI models.
• You can delete single photos or the whole identity profile at any time; the files are then deleted from storage. Images you have already generated stay in your projects until you delete them.

We share data only with providers that help us run Thumbora, and only as far as necessary:

• reAPI (reapi.ai) — the AI gateway that passes prompts and input images (through short-lived links) to Google’s Gemini image models (Nano Banana) and returns the results;
• Google — the image models that generate results, and Google sign-in if you use it;
• WayForPay — payment processing; card details are entered on WayForPay’s page and processed by WayForPay;
• an S3-compatible object storage provider — storage of uploaded and generated files;
• hosting, email delivery and error-monitoring providers — running the Service, sending emails and diagnosing failures.

These providers process data under their own terms and privacy policies, and some of them may process it outside Ukraine and the EU. Where required, we use appropriate safeguards for such transfers. We don’t sell personal data and don’t use advertising trackers.

• Account data and content — while your account exists. Files you delete are removed from storage shortly after deletion; backups may keep them for a limited time.
• When you delete your account, your profile is anonymized and your files are deleted. Payment records and the credit ledger are kept for the period required by accounting and tax law.
• Technical logs are kept for a limited period needed for security and troubleshooting.
• Support correspondence is kept as long as needed to handle the request and resolve possible disputes.

We use encrypted connections (HTTPS), private storage that is accessible only through short-lived signed links, hashed passwords, role-based access for staff and logging of administrative actions. No system is perfectly secure, but we work to protect your data and will notify you and the regulator of a breach where the law requires it.

You have the right to:

• access the data we hold about you and get a copy of it;
• correct inaccurate data;
• delete data or your whole account;
• restrict or object to processing;
• receive your data in a portable format;
• withdraw consent at any time (for face photos, analytics, product emails) without affecting earlier processing;
• lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights or with the data protection authority of your country.

To exercise your rights, write to support@4thumb.com from the email address linked to your account. We reply within 30 days.

We use essential cookies and, with your consent, first-party analytics. Details are in the Cookie Policy.

The Service is not intended for children under 16. If you believe a child has given us personal data, contact us and we will delete it.

We may update this Policy. We will publish the new version on this page and notify you of material changes by email or in the Service.