Privacy Policy

Last updated: 2026-07-01

Who we are

FatThumb is an AI YouTube-thumbnail generator. The data controller is Claydex Consulting Partners LLC, a United States limited liability company doing business as FatThumb ("we", "us", "FatThumb"). Our registered business address is 2719 Hollywood Blvd., Hollywood, FL 33020, United States. For any privacy question or to exercise your rights, contact us at contact@fatthumb.klaas.pro.

We are based in the United States and offer the Service to users worldwide, including the EU/EEA and the UK. This policy therefore covers your rights under the EU General Data Protection Regulation (GDPR) and UK GDPR, which apply to our processing of EU/UK residents' data.

This policy explains what personal data we process, why, on what legal basis, how long we keep it, who we share it with, and the rights you have under the GDPR and UK GDPR.

The data we process

  • Account data — your email, name, and authentication identifiers (via magic link, password, GitHub, or Google).
  • Biometric data (special category, GDPR Art. 9) — the face photos you upload to create a "Person" profile, and the AI-generated descriptions and face-consistency signals derived from them. This is the most sensitive data we process and is handled only with your explicit consent (see below).
  • Content you create — your prompts, "inspiration" reference images and their AI style analysis, chosen templates, and the thumbnails we generate for you.
  • Billing data — your plan, credit balance, and transaction history. Card details are handled by Stripe; we never see or store your full card number.
  • Usage and technical data — basic product analytics, error reports, and security signals (e.g. a coarse signup fingerprint to prevent abuse).
PurposeLegal basis (GDPR)
Process your face photos to generate face-consistent thumbnailsExplicit consent — Art. 9(2)(a). You give this when you create a Person, and can withdraw it at any time.
Provide the service (generate thumbnails, manage your account)Performance of a contract — Art. 6(1)(b)
Billing, fraud prevention, and securing the platformLegitimate interests — Art. 6(1)(f)
Keep accounting/transaction recordsLegal obligation — Art. 6(1)(c)
Product analytics (where enabled)Consent / legitimate interests

Face photos are biometric data. We process them only after you give explicit, specific, informed consent at the point you upload them, and we record the consent (version + timestamp) server-side. You can:

  • Withdraw consent for a Person at any time (a "Withdraw consent" action on the Persons page). After withdrawal we no longer use that face to generate, and you can delete the photos.
  • Delete a Person, which permanently erases its face photos from our storage.

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

How long we keep it

We keep your data for as long as your account is active. When you delete a Person, its face photos are purged from storage. When you use "Delete all my data" (Settings → Danger zone), we erase all your persons, face photos, images, inspirations, generations, and thumbnails — from both our database and our object storage. Transaction/accounting records are retained where we are legally required to keep them (Art. 17(3)(b)).

Who we share it with (sub-processors)

We use a small set of vetted sub-processors to run the service (cloud database and storage, AI image/vision models, payments, email, analytics). The current list, their purpose, and their region are on our Sub-processors page.

International transfers

We are based in the United States, and our sub-processors (notably the AI model providers, object storage, and analytics) are also primarily based there. Where personal data of EU/EEA or UK residents is transferred to the United States, we rely on appropriate safeguards such as the EU Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum. We do not send your raw face photos to any provider except as needed to generate your thumbnails at your request.

EU / UK representative (GDPR Art. 27)

We are established in the United States and offer the Service to people in the EU/EEA and the UK. EU/EEA and UK residents can raise any data-protection matter, including matters that would be directed to an Article 27 representative, by contacting us at contact@fatthumb.klaas.pro; we will respond and, where a representative is required, route your request accordingly.

Your rights

Under the GDPR and UK GDPR you have the right to: access your data; rectify it; erase it; restrict or object to processing; data portability; and withdraw consent at any time. You can exercise the main rights yourself in Settings → Danger zone ("Export my data" and "Delete all my data") or by emailing contact@fatthumb.klaas.pro. You also have the right to lodge a complaint with your local supervisory authority: for EU/EEA residents, your national data protection authority; for UK residents, the Information Commissioner's Office (ICO) (ico.org.uk).

If you are a California resident, you may also have rights under the California Consumer Privacy Act (CCPA/CPRA), including the right to know what personal information we collect, to request its deletion, and to opt out of any "sale" or "sharing" of personal information. We do not sell or share your personal information, and we do not use your biometric face data for advertising. To exercise any of these rights, contact us at contact@fatthumb.klaas.pro.

Security

We encrypt data in transit, store generated outputs and uploads behind unguessable keys, keep provider API keys encrypted at rest, and keep the AI providers' safety filters on. No system is perfectly secure, but we work to protect your data.

Cookies and tracking

We use strictly necessary cookies to keep you signed in and to secure the Service (authentication, session management, and fraud prevention). Where enabled, we use privacy-respecting product analytics (see our Sub-processors page) to understand how the Service is used and to improve it. You can control non-essential cookies through your browser settings; disabling strictly necessary cookies may break core functionality.

AI processing and model training

To generate your thumbnails, your prompts and the images you provide are sent to our third-party AI providers, whose safety filters remain enabled. We do not use your content — including your face photos — to train our own AI models, and we do not sell it. Our providers process your inputs only to return your requested output; their own use of data is governed by their policies, and we do not permit them to use your raw face photos for any purpose other than generating your thumbnails.

Children's privacy

The Service is intended only for adults aged 18 or older. We do not knowingly collect personal data from anyone under 18. If we learn that we have collected data from a minor, we will delete it promptly; if you believe a minor has provided us data, contact contact@fatthumb.klaas.pro.

Do Not Track and Global Privacy Control

We do not sell or share your personal information for cross-context behavioral advertising, and we do not use your biometric face data for advertising. Where your browser sends a "Do Not Track" or Global Privacy Control (GPC) signal, we treat it as a valid request to opt out of any such sharing.

Changes

We may update this policy. For material changes we will notify you by email or an in-app notice. The "last updated" date above reflects the current version.

Contact

Privacy questions or rights requests: contact@fatthumb.klaas.pro.