Privacy Policy

The controller of the personal data processed in EdThumb is Infowan Soluções em TI Ltda., CNPJ 53.269.689/0001-10, located at Rua Alceu Amoroso Lima, 668, Sala 1610, Edifício America Towers, Caminho das Árvores, Salvador, BA, ZIP 41820-770, Brazil ("Infowan", "we", "us"), website www.infowan.com.br. Contact: support@edthumb.com.

• Account data: name, email, password (stored encrypted, when used) and preferences.
• Sign in with Google: name, email, profile picture and Google account ID, provided by Google when you choose to sign in with it.
• Photos of people (characters): face photos you upload to create characters. We treat this data as sensitive (see section 5).
• Content you create: generated and edited images, versions, editor selections, requests (prompts), titles and text you write, and A/B test results you record.
• Public YouTube channel data: name, ID, image, public statistics and thumbnails of the channel you link, plus the references you choose.
• Payment data: processed by Stripe. We only receive information such as subscription status, plan, amounts and the card's last digits and brand; we do not store the full card number.
• Usage and credits: EdCoin usage records, operations performed, date and time, IP address, browser and device type, and technical logs needed for security and operation.
• Support: messages and attachments you send to our support team.
• Sign-up source: where your first visit to the website came from (campaign parameters such as utm_source, referring site, first page visited, country estimated from the IP and browser language), stored with your account when you sign up.
• Website browsing, if you accept analytics cookies: pages viewed, clicks and events (such as starting a sign-up or a purchase), device type and approximate location, through Google Analytics and Microsoft Clarity (section 12).

• to create and maintain your account and authenticate your access (including through the ChatGPT plugin);
• to generate and edit thumbnails with your characters and your channel's visual identity;
• to analyze reference thumbnails and A/B test results to personalize future suggestions for your account;
• to process payments, manage EdCoins and issue receipts;
• to provide support and send service communications (account, security and billing notices);
• to prevent fraud and abuse, keep the service secure and comply with legal obligations;
• to understand aggregate product usage in order to improve it;
• to measure which marketing channels bring sign-ups and subscriptions (sign-up source and, with your consent, analytics cookies).

We do not sell your personal data. We do not use your face photos to train our own AI models or for any purpose other than generating your images.

• Performance of a contract (LGPD art. 7, V): account, image generation, EdCoins, payments and support.
• Consent (art. 7, I and art. 11, I): face photos used for characters, analytics cookies (Google Analytics and Microsoft Clarity) and optional marketing communications.
• Compliance with a legal obligation (art. 7, II): access logs required by the Brazilian Internet Civil Framework (Marco Civil da Internet), tax and accounting data.
• Legitimate interest (art. 7, IX): security, fraud prevention, product improvement and recording the sign-up source (minimal data, used only by us and in aggregate), always respecting your rights and expectations.
• Regular exercise of rights (art. 7, VI): defense in legal proceedings and complaints.

Face photos can identify people and are treated as sensitive personal data. Therefore:

• we only use them with your explicit consent, given when you upload them, and only to generate the images you request;
• you must have permission from the person pictured to upload photos of others, and you are responsible for obtaining it;
• photos of children and teenagers may only be uploaded with the specific consent of at least one parent or legal guardian;
• photos are sent to the image generation provider only at the time of generation;
• you can withdraw your consent at any time by deleting the character in the dashboard or asking support.

We only share data with providers (processors) needed to deliver the service, under contracts that require confidentiality and security:

• OpenAI: image generation (GPT Image) and text and image analysis (such as the channel's visual identity), receiving the requests, text, reference images and character photos needed for each generation. Under OpenAI's API policy, this data is not used to train its models and may be retained for up to 30 days for abuse monitoring;
• Google / YouTube Data API: sign in with Google and reading public data of the linked channel;
• Stripe: payment and subscription processing;
• Vercel: hosting of the website and web app;
• Hostinger: server (VPS) for our API;
• Supabase (self-hosted instance on our infrastructure): authentication and database;
• Cloudflare R2: image storage;
• Backblaze B2: backups;
• Google Analytics and Microsoft Clarity: website usage statistics and anonymized session recordings, only if you accept analytics cookies.

We may also share data when required by law or by order of a competent authority, or in a corporate reorganization, keeping the safeguards of this policy. When you use the plugin, OpenAI also receives the content of your ChatGPT conversation as the provider of ChatGPT (see section 8).

Some processors (OpenAI, Google, Microsoft, Stripe, Vercel, Cloudflare and Backblaze) process data outside Brazil, mainly in the United States. These transfers follow LGPD art. 33 and the International Data Transfer Regulation of the Brazilian Data Protection Authority (ANPD Resolution CD/ANPD No. 19/2024):

• when needed to perform our contract with you or fulfill your request, such as generating an image or processing a payment (art. 33, IX, together with art. 7, V);
• based on data protection contractual clauses signed with each provider, adopting the standard clauses approved by the ANPD where applicable (art. 33, II, "b").

We send each provider only the data needed for the task and require security measures consistent with this policy. You can ask for more information about these safeguards through the DPO contact.

• Connection: you authorize ChatGPT to access your EdThumb account through OAuth, by signing in on our sign-in page. We do not receive your OpenAI password and OpenAI does not receive your EdThumb password.
• What we receive: the requests ChatGPT forwards to EdThumb to do what you asked (for example, the thumbnail topic, the style, the desired adjustment and images you attach for that purpose).
• What we do not receive: your ChatGPT conversation history or messages that are not sent to EdThumb.
• What ChatGPT sees: EdThumb's responses to that request, such as the generated thumbnail, the variations and the editor shown next to the chat.
• Processing by OpenAI: conversation content is processed by OpenAI under its own policies, for which Infowan is not the controller.
• Disconnecting: you can revoke access at any time in ChatGPT's connected apps settings or by asking support. See the steps in Support.

We use the YouTube API Services to read public data of the channel you link. This use is also subject to the Google Privacy Policy. You can unlink the channel in the dashboard and revoke EdThumb's access to your Google account at myaccount.google.com/permissions.

• Account data: while the account is active. After a deletion request, we delete or anonymize it within 30 days, keeping only what the law requires, for the periods below.
• Photos, characters and generated images: until you delete them. If you delete your account, we delete them within 30 days.
• Application access logs (IP, date and time): 6 months, as required by article 15 of the Brazilian Internet Civil Framework.
• Backups: up to 60 days. Deleted data leaves the backups when the copy expires and is not restored for any other purpose.
• Payment data, invoices and EdCoin history: 5 years after the transaction, as required by Brazilian tax law and for defense in consumer claims.
• Support messages and data subject requests: 5 years, to prove they were handled.
• Website analytics data: 14 months in Google Analytics and up to 13 months in Microsoft Clarity; the sign-up source stays with the account and is deleted along with it.

After these periods, data is deleted or anonymized so that it can no longer identify you.

Under article 18 of the LGPD, you can request at any time:

• confirmation that we process your data and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary data or data processed in breach of the law;
• portability of your data to another provider;
• deletion of data processed based on consent;
• information about who we share your data with;
• information about the possibility of not consenting and its consequences;
• withdrawal of consent;
• review of decisions made solely based on automated processing.

To exercise your rights, write to support@edthumb.com from your account email. We may ask you to confirm your identity. Simplified confirmation and access requests are answered immediately; the full statement within 15 days (LGPD art. 19). Other requests are handled as quickly as possible, and we will tell you if there is a legal reason not to fulfill any of them. You can also file a complaint with the Brazilian Data Protection Authority (ANPD) at gov.br/anpd or with the data protection authority of the country where you live.

Essential (always on, needed for the website to work):

• sign-in session (authentication cookies): keep you signed in and protect your account;
• language (edthumb_locale cookie, 1 year): remembers the website language;
• cookie choice (edthumb_consent local storage): remembers whether you accepted or declined analytics cookies;
• interface preferences (browser local storage, including the language chosen in the plugin): remember screen choices.

Visit source (first-party edthumb_attr cookie, 180 days): stores where your first visit came from (campaign, referring site, first page, country and language) so we know which promotions bring sign-ups. It is read only by EdThumb, does not identify you on other sites and is not shared with third parties.

Analytics (only with your consent, through the notice shown on your first visit):

• Google Analytics (_ga and _ga_* cookies, up to 13 months): statistics on page views, visit sources and events such as sign-up and purchase. We use Google Consent Mode: without your consent, no analytics cookie is set;
• Microsoft Clarity (_clck and _clsk cookies, up to 1 year): heatmaps and session recordings with typed text masked, so we can find usability problems.

We do not use advertising pixels or sell browsing data. To change your choice, clear the site data in your browser (the notice will appear again) or write to support@edthumb.com.

We take technical and administrative measures to protect your data, such as encrypted connections (HTTPS), per-account access control, hashed passwords, restricted access keys and backups. No system is completely immune to failures; if an incident could create a relevant risk, we will notify you and the ANPD as required by law.

EdThumb is not intended for people under 18 without supervision. Minors may only use the service with the authorization and supervision of their legal guardian. Images of children and teenagers may only be uploaded with the specific consent of a parent or guardian, and always in the child's best interest. If we find data of minors processed without this consent, it will be deleted.

We may update this policy to reflect changes in the product or the law. The last updated date is at the top of the page, and material changes will be announced on the website or by email.

This is a translation of the Portuguese version, provided for your convenience. If there is any conflict between them, the Portuguese version (Política de Privacidade) prevails, to the extent permitted by law.

Data protection officer (LGPD art. 41): Infowan Soluções em TI Ltda., by email at support@edthumb.com (use the subject "Privacy"). Mailing address: Rua Alceu Amoroso Lima, 668, Sala 1610, Edifício America Towers, Caminho das Árvores, Salvador, BA, ZIP 41820-770, Brazil. Other questions: Support.