YouThumb AI Logo
LoginStart now

Privacy Policy

Who is responsible for your data

Last updated: October 5, 2026. YouThumb.ai is an AI-powered YouTube thumbnail creation service operated by MIKE MC FORMATIONS LLC, a New Mexico (USA) limited liability company, registered office at 1704 Llano St Ste B-1433, Santa Fe, NM 87505, USA. We are the controller of the data described here. This policy explains what data we process when you use the website, the app, the API or the MCP server, why, who we share it with, and how to exercise your rights. Questions: support@youthumb.ai.

Data we process

We process the data needed to run the service and the data you choose to add to it:

  • Account: your email address, name and profile picture. Your password is stored hashed, never in plain text. If you sign in with Google, we receive from Google the profile information needed to sign you in. If you enable two-factor authentication, we store the secret it relies on.
  • Organizations: organization name, logo and description, members and roles, and the email addresses of the people you invite.
  • Persons: the name, description and face photos of the "persons" you create to appear in your thumbnails. These are real faces: only add yourself or people who have agreed to it.
  • Content: the images you upload (references, logos, sketches, starting images), your prompts, presets, projects and favorites, and the generated images.
  • Credits and billing: your plan, subscription status, history of credits granted and used, and your Stripe customer ID. Card details are entered at Stripe and never pass through our servers.
  • API and MCP: the API keys you create (name, start of the key and technical details; the key itself is stored hashed), the applications you authorize through OAuth (Claude, ChatGPT, Codex or another MCP client), the organization chosen for each one, the access tokens issued to them, and your MCP settings (granted rights, daily credit limit).
  • Technical data: IP address and browser associated with your sessions, technical logs, error reports and audience measurement data about how the site is used.
  • Messages: what you send us through the contact form, the feedback button or by email.

Why we use it and who we share it with

We use this data to provide the service (performance of the contract), secure and improve it (legitimate interest), meet our legal and accounting obligations, and measure audience in line with cookie rules. We do not sell your data. Apart from legal obligations, only the providers listed here receive it, on our behalf and for the stated task:

  • Running your account, organizations, credits and subscription, and generating your thumbnails.
  • Sending service emails (address verification, sign-in links, password resets, invitations, notifications) and, when you sign up, adding you to our product updates list, which you can leave at any time.
  • Securing the service (rate limiting, abuse detection, error diagnosis) and answering support requests.
  • Understanding how the service is used in order to improve it.
  • Google (Gemini API) generates the images: it receives the prompts and images needed for each generation, including the face photos of the persons used.
  • Supabase hosts the database and image storage.
  • Stripe processes payments, subscriptions and invoices.
  • Resend sends service emails. AgentsMail manages the product updates list (email address and plan).
  • Inngest runs background tasks (generations, scheduled emails).
  • Vercel hosts the application.
  • PostHog and Google Analytics measure audience. Sentry collects error reports.
  • Google is also involved if you choose to sign in with your Google account.
  • Applications you connect through MCP or with an API key receive the data your rights open to them. They apply their own privacy policies.

Security and transfers outside the European Union

Traffic to YouThumb.ai is encrypted (HTTPS). Passwords and API keys are stored hashed, access tokens issued to MCP applications expire after 15 minutes, and you can enable two-factor authentication. Access to data is limited to the people who need it to run the service and provide support. Note: images are served through public links, so anyone who gets an image's link can view it; only share those links with people you choose. Several of our providers, including Google, Stripe, Vercel, PostHog, Sentry and Inngest, are based in the United States or process data there. These transfers rely on the safeguards provided by the GDPR, such as the European Commission's standard contractual clauses or the EU–US Data Privacy Framework, depending on the provider.

Retention and your rights

We keep your data while your account is active. You can delete your images, persons and projects from the app at any time. When your account is deleted, the data attached to it is erased, except what the law requires us to keep (invoices and accounting records in particular) for the legal period. You have the right to access, rectify, erase, restrict, object and to data portability (export of your data). You edit your profile from your Account page, revoke an MCP application in Account → MCP, delete an API key in Account → API Keys, and unsubscribe from product emails through the link in each of them. For anything else, including deleting your account or exporting your data, write to support@youthumb.ai: we reply within one month at most. You can also lodge a complaint with the data protection authority of your country (in France, the CNIL).

Cookies and changes to this policy

YouThumb.ai uses cookies required for the service to work (sign-in session, chosen language) and, for audience measurement, PostHog and Google Analytics cookies. Display preferences such as the theme are stored in your browser. You can block or delete cookies in your browser settings; without the required cookies, you will not be able to sign in. We may update this policy as the service or the law evolves: the date at the top of the page changes when we do, and we notify you by email of any significant change.