Privacy Policy

Last updated: 17 July 2026

This policy explains how we process your personal data when you use ThumbnailsMaker and what rights you have under the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). We process personal data only in accordance with these laws.

1. Controller

The controller responsible for data processing is Alexa Wagner, operating ThumbnailsMaker as a sole proprietorship. Contact: support@thumbnailsmaker.com. Full details are in the Imprint. Given the nature and scale of our processing, we are not required to appoint a Data Protection Officer; you can reach us directly for any privacy matter.

2. Data we process, purposes and legal bases

Account data

When you register we process your name, email address and an encrypted password. Purpose: to create and manage your account and provide the Service. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

Billing data

For paid plans, payment is handled by our payment provider (Stripe). We receive confirmation and subscription status but do not store full card numbers. Purpose: to process payments and manage subscriptions. Legal basis: performance of the contract (Art. 6(1)(b)) and compliance with legal retention obligations (Art. 6(1)(c)).

Your content and AI processing

To produce thumbnails we process the brief text and the image and video assets you supply. Parts of this processing are carried out by specialised sub-processors — image composition and background handling via a model hosting provider (Replicate), and text assistance via an AI provider (Anthropic). These providers process your content on our behalf solely to return the requested output and do not use it to train their models for their own purposes. Purpose: to provide the core Service. Legal basis: performance of the contract (Art. 6(1)(b)).

YouTube and Google data

If you connect a YouTube channel, we process the data you authorise via Google/YouTube APIs — including channel identifiers and, where you publish, the thumbnail and associated video reference. Purpose: to publish thumbnails and provide the connected features you use. Legal basis: performance of the contract (Art. 6(1)(b)). See section 6 for the specific YouTube API terms.

Usage, log and device data

When you use the Service, our systems automatically process technical data such as IP address, browser and device type, and interaction logs. Purpose: to operate the Service securely, prevent abuse and diagnose faults. Legal basis: our legitimate interest in a secure, functioning service (Art. 6(1)(f)).

Communications

If you contact us, we process the content of your message and your contact details to handle your request. Legal basis: performance of the contract or our legitimate interest in responding (Art. 6(1)(b)/(f)).

3. Cookies and similar technologies

We use cookies and comparable storage that are strictly necessary to operate the Service (for example to keep you signed in). These do not require consent; the legal basis is § 25(2) TDDDG together with our legitimate interest (Art. 6(1)(f) GDPR). We do not use advertising or cross-site tracking cookies. Should we ever introduce optional analytics, we will ask for your consent first (§ 25(1) TDDDG, Art. 6(1)(a) GDPR), which you can withdraw at any time. You can also manage cookies through your browser settings.

4. Recipients and processors

We share personal data only where necessary, and with processors bound by data-processing agreements under Art. 28 GDPR. Our main processors are:

  • Supabase — database, authentication and file storage (hosted in the EU);
  • Render — application hosting (hosted in the EU);
  • Stripe — payment processing;
  • Resend — delivery of transactional email;
  • Google / YouTube — the connected-channel and publishing features you use;
  • Replicate and Anthropic — the thumbnail composition and text-assistance processing described above.

We do not sell your personal data. We may disclose data to public authorities where we are legally required to do so, and, in the event of a business transfer, to a successor bound by this policy.

5. International transfers

Our core data (database, storage and hosting) is held on servers in the European Union. Some sub-processors — in particular payment, email delivery and the YouTube/AI processing — may process data in countries outside the EU/EEA, including the United States. Where that happens, the transfer is safeguarded by the European Commission’s Standard Contractual Clauses and/or the provider’s certification under the EU-US Data Privacy Framework, so that an adequate level of protection is ensured.

6. YouTube API Services

ThumbnailsMaker uses YouTube API Services. By using the connected features you agree to the YouTube Terms of Service, and our use of information received from those APIs complies with the YouTube API Services Terms and the Google API Services User Data Policy, including its Limited Use requirements. You can review and revoke our access to your Google/YouTube data at any time via the Google Account permissions page. Data obtained through these APIs is used only to provide the features you request and is refreshed or deleted in line with YouTube’s requirements.

7. Retention and deletion

We keep personal data only as long as necessary for the purposes above or as required by statutory retention periods (for example, tax and commercial law obligations for billing records). You can delete your account, and thereby its associated stored data, from your account settings, or request deletion by emailing support@thumbnailsmaker.com. We process deletion requests without undue delay and within 30 days at the latest, except where we are legally required to retain certain data. Where you revoke the YouTube connection, data previously retrieved under that authorisation is deleted within 30 days.

8. Your rights

Under the GDPR you have the right to:

  • access your personal data (Art. 15);
  • rectification of inaccurate data (Art. 16);
  • erasure (Art. 17) and restriction of processing (Art. 18);
  • data portability (Art. 20);
  • object to processing based on our legitimate interests (Art. 21); and
  • withdraw consent at any time with effect for the future, where processing is based on consent (Art. 7(3)).

To exercise these rights, contact us at support@thumbnailsmaker.com. You also have the right to lodge a complaint with a supervisory authority — for us, this is Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit in Bayern.

9. Data security

We implement appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access, including encryption in transit and access controls. No method of transmission or storage is completely secure, but we continually review our safeguards.

10. Changes to this policy

We may update this policy to reflect changes to the Service or the law. We will publish the current version here and communicate material changes by email or within the Service.

11. Contact

For any question about this policy or your data, contact us at support@thumbnailsmaker.com.