This policy explains how AI Sprite Maker (“we”, “us”) handles personal data when you use aispritemaker.com, the web app, the free tools, the API and the MCP server. We are the controller of the personal data described here. Questions: hello@aispritemaker.com.
What we collect
Account data
Your email address, display name and, if you sign in with Google, GitHub or Discord, the profile name and avatar that provider shares with us. If you use a password, we store only a salted hash of it. We record your plan, credit balance and a ledger of credit grants and charges.
Content you submit
Prompts, style and size settings, reference images, uploaded videos and GIFs, and the sprites, sheets and files we generate from them. We also keep job records (type, status, credit cost, timestamps, error codes) so your history and billing are correct.
Payment data
Stripe processes payments. We receive your Stripe customer ID, subscription status, the country used for tax, the last four digits and brand of your card, and invoice records. We never receive or store full card numbers.
Technical data
When you use the Service our hosting provider, Cloudflare, processes your IP address, browser user agent and request details to deliver pages, stop abuse and enforce rate limits. For API and MCP calls we log the key ID (never the key itself), endpoint, status code and timing.
Analytics
We use Plausible Analytics to count page views and a few events (such as “started a generation”). Plausible does not use cookies, does not collect personal data and does not track you across sites. Visitor counts are derived from a daily-rotating hash that cannot be reversed to an IP address.
What the free tools do not collect
The tools under /tools (video to sprite sheet, GIF to sprite sheet, slicer, palette swapper and the rest) run entirely in your browser. The files you open in them never reach our servers.
Why we use it (legal bases)
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Create and run your account, generate sprites, store your history | Account data, content you submit | Performance of our contract with you |
| Take payment and calculate tax | Payment data | Contract; legal obligation (tax records) |
| Prevent abuse, fraud and free-credit farming; enforce rate limits; moderate content | Technical data, content you submit | Legitimate interest in keeping the Service safe and fair |
| Understand which pages and tools are used | Plausible aggregate analytics | Legitimate interest; no personal data involved |
| Service emails (receipts, job failures, security notices, policy changes) | Email address | Contract; legitimate interest |
| Product news emails | Email address | Consent. You can opt out from any email or in Settings |
We do not sell or rent personal data, we do not share it for cross-context behavioural advertising, and we do not use your prompts, uploads or outputs to train AI models.
Cookies
We set only the cookies needed for the Service to work:
| Cookie | Purpose | Lifetime |
|---|---|---|
Session cookie (better-auth.session_token or similar) | Keeps you signed in | Up to 30 days, or until you sign out |
| Short-lived auth cookies | Protect the sign-in and OAuth flow (state, CSRF) | Minutes |
Cloudflare security cookies (for example __cf_bm, Turnstile) | Bot and abuse protection | Up to 30 minutes / session |
We also store your language and a few UI preferences (such as your preferred code-sample language in the docs) in your browser’s local storage. These never leave your device.
Stripe sets its own cookies on its checkout and customer-portal pages to process payment and prevent fraud; see Stripe’s cookie policy. We use no advertising or cross-site tracking cookies, which is why we don’t show a cookie banner.
Sub-processors
These companies process personal data on our behalf, only to provide the Service:
| Provider | What they do for us | Data involved |
|---|---|---|
| Cloudflare, Inc. | Hosting and CDN (Workers), database (D1), file storage (R2), bot protection (Turnstile), and some AI inference through Cloudflare Workers AI | All data stored by the Service; technical data; prompts and images for jobs run on Workers AI |
| Stripe, Inc. and affiliates | Payments, subscriptions, invoices and tax calculation (Stripe Tax) | Payment data, email, billing country and address |
| Plausible Insights OÜ (EU) | Privacy-friendly website analytics | Aggregated, non-personal page-view data |
| MiniMax | AI video generation used for custom motions and animation | Prompts, reference or character images for that job |
| Alibaba Cloud (Model Studio, international) | AI image and video generation | Prompts, reference or character images for that job |
| Google LLC (Gemini API) | AI image generation and editing | Prompts, reference or character images for that job |
| Black Forest Labs, Inc. (FLUX API) | AI image generation and editing | Prompts, reference or character images for that job |
| Resend (transactional email) | Sending sign-in links, receipts and service emails | Email address, email content |
How AI providers are used. For each job we send only what the model needs: your prompt, chosen settings, and the relevant reference, character or motion frames. We do not send your email address or account details. We use providers through their paid business APIs, on terms under which they may not use your content to train their models, and we route jobs between them for quality, speed and cost, so a single job may use more than one provider. Outputs are stored in our own storage on Cloudflare R2, not with the providers, beyond any short-lived processing retention the provider requires to operate or to detect abuse.
We will update this list before adding a new sub-processor that handles personal data.
International transfers
We and our providers operate in several countries, including the United States, the European Union and Singapore, so your data may be processed outside the country where you live. Where data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses (and the UK addendum) or an equivalent safeguard offered by the provider.
How long we keep data
| Data | Kept for |
|---|---|
| Outputs on the Free plan | 30 days after the job finishes, then deleted |
| Outputs on Starter, Pro and Studio | For as long as your subscription is active |
| Outputs after a paid plan ends | 60 more days, then the Free-plan 30-day rule applies |
| Uploaded reference images, videos and intermediate working files | Deleted automatically 14 days after the job finishes |
| Characters and motions you saved for reuse | Until you delete them or your account |
| Public gallery items | Until you unpublish them or delete your account |
| Job records and credit ledger | For the life of your account |
| Payment and invoice records | As long as tax law requires, typically up to 10 years |
| Request logs and API logs | Up to 30 days |
| Account data | Until you delete your account |
When you delete your account we delete your profile, outputs, uploads, saved characters and API keys within 30 days, and remove them from backups within a further 30 days. We keep invoice records where the law requires it, and a hashed form of your email for up to 12 months only to stop repeated free-credit abuse.
Your rights
Depending on where you live (for example under the GDPR, the UK GDPR, or US state laws such as the CCPA/CPRA) you have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to withdraw consent. You can do most of this yourself:
- Download your sprites from the dashboard at any time.
- Correct your name or language in Settings.
- Export your account data, delete your account, or anything else: email hello@aispritemaker.com from the address on your account. We reply within 30 days. See how to delete your account.
You will not be treated differently for exercising your rights. If you are in the EEA or UK and believe we have not handled your data properly, you can complain to your local data protection authority, though we would appreciate the chance to fix it first.
Security
Traffic is encrypted with TLS. Passwords are hashed. API keys are stored only as SHA-256 hashes and shown once when created. Private files are served through short-lived signed URLs. Access to production systems is limited to the people who run the Service.
Children
The Service is not directed at children under 13 (16 in the EEA and UK). We do not knowingly collect their data. If you believe a child has created an account, email us and we will delete it.
Changes
If we change this policy in a way that matters, we will email account holders and show a notice in the app before the change takes effect. The effective date at the top shows the current version.
Contact
AI Sprite Maker · hello@aispritemaker.com