プライバシーポリシー

This Privacy Policy explains how YDuck Labs LLC, NM 87110, USA (“we”, “us”), the operator of MakeSame, collects, uses and protects your personal information. We are the controller of your personal data for the purposes of data protection laws such as the GDPR. For any privacy question or request, contact support@makesame.com.

1. Information we collect

Account data: email address, display name, language preference and a securely hashed password. If you turn on two-step verification, an encrypted authenticator secret and backup codes.
Sign in with Google: if you choose it, Google shares your Google account's email address and whether it is verified, your name and an account identifier. We don't receive your Google password or contacts, and we don't keep your profile picture.
Photos and text you submit, and the images we generate for you.
Billing records: orders, amounts, taxes, payment status, credit history and membership status. Card and bank details are collected by our payment providers; we never receive or store your full card number.
Technical and security data: IP address, browser and device information for signed-in sessions, and server logs. We use this to keep your account secure, prevent fraud and abuse, and fix problems.
Usage events: basic records such as a generation starting or finishing, or a checkout being started. These don't include your photos. When you arrive from another website, we also record that site's domain, any campaign tags in the link (such as utm_source) and the page you landed on.
Sign-up source: if you create an account during that same visit, we save that source (referring domain, campaign tags and landing page) with your account, so we can tell which websites and ad campaigns bring customers. We keep it only in the open page's memory until you sign up, never in cookies or other browser storage, and we don't send it, or any information about you, to advertising platforms.
Messages you send us, for example support emails.

2. How we use it, and our legal bases

To provide the Service you signed up for: running your account, processing your photos, delivering results, handling credits, payments and memberships, and sending account and payment emails. Legal basis: performance of our contract with you.
To keep the Service safe: automated content review, bot protection, rate limits, fraud and abuse prevention, and security monitoring. Legal basis: our legitimate interests in protecting users and the Service.
To understand and improve the Service using aggregated usage events, and to measure which websites and ad campaigns bring customers using the sign-up source. Legal basis: our legitimate interests. You can object at any time by emailing us, and we will remove the sign-up source from your account.
To meet legal obligations, such as keeping tax and accounting records and responding to lawful requests. Legal basis: legal obligation.

We don't sell your personal information, don't share it for cross-context behavioural advertising, and don't make decisions with legal or similarly significant effects about you based solely on automated processing.

3. Your photos

We use your photos only to produce the results you request. They are sent to our AI image provider (OpenAI) for processing. OpenAI states that it does not use data sent through its API to train its models by default. It keeps abuse-monitoring logs for up to 30 days, unless a longer period is required by law or reasonably necessary to protect its services or others from harm; images flagged as possible child sexual abuse material may be kept for manual review. See OpenAI's data controls.
We remove location and other embedded metadata from uploads.
We don't use your photos or results as marketing examples or to train AI models.
Your uploads and results are private to your account. Download links are short-lived and only work for you.

4. Content review

Before a photo or text is processed, an automated safety check (OpenAI's moderation service) looks for content that breaks our Terms. If something is rejected, we don't store it; we only keep a record of the rule category, the time and a fingerprint (hash) of the image to prevent repeated abuse.

5. How long we keep data

Uploaded photos are deleted automatically 30 days after upload, with one exception: while a generation that uses the photo is still waiting, running, or under review because we couldn't confirm whether it finished, we keep the photo so the generation can be completed or retried without charging you again. It is deleted as soon as that generation is finished or reviewed (if the 30 days have passed by then), or within 24 hours if you delete the creation or your account.
Generated results are deleted automatically 90 days after they are created.
When you delete a creation, its result and the photo you uploaded for it are removed from storage within 24 hours. If you used the same photo in another creation you haven't deleted, the photo is kept for that creation until it is deleted or reaches the 30-day limit (subject to the exception above).
When you delete your account, your profile is anonymised and your sessions, password and any linked Google sign-in are removed immediately; all your photos and results, including any for generations still under review, are removed from storage within 24 hours.
Orders, payment and credit records are kept for as long as tax and accounting laws require (generally up to 7 years), linked only to the anonymised account after deletion.
Security records (such as session and content-review records) are kept only as long as needed for security and abuse prevention.

6. Service providers

We share personal information only with providers that help us run the Service and process it on our behalf under contract:

Hosting: our cloud server provider (servers in the United States) — runs the website and database.
Cloudflare, Inc. (United States, global network) — content delivery, DNS, security, bot protection (Turnstile), and storage of uploaded photos and results (Cloudflare R2).
OpenAI (United States) — AI image generation and content moderation.
Purelymail (United States) — email delivery and our support mailbox.
Google LLC (United States) — “Continue with Google” sign-in, only if you choose it. Google handles that sign-in under the Google Privacy Policy.

Payments: card payments are handled by Stripe, Inc. (United States). For billing addresses in mainland China, we are the seller and Stripe processes the payment on our behalf (Stripe privacy policy). For other regions, the purchase is sold through Link, Stripe's reseller service: Link acts as the seller of record, calculates and collects sales tax or VAT, handles payment support and refunds it is asked to make, and processes your payment and billing details as an independent controller under the Link privacy policy. If another payment provider is offered at checkout, it collects payment, billing and tax details under its own privacy policy. In every case we send only the account email and the order information needed to create the checkout, and receive customer and transaction identifiers, amounts, taxes, currency and payment status for our billing records. We do not send uploaded photos, generated images or generation text to payment providers. The checkout page shows who you are paying before you submit payment details.

We may also disclose information if required by law, to protect the rights and safety of our users or others, or as part of a merger, acquisition or sale of the business (in which case this policy will continue to apply to your information).

7. International transfers

We are based in the United States, and your information is processed in the United States and other countries where our providers operate. When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland, we rely on safeguards such as the European Commission's Standard Contractual Clauses or the provider's certification under the EU-U.S. Data Privacy Framework.

8. Security

We protect your information with encryption in transit (HTTPS), hashed passwords, encrypted secrets, private storage with short-lived access links, access controls and two-step verification for administrators. No system is completely secure, but we work to protect your data and will notify you and the authorities of a data breach where the law requires.

9. Your rights

You can download a copy of your data and delete your account yourself under Account → Settings. Depending on where you live, you may also have the right to:

access, correct or delete your personal information, and receive it in a portable format;
object to or restrict our processing based on legitimate interests;
withdraw consent where we rely on it;
know what personal information we collect and how we use and disclose it, and not be discriminated against for exercising your rights (for example, under California and other U.S. state laws);
lodge a complaint with your local data protection authority.

To exercise these rights, email support@makesame.com from the address on your account. We may need to verify your identity, and we will respond within the time required by law (generally one month). You may use an authorised agent where the law allows.

10. Children

The Service is not intended for anyone under 16. We don't knowingly collect personal information from children under 16. If you believe a child has given us personal information, contact us and we will delete it.

11. Bot protection

To stop automated sign-ups and password-guessing, our sign-up, sign-in and password-reset forms use Cloudflare Turnstile. It checks technical signals from your browser and device (such as IP address and browser characteristics) to tell people from bots. Cloudflare processes this data on our behalf and does not use it for advertising.

12. Cookies

We only use cookies that are necessary for the site to work: a sign-in session cookie and a cookie that remembers your language. We don't use advertising or third-party tracking cookies, and we measure where visits and sign-ups come from without cookies or other browser storage (see section 1), so no cookie consent banner is shown. Our payment and security providers may set their own strictly necessary cookies on their checkout and verification pages. If this changes, we will ask for your consent first where required.

13. Changes to this policy

We may update this policy. The date at the top shows when it was last changed. For material changes, we will notify you by email or on the Service before they take effect.

14. Contact

YDuck Labs LLC, NM 87110, USA
support@makesame.com