Privacy Policy

Last updated: April 3, 2026

MiniMagic ("we," "us," "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our website and services at minimagic.ai ("the Service").

1. Information We Collect

1.1 Information You Provide

Account information: Email address, display name
Payment information: Processed securely by Stripe. We do NOT store credit card numbers, CVVs, or full card details on our servers. Stripe handles all payment data under their PCI DSS Level 1 certification.
Content you create: Text prompts, generated images, generated 3D models, and any files you upload
Communications: Messages you send to our support team

1.2 Information Collected Automatically

Usage data: Pages visited, features used, generation history, credit transactions
Device information: Browser type, operating system, screen resolution
IP address: Used for security, rate limiting, and fraud prevention
Cookies: See Section 6 below

2. How We Use Your Information

Purpose	Data Used	Legal Basis
Provide and operate the Service	Account info, content, usage data	Contract performance
Process payments and manage billing	Email, payment info (via Stripe)	Contract performance
Improve and develop the Service	Usage data, generated content, prompts	Legitimate interest
Train and improve AI models	Prompts, generated images, 3D models	Legitimate interest / Consent
Marketing and promotional materials	Generated content (may be showcased)	Legitimate interest / Terms of Service
Security and fraud prevention	IP address, usage patterns, device info	Legitimate interest
Comply with legal obligations	As required by applicable law	Legal obligation
Respond to support requests	Email, account info, communications	Contract performance

3. Third-Party Services

We share data with the following third-party service providers who process data on our behalf:

Provider	Purpose	Data Shared
Supabase	Database, authentication, file storage	Account data, content, usage data
Stripe	Payment processing, billing	Email, payment details
Google (Gemini API)	AI image generation	Text prompts, reference images
Tripo3D	3D model generation	Images for 3D conversion
fal.ai	AI inference, image processing	Text prompts, images

Each provider has their own privacy policy governing their processing of your data. We encourage you to review their policies.

We do NOT sell your personal information to third parties.

4. Data Retention

Account data: Retained while your account is active. Deleted upon account deletion request, subject to legal retention requirements.
Generated content: Stored as long as your account is active. You may delete individual images and models at any time.
Payment records: Retained as required by tax and accounting regulations (typically 7 years).
Server logs: Retained for up to 90 days for security and debugging purposes.

5. Your Rights

5.1 All Users

Access: Request a copy of your personal data
Correction: Request correction of inaccurate data
Deletion: Request deletion of your account and personal data
Export: Download your generated content

5.2 California Residents (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act:

Right to know what personal information is collected and how it is used
Right to delete personal information
Right to opt-out of the "sale" of personal information (we do not sell personal information)
Right to non-discrimination for exercising your rights

5.3 European Residents (GDPR)

If you are in the European Economic Area, you have additional rights including:

Right to data portability
Right to restrict processing
Right to object to processing based on legitimate interest
Right to withdraw consent at any time
Right to lodge a complaint with your local data protection authority

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

6. Cookies

MiniMagic uses the following cookies and local storage:

Cookie/Storage	Type	Purpose
Supabase auth tokens	Essential	Keep you logged in
Stripe fraud prevention	Essential	Secure payment processing
Theme preference	Functional	Remember your display settings
Local generation history	Functional	Cache your work locally for faster access

We do not use third-party tracking or advertising cookies. All cookies used are essential or functional — no consent banner is required for these categories.

7. Security

We implement industry-standard security measures including:

HTTPS/TLS encryption for all data in transit
Supabase Row Level Security on all database tables
Server-side API key protection (no secrets in client code)
Stripe webhook signature verification
Per-IP rate limiting on all endpoints
Atomic credit operations to prevent manipulation

No system is 100% secure. If you discover a security vulnerability, please report it to [email protected].

8. Children's Privacy

MiniMagic is not directed at children under 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13, we will promptly delete it. If you believe a child under 13 has provided us with personal information, contact us at [email protected].

9. International Data Transfers

Your data may be processed in the United States and other countries where our service providers operate. By using the Service, you consent to the transfer of your data to these locations. We ensure appropriate safeguards are in place with our processors.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notice. The "Last updated" date at the top reflects the most recent revision.

11. Contact Us

For privacy-related inquiries:
[email protected]

MiniMagic
United States