1. Who we are
Mascot Design (mascot-design.app) is operated by Flying Web Solutions, based in Ireland (“we”, “us”, “our”). We are the data controller for the personal data described in this policy. You can reach us at [email protected] for anything privacy-related.
This policy explains what data we collect when you use Mascot Design, why we collect it, who processes it on our behalf, and the rights you have under the EU General Data Protection Regulation (GDPR).
2. Data we collect
Account data
When you sign up, our authentication provider (Clerk) collects your email address, your name, and an optional profile picture. If you sign up through a social login, we receive the basic profile details that provider shares. We store an internal account identifier, your email, name, and avatar URL alongside your plan and role.
Onboarding survey
After signup we ask a short optional survey: what you are building, your role, the visual style you lean towards, and how you heard about us. We use this to tailor defaults and understand where users come from. You can skip it, and you can retake it later.
Billing data
Payments are handled by Stripe. At checkout Stripe collects your billing name and address (required) and your card details. Your full card number never touches our servers — we only store Stripe’s customer and subscription identifiers, and we display back the card metadata Stripe shares with us (brand, last four digits, expiry). We also keep a credit ledger — an append-only record of credit grants, purchases, and spends — for billing accuracy and accounting.
Content you create
We store the prompts and settings you enter, reference images you upload, the character specs derived from them, and the mascots, images, and animation clips you generate. Generation jobs also record provider, status, credit cost, and any error, so we can refund credits for failed generations and debug problems.
Anonymous demo
The no-signup demo on our landing page is rate-limited per day. To do that we store a salted one-way hash of your IP address — we do not store the IP address itself, and the hash cannot be reversed into it. Demo prompts and results are kept for roughly 24 hours and then deleted automatically, unless you sign up and claim your demo mascot.
Cookies and local storage
We use only cookies and browser storage that are essential or functional — sign-in session cookies and things like your theme preference. We run no analytics, advertising, or cross-site tracking. The full list is in our Cookie Policy.
3. Why we process your data
| Purpose | Data involved | Legal basis (GDPR art. 6) |
|---|---|---|
| Providing the service: accounts, generation, storage of your mascots | Account data, content you create | Performance of a contract |
| Billing, invoicing, and tax records | Billing data, credit ledger | Contract; legal obligation |
| Preventing abuse of the free demo and of the service | Hashed IP, job records | Legitimate interest |
| Understanding our users and improving the product | Onboarding survey (optional) | Legitimate interest; consent for optional answers |
| Support | Account data, job records, your emails to us | Contract; legitimate interest |
We do not sell personal data, we do not show ads, and we do not make automated decisions about you that have legal or similarly significant effects.
4. AI processing of your prompts and images
Generating a mascot means sending your prompt — and, when you use one, your uploaded reference image — to the AI provider that runs the model you selected. These providers process that content solely to return the generation result to us. API keys are held server-side and your content is sent over encrypted connections. The providers we use are listed in the next section.
5. Processors and sub-processors
| Provider | What it does | What it receives |
|---|---|---|
| Clerk | Authentication and account management | Email, name, profile picture, sign-in metadata |
| Stripe | Payments, subscriptions, invoices | Billing name and address, card details, email |
| Convex | Application database and file hosting | All application data, including uploaded and generated images |
| OpenAI | Image generation, prompt assistance, reference-image analysis | Prompts, generation settings, reference images |
| Image generation (Gemini / Imagen models) | Prompts, generation settings, reference images | |
| fal.ai | Animation clips and background removal | Prompts, source images |
| BytePlus (ModelArk) | Image-to-video generation (Seedance models) | Prompts, source images |
6. International transfers
Some of the providers above process data outside the European Economic Area, primarily in the United States. Where that happens, transfers rely on safeguards recognised under the GDPR, such as the European Commission’s Standard Contractual Clauses or an adequacy decision (including the EU–US Data Privacy Framework where the provider is certified).
7. How long we keep data
- Account data and your content — for as long as your account exists. Ask us to delete your account and we remove your personal data and stored content, except what we must keep by law.
- Anonymous demo data — deleted automatically after roughly 24 hours if unclaimed.
- Billing records and the credit ledger — kept for as long as tax and accounting law requires.
8. Your rights
Under the GDPR you can ask us to:
- access the personal data we hold about you;
- correct inaccurate data;
- delete your data (“right to be forgotten”);
- restrict or object to certain processing;
- export your data in a portable format;
- withdraw consent at any time, where processing relies on it.
Email [email protected] and we will respond within one month. You also have the right to lodge a complaint with the Irish supervisory authority, the Data Protection Commission, or with your local data protection authority.
9. Security
All traffic to and from Mascot Design and its providers is encrypted in transit. Provider API keys are held server-side and are never sent to your browser. Access to production data is restricted. No system is perfectly secure, but if we become aware of a breach affecting your personal data we will notify you and the supervisory authority as the GDPR requires.
10. Children
Mascot Design is not directed at children and is not intended for anyone under 16. We do not knowingly collect personal data from children; if you believe a child has created an account, contact us and we will delete it.
11. Changes to this policy
If we change this policy in a meaningful way — for example, adding an analytics tool or a new AI provider — we will update this page and its “Last updated” date, and for significant changes we will notify account holders by email or in the app.
12. Contact
Flying Web Solutions, Ireland · [email protected]