Legal

Privacy Policy

Last updated: September 2, 2026

Language Note

This Privacy Policy is provided in English for compliance purposes. In case of any inconsistency between the English version and any translated version, the English version shall prevail.

1. Introduction

Welcome to ToonBliss Art Studio ("we," "our," or "us"). We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our AI image conversion service.

We operate as a personal developer based overseas. This policy applies to all users of our service worldwide, including users from the European Economic Area (EEA), the United Kingdom, the United States, and other regions.

2. Information We Collect

2.1 Information You Provide

  • Account Information: When you register, we collect your email address, username, and password.
  • Uploaded Images: The images you upload for AI style conversion.
  • Payment Information: When you make purchases, payment processing is handled by our third-party payment processor (Paddle). We do not store your full credit card numbers or banking details.
  • Communications: Information you provide when contacting us for support.

2.2 Information Collected Automatically

  • Usage Data: Pages visited, features used, conversion history, and time spent on the site.
  • Device Information: Browser type, operating system, IP address, and device type.
  • Cookies and Tracking: We use cookies and similar technologies to improve your experience and for analytics. See Section 5 for details.

3. How We Use Your Information

  • To provide and maintain our AI image conversion service
  • To process your transactions and manage your account
  • To improve our service and develop new features
  • To communicate with you about your account, transactions, and service updates
  • To detect, prevent, and address technical issues and fraud
  • To comply with legal obligations
  • To add AI-generated identification markers to output images as required by the EU AI Act (August 2026)

4. How We Share Your Information

4.1 Service Providers

  • AI Processing: We use AI API services to process image conversions. Images are sent to AI processing servers for conversion and are not permanently stored.
  • Database: We use Neon (Serverless PostgreSQL), a cloud database service, to store user account information, conversion history, and usage records. Account data is encrypted at rest and in transit.
  • Payment Processor: Paddle (Merchant of Record) processes all payments securely. Paddle handles all payment processing, tax calculation, and compliance.
  • Hosting: Our website is hosted on Vercel servers located in the United States.
  • Analytics: We may use analytics tools to understand usage patterns and improve our service.

4.2 Legal Requirements

We may disclose your information if required to do so by law or in response to valid legal requests by public authorities.

4.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction.

5. Cookies and Tracking Technologies

  • Essential Cookies: Required for the website to function properly (e.g., session management, login state).
  • Analytics Cookies: Help us understand how visitors interact with our website.
  • Advertising Cookies: We use Google AdSense to display ads. Google uses cookies to serve personalized ads based on your browsing history.
  • Functional Cookies: Remember your preferences and language settings.

You can control cookies through your browser settings. For more information about Google's use of cookies for advertising, visit Google's Advertising Policy.

Third parties, including Google, may place and read cookies in your browser or use web beacons or IP addresses to collect information when you visit our website. For more information about how Google uses data from sites that use its products, please visit How Google uses data from sites that use its products.

Children's Privacy (COPPA): Our service is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe that a child has provided us with personal information, please contact us immediately so we can delete it. We do not use personalized advertising or targeted advertising for users we know are under 13. If your website or app is directed to children, you must comply with the Children's Online Privacy Protection Act (COPPA) and mark your ad requests as child-directed.

5.1 Device and Location Data

We may collect information that identifies or can be used to infer your approximate geographic location, such as IP address-derived location data. We do not collect precise geographic location data from GPS, Wi-Fi, or cell tower data.

If we collect, process, or disclose information that identifies or can be used to infer your precise geographic location, we will:

  • Disclose to you the purposes for which your data may be used (including ad personalization, analytics, and attribution), including that the data may be shared with partners
  • Obtain your express (opt-in) consent before collecting, processing, or disclosing such information
  • Send such information to Google in an encrypted state or via an encrypted channel
  • Disclose such information collection, processing, or disclosure in this privacy policy

5.2 Personal Identifiable Information (PII) Protection

We do not pass any information to Google that Google could use or recognize as personally identifiable information. We do not use Google's services to identify users or facilitate the merging of personally identifiable information with previously collected non-personally identifiable information without robust notice of, and the user's prior affirmative (opt-in) consent to, that identification or merger.

We do not attempt to disaggregate data that Google reports in aggregate. We comply with Google's EU User Consent Policy, which requires that we display accurate disclosures concerning data processing on our properties and obtain legally valid consent where required from end users in the EEA, the UK, and Switzerland.

5.3 Cookies on Google Domains

We do not set cookies on Google's domains, nor do we modify, intercept, or delete cookies set on Google's domains.

5.4 Google Consent Mode v2 and EU User Consent Policy

We implement Google Consent Mode v2 to ensure compliance with Google's EU User Consent Policy. This means:

  • By default, all non-essential cookies (advertising, analytics) are set to "denied" until you provide consent
  • When you accept cookies via our consent banner, we update Google's consent signals to "granted" for the relevant categories
  • When you reject cookies, Google's consent signals remain "denied" for non-essential categories
  • You can customize your cookie preferences at any time through our cookie consent banner

For users in the European Economic Area (EEA), the United Kingdom, and Switzerland, we obtain explicit consent before setting non-essential cookies or using your data for personalized advertising. For more information, please visit Google's EU User Consent Policy.

6. Data Retention

  • Account information: Until you delete your account or for as long as your account is active.
  • Uploaded images: Deleted immediately after conversion processing is complete. We do not permanently store your uploaded images.
  • Payment records: Retained as required by tax and financial regulations (typically 5-7 years).
  • Usage data: Retained for analytics purposes for up to 26 months.

7. Data Security

  • Encryption of data in transit using TLS/SSL
  • Secure server infrastructure on AWS
  • Regular security assessments
  • Access controls limiting internal access to personal data

However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

8. Your Rights

8.1 For All Users

  • Access: Request a copy of the personal data we hold about you.
  • Correction: Request correction of inaccurate data.
  • Deletion: Request deletion of your data, subject to legal retention requirements.
  • Objection: Object to the processing of your data for marketing purposes.

8.2 For EEA/UK Users (GDPR)

  • Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time.
  • Data Portability: Request your data in a structured, commonly used format.
  • Restriction: Request restriction of processing under certain circumstances.
  • Lodge a Complaint: You have the right to lodge a complaint with your local data protection authority.

Legal Basis for Processing (GDPR): We process your data based on: (a) your consent (for cookies and marketing); (b) contract performance (to provide our service); (c) legitimate interests (to improve our service and prevent fraud); and (d) legal obligations.

8.3 For California Users (CCPA/CPRA)

  • Know what personal information we collect, use, disclose, and sell
  • Request deletion of your personal information
  • Opt out of the sale of your personal information (we do not sell personal information)
  • Non-discrimination for exercising your CCPA rights

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States (where our servers and service providers are located). When we transfer data from the EEA/UK to other countries, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission.

10. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of these websites. We encourage you to review their privacy policies before providing any personal information.

11. Children's Privacy

Our service is not directed to individuals under the age of 13 (or 16 in the EEA). We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us, and we will delete it.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically.

13. Contact Information

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us:

yangpeng007x@gmail.com

14. DMCA Copyright Agent

Our designated DMCA Copyright Agent can be reached at:

  • Email: yangpeng007x@gmail.com (Subject: "DMCA Notice")
  • Physical Address: [To be provided after server deployment]

We are registered with the U.S. Copyright Office as a service provider under the DMCA Safe Harbor provisions.

This Privacy Policy was last updated on September 2, 2026.

Start Converting