Privacy Policy

Last updated: 6 June 2026

This Privacy Policy explains how FaceToCartoon ("FaceToCartoon", "we", "us", or "our") collects, uses, stores, shares, and protects your information when you use facetocartoon.com and our related services (the "Service"). FaceToCartoon is the data controller for the personal data described here. If you have any questions, contact us at support@facetocartoon.com.

1. Information we collect

Account information

When you create an account, we collect your email address and (optionally) your display name. Passwords are stored in hashed form by our authentication provider — we never see or store your plaintext password. If you sign in with Google, we receive basic profile information (such as your email address and name) from Google.

Photos you upload

To generate a cartoon, you upload a source photo. We process this image to create your output. Before storage, we strip embedded metadata (such as EXIF and GPS/location data) from your image. Uploaded photos are stored only transiently (see "Data retention" below).

Generated images

The cartoon images we create for you are stored transiently so you can preview and download them.

Payment information

Payments are processed by Paddle, which acts as the Merchant of Record for purchases made through the Service. We do not collect or store your full card or banking details — Paddle does. Paddle provides us with limited transaction information (such as plan, subscription status, billing country, and the last four digits of your card) so we can manage your subscription and credits.

Usage and account activity

We keep records of your generation history (such as style, size, format, and timestamps), your credit balance and credit ledger, and your subscription status and plan.

Technical and security data

We collect your IP address, device, and browser information for security, fraud prevention, and rate limiting. IP addresses are used in hashed form for abuse-prevention counters. We also maintain basic request and security logs.

Cookies and local storage

We use cookies and browser local/session storage that are strictly necessary to keep you signed in, secure your session, remember your preferences, and cache non-sensitive data for performance. We do not use advertising cookies.

Communications

If you contact us (for example, via our contact form or support email), we keep your messages and contact details.

2. How we use your information

  • To provide the Service — generating cartoon images from the photos you upload.
  • To create, authenticate, and secure your account.
  • To process payments and manage your subscriptions, credits, and billing through Paddle.
  • To prevent abuse, fraud, and automated misuse (rate limiting and bot protection).
  • To operate, maintain, troubleshoot, and improve the Service.
  • To send you transactional and service messages (such as account, billing, and verification emails).
  • To respond to your support requests.
  • To comply with our legal obligations and enforce our Terms.

Where the GDPR or UK GDPR applies, we rely on the following legal bases: performance of our contract with you (providing the Service); our legitimate interests (security, fraud prevention, and improving the Service); your consent (where requested); and compliance with legal obligations.

3. AI processing of your photos

To create your cartoon, the photo you upload is sent to our third-party AI provider (xAI / Grok) solely to generate the output you requested. We do not use your photos to train our own models. Your use of the AI-generated output is also subject to our Terms of Service.

4. Data retention

We retain uploaded photos and generated images only for as long as needed to provide the Service, and then delete them automatically:

  • Uploaded source photos expire shortly after upload (currently about 20 minutes).
  • Generated images expire shortly after creation (currently about 30 minutes).
  • An automated cleanup process (which runs at least hourly) permanently deletes expired images from our storage.

We retain account information for as long as your account is active. We may retain limited records (such as billing and credit-ledger entries) for longer where required for accounting, tax, legal, or fraud-prevention purposes. You can request deletion of your account at any time.

5. Who we share your information with

We share personal data only with service providers that help us operate the Service, including:

  • Supabase — database, authentication, and secure file storage.
  • Paddle — payment processing and Merchant of Record for purchases.
  • xAI (Grok) — AI image generation.
  • Cloudflare Turnstile — bot and abuse protection on sign-up and sign-in.
  • Google — if you choose to sign in with Google.
  • Web3Forms — delivery of contact-form messages.
  • Vercel — application hosting and infrastructure.

We may also disclose information where required by law, to enforce our Terms, or to protect the rights, safety, and security of our users and the Service. We do not sell your personal data.

6. International data transfers

Our providers may process data in countries other than your own. Where personal data is transferred internationally, we rely on appropriate safeguards (such as standard contractual clauses) provided by those processors.

7. Data security

We use industry-standard measures to protect your data, including encryption in transit, hashed passwords, hashed IP addresses for abuse counters, stripping of image metadata, access controls, and short retention of images. No method of transmission or storage is completely secure, but we work to protect your information.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal data; to object to or restrict certain processing; and to withdraw consent. If you are in the EEA/UK, these rights arise under the GDPR/UK GDPR. If you are a California resident, you have rights under the CCPA/CPRA, including the right to know, delete, and not be discriminated against for exercising your rights (we do not sell personal data).

You can update your name in your account settings and request access or deletion by emailing support@facetocartoon.com. You also have the right to lodge a complaint with your local data protection authority.

9. Children

The Service is not directed to children under 16, and you must be old enough to consent under your local law to use it. Do not upload photos of children without the consent of a parent or guardian. If you believe a child has provided us personal data, contact us and we will delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date above and, where appropriate, notify you. Your continued use of the Service after changes take effect constitutes acceptance.

11. Contact us

FaceToCartoon — support@facetocartoon.com. For data requests, please include the email address associated with your account.