Privacy Policy

1. Information We Collect

We collect the following types of information:

• Account Information: When you sign in via Google OAuth, we receive your name, email address, and profile picture from your Google account.
• Uploaded Images: Reference images you upload to the Service for multi-angle generation.
• Generated Images: AI-generated multi-angle images produced by the Service based on your uploads.
• Usage Data: Information about how you interact with the Service, including pages visited, features used, generation requests, and session data.
• Payment Information: Billing details are processed and stored securely by Stripe. We do not directly store your credit card numbers.
• Session Recordings: On this marketing website we record a random 10% of browsing sessions, plus every session in which an error occurs, as full-fidelity replays via Sentry to diagnose errors and improve usability. Replays capture page content and on-page media without masking, along with technical metadata such as your IP address and request data. Values typed into input fields are masked by default.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service, including generating multi-angle images from your uploads.
• Process your transactions and manage your subscription.
• Send you service-related communications, including account confirmations, billing receipts, and important updates.
• Analyze usage patterns to improve performance, features, and user experience.
• Detect, prevent, and address technical issues, fraud, or abuse.
• Comply with legal obligations.

3. Data Storage

Your data is stored using the following services:

• Database: Account information, session data, and generation metadata are stored in Neon PostgreSQL, a serverless database platform.
• Image Storage: Uploaded and generated images are stored using Vercel Blob, a cloud storage service.
• Hosting: The Service is hosted on Vercel’s cloud infrastructure.

We implement industry-standard security measures to protect your data, including encryption in transit (TLS) and secure access controls.

4. Third-Party Services

We share data with the following third-party services to operate the platform:

• Amplitude: Product analytics. Receives consent-gated usage events only; event properties never include your email, name, or password. The analytics SDK initializes only after you grant analytics consent.
• fal.ai: Image generation and editing for the Avatar and Products templates and the flows built on them, and the optional 4K export. Receives your reference image, the images generated from it, and the generation prompt.
• Tencent (Hunyuan 3D), via fal.ai: 3D model creation. Only when you choose to create a 3D model from an Avatar or Products turnaround, fal.ai sends that session's images (your reference photo and the generated views) to Tencent's Hunyuan 3D model, which returns the 3D model files. For Avatar sessions these images can show a person's face. The finished model is stored in Vercel Blob with your other images, under the same unlisted-link protection, and is listed only in your account.
• Google Gemini API: Environment template image generation, receives reference image + prompt.
• Neon: PostgreSQL database (US region), stores account, session, and generation metadata.
• Resend: Transactional email delivery for account, billing, and product update communications, and delivery of messages sent through our contact form to our inbox.
• Sentry: Error monitoring, performance tracing (100% of traces), application logging, and full-fidelity session replay (10% of sessions, and every session with an error), used to diagnose errors and improve the website. On this website, replay text and media masking is disabled (input-field values remain masked), and default PII such as your IP address, request data, headers, and cookies is sent from both the browser and our servers — payloads are not scrubbed. This data is processed by Sentry in the United States and retained per Sentry’s default schedule (approximately 90 days). Legal basis: your consent where required, otherwise our legitimate interest in operating and improving the Service.
• Stripe: Payment processing; collects and stores billing details per Stripe’s privacy policy.
• Upstash: Rate-limit and idempotency-key storage (Redis-compatible KV).
• Vercel: Hosting, edge, function execution, and Speed Insights (performance only — no behavioral data).
• Vercel BotID: Bot detection for sign-up and rate-limited endpoints.

5. Cookies and Tracking

• Essential cookies (session, CSRF, impersonation flag) — set without consent (legitimate interest / contractual necessity).
• Analytics cookies — set only with consent; deny-by-default for EU/UK. We use Amplitude for product analytics, initialized only after you grant analytics consent.
• Consent state cookies (mg_consent, mg_consent_pp_v, mg_consent_locale) — first-party essential, set without consent (required to remember your consent decision).
• First-touch attribution cookie (mg_ft) — first-party, set on your first page view and never overwritten, kept for 180 days. It records the page you landed on, the referring site and any campaign tags (utm_*) in the link, so a later sign-up can be attributed to how you found us. It holds no cross-site identifier and is not shared with ad networks. Ad click IDs (gclid, fbclid) are stored in it only after you grant analytics consent.
• Sentry monitoring on every visit, and session replay on a random 10% of visits plus every visit with an error — not gated behind analytics consent. Browser telemetry is routed through our first-party “/monitoring” path so that ad-blockers do not interrupt reporting.

On this marketing website, your analytics-cookies choice is kept in the mg_consent cookie. To change it, clear this site’s cookies in your browser: if you are in the EU, the UK or Switzerland, the consent banner then asks again on your next visit. In the app, you can change your choice anytime from your account settings.

6. Data Retention

We retain your account information for as long as your account is active. Uploaded and generated images are retained according to your subscription plan and may be automatically deleted after a period of inactivity. If you delete your account, we will remove your personal data within 30 days, except where retention is required by law or for legitimate business purposes such as fraud prevention.

7. Your Rights

Depending on your location, you may have the following rights under GDPR, CCPA, or other applicable data protection laws:

• Access: Request a copy of the personal data we hold about you.
• Export: Request your data in a portable, machine-readable format.
• Deletion: Request deletion of your personal data and account.
• Correction: Request correction of inaccurate personal data.
• Objection: Object to certain processing of your data.

To exercise these rights, visit your account settings or contact us at privacy@multiangle.ai.

8. Children's Privacy

The Service is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal data from a child under 13, we will take steps to delete that information promptly. If you believe a child under 13 has provided us with personal information, please contact us at privacy@multiangle.ai.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the “Last updated” date. Your continued use of the Service after changes are posted constitutes acceptance of the revised policy. We encourage you to review this page periodically.

10. Contact Information

If you have any questions about this Privacy Policy or our data practices, please contact us at privacy@multiangle.ai.