Privacy Policy

1. Who is responsible

Metin Ferati, based in Skopje, North Macedonia, operates CreateMascot at createmascot.art and is responsible for the personal information described here. Contact hi@metinferati.com for privacy questions or requests.

2. Information we handle

• Account details: your name, email address, password hash, verification status and any profile details you choose to provide. If you use Google sign-in, we receive your Google account identifier, name, email address, email-verification status and profile picture to create or access your account.
• Creative work: uploaded references, prompts, mascot descriptions, style instructions, generated images, approvals and saved project history, including creative briefs and the website URLs and product descriptions you submit for them.
• Generation records: request settings, job status, errors, provider request identifiers, usage and credit deductions or restorations.
• Purchase records: payment and customer identifiers, purchased packs, amounts, currency, payment or refund status and your credit ledger. Dodo Payments handles payment-card details; CreateMascot does not receive your full card number.
• Technical and support information: session identifiers, IP address, browser information, request and security logs, and information you send when asking for help.

3. Why we use it

We use account and creative information to provide the service you request: sign you in, save your work, generate images, deliver downloads and maintain your credit balance. Where a legal basis is required, this processing is necessary to perform our agreement with you or take steps at your request before you buy.

We use relevant technical records to secure accounts, prevent fraud and misuse, investigate failures and answer support requests. Our legitimate interests are operating a reliable service and protecting customers, balanced against your privacy rights. We retain and disclose records where necessary to meet legal obligations, such as accounting requirements or lawful requests.

When an optional activity requires consent, we will ask separately and you may withdraw it. We do not sell personal information, run advertising trackers on the app, or use your artwork in a public showcase without permission. Image generation is automated; we do not use it to make legal or similarly significant decisions about you.

4. Providers and sharing

We share the information needed for the feature you use with these providers. A disabled feature does not send a request to its provider.

• Google: authenticates your account when you choose Google sign-in. We request basic identity information, not access to Gmail, Drive or Calendar. Google handles its authentication service under its Privacy Policy.
• OpenAI: receives prompts and the reference images needed to generate or edit your illustration. For creative briefs, it receives your product description, submitted website URL and readable text retrieved from that public page. We save the resulting brief so you can return to it. Its API data controls describe provider retention, safety review and training defaults. API content is not used for training by default, but provider processing is not a promise of zero retention. CreateMascot does not run its own model training on your content.
• UploadThing: stores and delivers uploaded references and generated images when hosted image storage is enabled. Images currently use public file links: anyone with a file’s direct URL can view or download it without signing in. Your account and project library require sign-in, but this does not make the underlying image files private. Only upload artwork you are comfortable sharing; do not upload confidential images. Removing a reference from a draft or archiving a mascot does not itself delete every stored copy.
• Resend: processes recipients and message content for transactional email, such as verification and password resets. See its Privacy Policy.
• Dodo Payments: handles checkout as merchant of record, including payment, tax, fraud checks, receipts and refunds. We share the account and purchase information needed to connect your payment to your credits. Dodo Payments also handles information under its own Privacy Policy.
• Hosting infrastructure: the application server, database and background-job infrastructure process account, project and technical data to operate the service.

Authorized operators may access information to provide support, investigate misuse or maintain the service. We may disclose relevant information when legally required or necessary to protect legal rights. We do not make customer libraries publicly browsable.

5. Cookies and browser storage

CreateMascot uses essential authentication cookies to keep you signed in and secure your session. Sessions are configured to expire after seven days and may refresh while you continue using the service. Blocking essential cookies can prevent sign-in from working.

Browser storage remembers interface choices, such as whether you dismissed the tutorial. You can clear it through your browser settings; doing so can reset those choices. The separate Dodo Payments checkout may use its own cookies and privacy controls.

We use Simple Analytics to measure visits without cookies or persistent visitor identifiers. It records page paths, referring sites, campaign tags and basic browser, device and country information. It does not store IP addresses. This measurement runs independently of the optional Google Analytics preference below, including when you decline Google Analytics or enable your browser’s Do Not Track setting. We do not send account details, artwork or prompts to Simple Analytics. Read its data collection documentation.

If you choose “Allow analytics”, Google Analytics measures page visits, signups, checkout starts and confirmed purchases to help us understand how people find and use CreateMascot. It uses cookie identifiers, browser and device information, approximate location, referring sites and purchase amounts with an opaque transaction identifier. We do not send your name, email, artwork, prompts or payment-card details. Advertising features and automatic form and site-search collection are disabled.

Google Analytics stays off until you consent. You can decline without losing access to any product feature, and withdraw consent here at any time. Withdrawal stops future collection and clears Google Analytics cookies in this browser; it does not delete earlier records. Analytics cookies expire after six months, refreshed on visits. Google processes analytics data under its Privacy Policy. Purchase events describe consenting customers who return to the app; accounting records remain separate.

6. Retention and deletion

Your account, saved projects, references and generated images remain stored so you can return to your library. There is currently no automatic deletion timer for saved projects. Archiving hides a mascot from your active library; it does not erase its data.

You can request account closure and deletion at hi@metinferati.com. Deletion requests are handled manually after we verify ownership. We remove information that is no longer needed, subject to legal obligations and any unresolved transaction, fraud investigation or dispute. A deletion request does not automatically refund purchases.

Retention depends on the type of record: project data supports your saved library; payment and credit records support accounting, refunds and dispute resolution; security and support records are retained for investigating incidents and resolving requests. Any retained copies must be limited to those purposes. Providers may keep separate records under their own policies and legal obligations. Contact us for information about a particular record or request.

7. Security and international processing

We use HTTPS, authenticated access and account ownership checks to protect the service. Passwords are stored as hashes. No online service can guarantee absolute security. Keep your login private and avoid submitting sensitive personal information or content you do not have permission to share.

Our providers may process information outside North Macedonia or your country, including in the United States. Local protections may differ. International transfers must meet applicable data-protection requirements, including required contractual safeguards or other permitted transfer mechanisms. Contact us for details about the providers and safeguards relevant to your data.

8. Your choices and rights

Depending on the law that applies to you, you may request access, correction, deletion, restriction or a portable copy of your personal information, and object to processing based on legitimate interests. You may withdraw consent for an activity that relies on consent without affecting earlier lawful processing.

Email hi@metinferati.com from your account address and describe your request. We may need to verify your identity and will respond within the applicable legal deadline. Some records may need to be retained; if an exception applies, we will explain it. You can also download generated images from your library.

You may complain to North Macedonia’s Agency for Personal Data Protection or another competent data-protection authority where you live. Contacting us first does not remove that right.

9. Children

CreateMascot is intended for adults aged 18 and over. We do not knowingly collect children’s information. If you believe a child has provided personal information, contact hi@metinferati.com so we can investigate and remove it where appropriate.

10. Updates to this policy

We will update this page and its date when our practices change. We will provide additional notice or request consent where the law requires it. For questions about this policy, contact hi@metinferati.com.