Privacy Policy

1. Introduction

MakerNice (“we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website (makernice.com), API (api.makernice.com), documentation (makernice.com/docs), and related services (collectively, the “Services”).

By using the Services, you consent to the data practices described in this policy. If you do not agree with this policy, please do not use the Services.

2. Information We Collect

2.1 Account Information

When you create an account, we collect your email address and name. If you sign in using a third-party authentication provider (such as GitHub or Google), we receive the identity information returned by that provider (typically your email address, display name, and profile identifier). For email/password sign-in, we store a salted cryptographic hash of your password — we never store your password in plain text. We store your API keys only as hashes. If you configure a webhook, we store its URL and signing secret.

2.2 Payment Information

Payments are processed by our third-party payment processors: Waffo Pancake, the Merchant of Record for card and digital wallet payments, and NOWPayments for cryptocurrency. We do not see, receive, or store your credit card numbers, bank account details, or cryptocurrency wallet private keys. We retain only: the top-up amount and status, the payment processor’s order or transaction references, and the payment notifications the processor sends us, stored as received.

2.3 API Usage Metadata

For each API request processed through our gateway, we collect limited metadata for billing, debugging, and abuse prevention purposes:

• Request identifier
• Account and API key identifier used
• Model invoked
• API endpoint called
• Cost of the request
• HTTP status code and error code (if applicable)
• Timestamp

We also keep an audit log of administrative actions our staff take on accounts.

2.4 Generation Request Content and Outputs

Request content and outputs are kept separately from the usage metadata described in Section 2.3, which is necessary for billing and service operations.

2.5 Technical and Device Information

When you visit our website or use our dashboard, we may automatically collect:

• IP address
• Browser type and version
• Device type and operating system
• Pages visited, visit timestamps, and referring URLs

Your IP address and browser user agent are stored with your sign-in sessions. We also use IP addresses for rate limiting; these counts are kept in memory only and are not written to our database.

2.6 Cookies

We use the following cookies:

• Session cookie: To authenticate you and maintain your login session.
• Language cookie: To remember the language you choose for the website, dashboard, and documentation.
• Analytics cookies (marketing website only, set by Microsoft Clarity): _clck and _clsk on our domain, which link one visitor’s page views into a session; and CLID, MUID, MR, SM and ANONCHK on Microsoft domains. Microsoft states that MUID identifies browsers visiting Microsoft sites and may be used for advertising, site analytics and other operational purposes. For visitors from the European Economic Area, the United Kingdom and Switzerland, Clarity does not set cookies by default until consent is given.

We do not use advertising cookies ourselves, we do not run third-party marketing pixels, and we have not connected our analytics data to any advertising product.

2.7 Website Analytics

To understand where visitors come from, which pages they view, and at which step of sign-up and use they leave, and where they struggle on a page, we use the following analytics services:

• Umami Cloud (provided by Umami Software): On the marketing website it records page views, time on page, referring sites, and campaign parameters (utm). In the dashboard it records only a few events (opening the sign-in page, entering the dashboard, a top-up being credited including its amount, and submitting a generation); its script is not loaded on dashboard pages.
• Cloudflare Web Analytics: Records page views, referring sites, country or region, and device type.
• Microsoft Clarity (provided by Microsoft): On the marketing website only, it records page interactions such as clicks, scrolling and mouse movement to produce session recordings and heatmaps, and sets the cookies listed in Section 2.6. Input fields, drop-downs, and the try-it area on model pages (prompts, uploaded images and generated results) are masked and not uploaded. Clarity is not loaded in the dashboard or on sign-in and sign-up pages, nor on a page whose URL carries query parameters other than campaign parameters, nor on 404 pages. Recordings are kept for 30 days and heatmaps for 13 months, and the data may be processed in the United States.

Your browser sends your IP address and User-Agent to these services to derive a visitor identifier and your country or region. We do not send them your email address, name, API keys, or prompts. Umami and Cloudflare Web Analytics do not set cookies, and Umami removes all URL query parameters other than campaign parameters before reporting (for example, tokens in verification links). To avoid double counting, we note which steps have been reported in your browser’s session storage, which is cleared when you close the tab.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Services.
• Authenticate your identity and manage your account.
• Calculate, bill, and process balance usage and payments.
• Send transactional communications (account verification, password resets, service notices).
• Detect, prevent, and address fraud, abuse, security incidents, and technical issues.
• Debug failed requests and maintain service reliability.
• Comply with applicable legal obligations.

We do not sell your personal data. We do not use your prompts, inputs, or generated content to train, fine-tune, or improve any AI models.

4. How We Share Your Information

We share your information only in the following limited circumstances:

4.1 Upstream AI Providers

When you make a generation request, the content of your request, including prompts and reference images, is sent to the appropriate Upstream Provider (currently the model service providers muapi, fal, and apimart) for processing. Each Upstream Provider processes your data according to its own privacy policy and terms of service. We encourage you to review the privacy policies of the Upstream Providers whose models you use.

4.2 Payment Processors

We share your email address and transaction information with our payment processors (Waffo Pancake and NOWPayments) solely to process your payments. As the Merchant of Record for card and digital wallet payments, Waffo Pancake also uses this information to calculate tax, issue invoices, and handle refunds and disputes.

4.3 Infrastructure and Security Providers

We use third-party infrastructure providers (such as cloud hosting and CDN services) to deliver the Services, including Cloudflare R2 for storing generated outputs and uploads, an SMTP email provider for sending emails, Cloudflare Turnstile for human verification on certain actions, and Umami Cloud, Cloudflare Web Analytics and Microsoft Clarity for website analytics (see Section 2.7). These providers may process data on our behalf under appropriate data protection agreements. Cloudflare retains network logs in accordance with its own policies, and Microsoft also processes Clarity data under its own privacy statement.

4.4 Legal Requirements

We may disclose your information if required to do so by law, legal process, or governmental request, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, investigate fraud, or respond to a government request.

4.5 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information.

5. Data Retention

We retain your information only for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law.

6. Data Security

We implement reasonable technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data in transit (TLS), secure credential storage (API keys are stored only as hashes), encrypted database backups, access controls, and regular security reviews.

However, no method of transmission over the Internet or method of electronic storage is completely secure. While we strive to protect your personal information, we cannot guarantee its absolute security.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete personal information.
• Deletion: Request deletion of your personal information, subject to our legal obligations to retain certain records.
• Data Portability: Request your data in a structured, commonly used, machine-readable format.
• Opt-Out: Opt out of promotional communications at any time by contacting us.
• Restriction: Request that we restrict the processing of your personal information under certain circumstances.
• Objection: Object to the processing of your personal information where we rely on legitimate interests as our legal basis.

To exercise any of these rights, please contact us at support@makernice.com. We will respond to your request within thirty (30) days, or within the timeframe required by applicable law.

7.1 Account Deletion

You can delete your account at any time by contacting us. Account deletion will remove your account data and revoke all API keys. Payment and billing records are retained for at least 3 years (longer where required by law), and request content from past generations is removed on the schedule in Section 5. Deleted data may remain in encrypted database backups for up to 30 days before the backups are rotated out.

8. Rights for Specific Jurisdictions

8.1 European Economic Area, United Kingdom, and Switzerland (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we process your personal data in accordance with the General Data Protection Regulation (GDPR) and equivalent local legislation. Our legal bases for processing include:

• Contractual necessity: To provide the Services you have requested and fulfill our obligations under our Terms of Service.
• Legitimate interests: For fraud prevention, security, service improvement, and communications, where these interests are not overridden by your data protection rights.
• Legal obligation: To comply with applicable laws (such as tax and accounting requirements).
• Consent: Where you have provided your explicit consent, which you may withdraw at any time.

You have the right to lodge a complaint with your local data protection authority if you believe we have not complied with applicable data protection laws.

8.2 California (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, and disclose.
• Request deletion of your personal information.
• Opt out of the sale or sharing of your personal information. We do not sell your personal information.
• Not be discriminated against for exercising your privacy rights.

9. International Data Transfers

Your information may be transferred to and processed in countries other than the country in which you reside. These countries may have data protection laws that differ from the laws of your country. By using the Services, you consent to the transfer of your information to countries outside of your country of residence. For example, analytics data from our marketing website (Microsoft Clarity) may be processed in the United States.

When we transfer personal data from the EEA, UK, or Switzerland, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the European Commission or equivalent mechanisms recognized under applicable law.

10. Children’s Privacy

The Services are not directed to anyone under the age of 18. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected personal information from someone under 18, we will take steps to promptly delete such information. If you believe that someone under 18 has provided us with personal information, please contact us at support@makernice.com.

11. Third-Party Links and Services

The Services may contain links to third-party websites, services, or Upstream Provider platforms. We are not responsible for the privacy practices or content of those third parties. We encourage you to review the privacy policies of any third-party services you access through the Services.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email at least fourteen (14) days before the changes take effect and update the “Last updated” date at the top of this page. Your continued use of the Services after the effective date of any changes constitutes your acceptance of the updated policy.

13. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Email: support@makernice.com