Privacy Policy

1. Who this policy covers

This policy applies to:

• Customers — individuals or organizations that sign up for or use Mascotly AI to create and host a mascot on their website.
• Website visitors — people who browse mascotlyai.com or interact with a mascot embed on a customer's site.

When a customer embeds our widget, the customer is generally the data controller for their visitors' personal data. We act as a processor for that visitor data, as described in our Data Processing Agreement.

2. Information we collect

Information you provide

When you create or manage a mascot, we may collect:

• Email address
• Website URL and content we crawl from pages you authorize
• Mascot name, personality description, and uploaded mascot image
• Support messages and other communications you send us
• Billing details processed by Stripe (we do not store full payment card numbers)

Information collected automatically

When you use the Service, we may automatically collect:

• Device and browser type, operating system, and language settings
• IP address, approximate location derived from IP, and referral URLs
• Pages viewed, features used, and interaction logs on mascotlyai.com
• Cookies and similar technologies (see Section 7)

Embed visitor data

When a visitor talks to a mascot on a customer's website, voice audio is processed in real time via OpenAI to enable the conversation. We do not store spoken text, audio recordings, or conversation transcripts. We retain only session metadata, such as session start and end times, token usage, and related billing information.

3. How we use information

We use collected information to:

• Provide, operate, maintain, and improve the Service
• Crawl and index customer websites to build mascot knowledge bases
• Process subscriptions, send transactional emails, and provide support
• Monitor usage, diagnose issues, enforce limits, and prevent abuse
• Comply with legal obligations and enforce our Terms of Service

4. Legal bases for processing (EEA/UK users)

If you are in the European Economic Area or United Kingdom, we process personal data based on:

• Contract: to provide the Service you requested
• Legitimate interests: to secure and improve the Service, subject to your rights
• Consent: where required for optional cookies or similar technologies
• Legal obligation: where we must retain or disclose data by law

5. How we share information

We do not sell your personal information. We may share information with:

• Service providers that help us host, analyze, bill, and operate the Service, including OpenAI (voice processing), Stripe (payments), Vercel and Railway (hosting and infrastructure), and DataFast (website analytics), under appropriate confidentiality and data protection obligations
• Professional advisors such as lawyers and accountants when necessary
• Business transfers in connection with a merger, acquisition, or sale of assets, with notice where required
• Law enforcement or regulators when required by law or to protect rights, safety, and security

6. Data retention

We retain account and usage data for as long as your account or paid subscription is active, or as needed to provide the Service. If you cancel a paid subscription, we retain data for the remainder of the current billing period and may delete or anonymize it afterward unless we must retain it for legal, tax, or dispute-resolution purposes.

For free-tier accounts, we may suspend or remove mascots and associated data at our discretion, including when an account is inactive. We are not obligated to retain free-tier data indefinitely.

Session metadata for embed visitors is retained only as long as needed for billing, operations, and abuse prevention.

7. Cookies and analytics

We use cookies and similar technologies on mascotlyai.com to measure traffic and understand how the site is used. You can control cookies through your browser settings. Disabling certain cookies may limit functionality.

8. Security

We implement reasonable technical and organizational measures to protect personal data, including encryption in transit (TLS) and access controls. No method of transmission or storage is completely secure. Report suspected security issues to info@ticekralt.com.

9. International transfers

Tice Kralt is based in the Netherlands. Your information may be transferred to and processed in countries where we or our providers operate, including the United States. Where required, we use appropriate safeguards such as Standard Contractual Clauses approved by the European Commission.

10. Your rights

Depending on your location, you may have the right to:

• Access, correct, or delete personal data we hold about you
• Object to or restrict certain processing activities
• Port your data in a structured, commonly used format
• Withdraw consent where processing is consent-based
• Lodge a complaint with your local data protection authority

To exercise these rights, email info@ticekralt.com. We may verify your identity before responding. We aim to reply within 30 days.

If you are a website visitor interacting with a mascot on a customer's site, please contact that customer (the data controller) first. We will assist them as required under our data processing agreement.

11. Children's privacy

The Service is not directed to individuals under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us data, contact us and we will delete it promptly.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will post changes on this page and update the "Last updated" date. Material changes will be communicated where required by law.

13. Contact us

For privacy-related questions or requests:
Tice Kralt (KvK 71553967)
Email: info@ticekralt.com