Privacy Policy
Last Updated: December 28, 2025
Our Commitment to You
CandyMustache, Inc. ("CandyMustache", "we", "our", or "us") is committed to transparency, security, and user control over personal data. To provide our digital assets, AI-powered creative tools, and related services (collectively, the "Services"), we must collect and process certain personal information.
By accessing or using our Services, you acknowledge and agree to the collection, use, storage, and disclosure of your Personal Data as described in this Privacy Policy. If you do not agree with this Policy, please discontinue use of the Platform.
1. Grounds for Data Collection
We process Personal Data where necessary to:
- Perform our contractual obligations under the Terms of Use and License Agreement (the "Agreement")
- Operate, secure, and improve the Services
- Comply with applicable legal and regulatory obligations
- Protect our legitimate business interests
You are not legally required to provide Personal Data; however, without it, we may be unable to provide core functionality such as account access, billing, AI generation, or asset downloads.
2. Types of Data We Collect
Personal Data
We may collect the following categories of Personal Data:
- Registration Information: Name, email address, mailing address, and professional details (such as company name or role).
- Payment Information: Payments are processed by third-party providers (e.g., Stripe). We do not store full payment card details; we receive only pseudonymized tokens and limited transaction metadata.
- AI Inputs: Text prompts, images, audio files, or other content you voluntarily submit to generate Outputs.
- Audio Data (Optional): If you choose to use AI voice-related features, we process the audio recordings you submit solely to provide those features.
- Usage Data: Account ID, session data, device and browser information, IP address, and general location (city/country level).
- User-Provided URLs (Optional): URLs to content you created using our Services, provided voluntarily for license verification or support purposes.
Non-Personal / Aggregated Data
We collect technical and aggregated data (such as browser type, operating system, referral source, time zone, and anonymized usage statistics) that does not directly identify you. If such data is combined with Personal Data, it will be treated as Personal Data.
3. AI Services & Audio Data Clarifications
No-Training Pledge
CandyMustache does not use your Inputs or Outputs to train, fine-tune, or improve our AI models or any third-party AI models.
Audio & Voice Data
If you choose to use optional AI voice features, we process your submitted audio solely to generate Outputs requested by you. We do not use Audio Data for identification, profiling, or inference of personal characteristics.
Depending on your jurisdiction, Audio Data may be considered sensitive or biometric data. You control this data and may delete associated voice models and samples at any time via your account dashboard. Deleted data is permanently removed from our active systems, subject only to limited legal retention requirements.
4. Tracking Technologies
We use cookies, pixels, and similar technologies ("Tracking Technologies") to operate and improve the Services.
- Analytics: We use tools such as Google Analytics to understand how users interact with the Platform. These tools collect anonymized or pseudonymized usage information.
- Preferences & Functionality: Cookies help remember settings and improve performance.
You can manage or disable cookies through your browser settings or by using available opt-out tools (such as the Google Analytics Opt-out Browser Add-on). Disabling cookies may affect certain features of the Services.
5. Purposes & Legal Bases for Processing
| Purpose | Data Categories | Legal Basis |
|---|---|---|
| Account creation & management | Registration, billing data | Performance of a contract |
| AI content generation | Inputs, optional Audio Data | Performance of a contract |
| Service delivery & support | Usage data, communications | Performance of a contract |
| Platform improvement | Aggregated usage data, feedback | Legitimate interests |
| Security & fraud prevention | Account & usage data | Legitimate interests |
| Marketing communications | Email address | Consent / legitimate interests |
| Legal compliance | Relevant Personal Data | Legal obligation |
6. How We Use Your Data
We use Personal Data to:
- Provide and operate the Services
- Process AI generations and asset downloads
- Communicate service-related notices and updates
- Send marketing communications (you may opt out at any time)
- Detect fraud, misuse, or violations of our Agreement
- Comply with legal and regulatory requirements
7. Data Sharing
We may share Personal Data with:
- Internal Personnel: Employees and contractors with a legitimate need to perform their duties.
- Service Providers: Cloud hosting, analytics, payment processors, and AI infrastructure providers. These providers are contractually restricted from using your data for their own purposes or model training.
- Legal & Safety Requirements: Where required by law, legal process, or to protect rights, safety, or security.
- Business Transactions: In the event of a merger, acquisition, or asset sale, data may be transferred as part of that transaction.
8. International Data Transfers (EEA / UK Users)
CandyMustache is based in the United States. If you are located in the EEA or UK, your Personal Data may be transferred to and processed in the U.S.
We rely on approved safeguards such as Standard Contractual Clauses (SCCs) or applicable data transfer frameworks to ensure an adequate level of protection.
9. Your Privacy Rights
GDPR (EU/UK)
You may have the right to access, correct, delete, restrict, object to processing, and request portability of your Personal Data. These rights are subject to applicable legal limitations.
California (CCPA / CPRA)
California residents have the right to:
- Know what Personal Information we collect and how we use it
- Request deletion or correction of Personal Information
- Opt out of certain sharing for targeted advertising
CandyMustache does not sell Personal Information in exchange for money. We may share limited data with analytics or advertising partners in ways that may be considered "sharing" under CPRA. You may opt out via browser settings or a "Do Not Sell or Share My Personal Information" link where required.
10. Data Retention
We retain Personal Data only for as long as necessary to:
- Provide the Services
- Maintain your account
- Comply with legal, accounting, or regulatory obligations
- Resolve disputes and enforce our agreements
Retention periods vary depending on data type and purpose.
11. Children's Privacy
The Services are not directed to children under the age of 16. We do not knowingly collect Personal Data from minors. If we become aware that such data has been collected, we will delete it promptly.
12. Updates to This Policy
We may update this Privacy Policy from time to time. The "Last Updated" date reflects the most recent revision. Material changes will be communicated via the Platform or email where required.
13. Contact Us
For privacy questions or to exercise your rights, contact us at:
CandyMustache, Inc.
651 North Broad Street, Suite 201
Middletown, DE 19709, United States
📧 Email: privacy@candymustache.com
📩 Support: Help Center / legal@candymustache.com