Privacy Policy | CartoonGenerator.ai

Introduction

This Privacy Policy explains how CartoonGenerator.ai collects, uses and protects information when you use our photo-to-cartoon tools and related account, asset, support and payment services.

Information We Collect

Depending on the features you use, CartoonGenerator.ai can collect:

Account and contact information, such as your name, email address, sign-in records, and messages you send to support.
Content and service records, such as prompts, uploads, generated results, usage, credits, and operational logs needed to provide the requested service.
First-party acquisition information, including an anonymous browser identifier; validated source, medium, campaign, landing, and referrer fields; an affiliate fallback; and recognized advertising click identifiers such as gclid, gbraid, wbraid, fbclid, or msclkid.
Checkout and order attribution, which preserves an immutable copy of the applicable first marketing touch and affiliate value when checkout begins and associates it with the resulting payment when possible.
Payment and transaction information returned by the configured payment provider. The site does not need to store full payment-card details when those details are handled by the provider.
Device and security information, such as IP address, browser details, request timestamps, and signals used to protect the service.
Optional-service data produced only by third-party analytics, support, or referral services that are actually configured and allowed to run.

Raw advertising click identifiers are kept in the site's database rather than the browser attribution cookie. The compact attribution metadata sent with a provider checkout is limited to the internal snapshot ID, source, medium, campaign, and affiliate value; raw click identifiers are not projected to the payment provider.

First-Party Attribution and Optional Services

The site records its own acquisition and order attribution globally, including for visitors in Europe, before and independently of the optional-services choice. This first-party record supports internal acquisition measurement and preserves the source attached to a later account, checkout, or order. A first marketing touch is retained for up to 30 days and is not replaced by a later direct or organic visit during that period.

Optional third-party services follow a separate runtime rule:

In the EEA, United Kingdom, Switzerland, or when the region is unknown, they wait for Allow all.
In other regions, they can follow the regional default until you make an explicit choice.
Only essential or a later withdrawal prevents optional third-party services from loading in every region. Global Privacy Control prevents them only outside the consent-gated regions. In the EEA, United Kingdom, Switzerland, or when the region is unknown, the current site choice controls loading, so Allow all permits configured optional services even when GPC is enabled.
Same-origin, self-hosted, cookieless Umami can be treated as first-party aggregate measurement and run outside that gate; cross-origin or protocol-relative configurations fail closed.

Changing the optional-services choice does not delete first-party acquisition already associated with an account or preserved in an immutable checkout or order snapshot.

How We Use Information

CartoonGenerator.ai uses information to:

provide, secure, troubleshoot, and improve the requested service;
manage accounts, credits, subscriptions, checkouts, and support;
prevent fraud, abuse, duplicate grants, and unauthorized access;
measure first-party acquisition, registration, first-generation, checkout, and purchase outcomes;
preserve an auditable source for orders without letting a later visit rewrite prior order attribution;
comply with legal obligations and enforce applicable terms; and
operate configured optional services when their runtime rule permits it.

We share information with service providers as needed to operate hosting, authentication, storage, email, AI generation, support or payment functions for CartoonGenerator.ai. Optional analytics and referral providers receive data only when configured and permitted by the runtime rules described above.

Payment providers can receive server-owned operational metadata needed to create and reconcile a checkout. Attribution authority remains the site's immutable database snapshot; provider metadata is a compact projection and recovery link, not a second source of truth.

Cloudflare provides hosting, storage and email infrastructure. KIE processes image generation requests, including the photo and style instructions needed to create your result. Google processes sign-in when you choose Google sign-in. Payments, when available, are processed through our payment gateway and the provider shown at checkout.

Retention

The browser’s signed first-touch attribution copy and an unassociated first marketing touch are retained for up to 30 days. Platform click records can expire independently under the same bounded acquisition model. Attribution already preserved with an account, checkout, payment or financial record can be retained with that record for our operational and legal retention period.

We retain other account, content, security, support and transaction records only as long as needed to provide the service, manage the account, resolve issues and meet applicable requirements.

Security

CartoonGenerator.ai uses controls such as signed HttpOnly attribution storage, server-side validation, database ownership checks, immutable order snapshots and restricted provider metadata. No system can guarantee absolute security.

Your Choices and Rights

You can use Cookie settings, where shown, to control optional third-party services. Global Privacy Control is honored for runtime loading only outside the consent-gated regions. In the EEA, United Kingdom, Switzerland, or when the region is unknown, the current site choice controls loading, so Allow all permits configured optional services even when GPC is enabled. These controls do not erase the site's internal first-party acquisition or order records.

Depending on where you live, you may have rights to request access, correction, deletion, restriction, objection or portability. Contact [email protected] to make a privacy request. We may ask for information needed to verify that the request concerns your account.

Changes to This Privacy Policy

We may update this Privacy Policy when our data practices or service providers change. The current version and date will be posted on this page.

Contact Us

If you have questions or a privacy request, email [email protected] or contact us.