Privacy Policy

This Policy applies to personal data processed by Umola in connection with the 3D Studio and the Sketch/Game Studio, which together comprise the Service as currently offered. It does not apply to any conversational AI or persistent chat-memory feature, as no such feature forms part of the Service at this time; should one be introduced, this Policy will be updated to address it before that feature becomes available.

For the purposes of this Policy, “personal data” means any information relating to an identified or identifiable natural person, consistent with the meaning given to that term, or the equivalent term, under applicable data protection law.

Umola is currently operated independently and has not been incorporated as a separate legal entity. For questions about this Privacy Policy or the handling of personal data, please contact support@umola.app. support@umola.app.

Umola collects the categories of personal data described below. Where this Policy speaks in terms of a “legal basis” for processing, that language reflects the framework used under data protection law in the European Economic Area and the United Kingdom; where a different framework applies to a given user, the described purpose remains an accurate statement of why the data is processed.

Data provided directly

Data generated through use of the Service

When a user initiates a generation, Umola transmits the relevant instruction, together with associated world or sketch data and images, to a third-party AI provider selected by the user or by default configuration. The providers presently integrated are Google (for the Gemini model) and OpenRouter. Umola does not transmit the user’s email address, username, or payment information as part of a generation request.

Each provider processes the transmitted data under its own privacy policy and terms. Umola does not use User Content to train its own models. Umola does not control, and makes no representation regarding, whether a third-party provider uses submitted data to train its own models; a user who wishes to avoid this may use the Bring Your Own API Key option described in Section 8, which routes generation requests under the user’s own account and agreement with the provider.

Images submitted for use as thumbnails may be processed by an automated classifier prior to storage or publication, for the purpose of screening prohibited content described in the Terms of Service.

The following is visible to any visitor to the Service, whether or not registered: username, display name, avatar, cover image, biography, website, self-reported location, published Content together with its title, description, and thumbnail, and aggregate play and like counts, and follower and following counts.

The following is not public: email address, unpublished Content, instructions submitted for generation, account balances, and purchase history.

Umola uses one session cookie, set by its authentication provider, which is strictly necessary to maintain a user’s signed-in state and for which no consent mechanism is required under applicable law. Umola also uses local browser storage to retain limited interface state and, where a user has configured one, an encrypted third-party API key; this data remains on the user’s device and is not transmitted to or readable by Umola’s servers other than as required to relay a generation request the user has initiated.

Umola does not use advertising cookies, analytics cookies, or third-party tracking technologies.

Payments are processed by a third-party payment processor (currently Razorpay). Payment card and bank account details are provided directly to the payment processor and are not received or stored by Umola. Umola receives and retains the resulting transaction reference, amount, and status for accounting and customer support purposes, and transmits the user’s account identifier to the payment processor to associate a payment with the correct account.

Where a user configures the Service to use a self-supplied Gemini or OpenRouter API key, that key is encrypted within the user’s browser and transmitted to Umola’s servers only to execute the specific generation request initiated by the user. Umola does not store the key on its servers. This client-side encryption is effective against inspection of data stored in the browser but does not protect against malicious code executing within the Service’s own web page, which could access the key by the same mechanism the Service itself uses. Umola is not aware of any such incident having occurred and discloses this limitation as a matter of technical accuracy.

Umola does not sell personal data and does not share personal data with third parties for their own advertising purposes. Umola shares personal data with the following categories of service provider, each acting on Umola’s instructions and receiving only the data necessary to perform its function:

Umola may disclose personal data where required by applicable law or legal process, or as necessary to establish, exercise, or defend a legal claim. Where legally permitted, Umola will notify the affected user of such disclosure.

The Service is operated from its primary jurisdiction, India, and the service providers listed in Section 9 operate internationally, including in the United States. Personal data is accordingly processed outside the jurisdiction in which a given user is located. Where applicable data protection law requires a safeguard for such a transfer, Umola relies on the relevant service provider’s own contractual and technical safeguards. Where the government of a relevant jurisdiction imposes a restriction on transfers to a particular destination, Umola will comply with that restriction.

Umola retains Personal Data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including providing and maintaining the Service, operating user accounts, processing transactions, maintaining usage and token records, preventing abuse and fraud, resolving disputes, enforcing our agreements, maintaining security, and complying with applicable legal and regulatory obligations. Different categories of data may therefore be retained for different periods depending on their purpose and applicable legal requirements.

Account and profile information. Account and profile information is generally retained for as long as the account remains active. If an account is deleted, Umola will take reasonable steps to delete or anonymise applicable account information within a reasonable period, subject to information that Umola is required or permitted to retain for legal, security, fraud-prevention, dispute-resolution, or other legitimate purposes.

User Content. User-created content, including sketches, games, worlds, images, published creations, and related project data, is generally retained while the relevant account or content remains active. Content may remain in backups for a reasonable period after deletion as part of ordinary backup and recovery processes.

Generation and usage records. Records relating to AI generations, token usage, generation status, technical events, and related usage may be retained for as long as reasonably necessary to operate the Service, maintain usage and billing records, investigate errors, prevent abuse, maintain security, and comply with applicable obligations. Umola does not currently represent that these records are automatically deleted after a fixed period.

Purchase and transaction records. Information relating to purchases, payments, refunds, credits, and transactions may be retained for as long as reasonably necessary for accounting, tax, fraud prevention, dispute resolution, financial record-keeping, and compliance with applicable legal obligations.

Moderation and safety records. Records relating to content reports, moderation actions, account restrictions, abuse prevention, and related investigations may be retained for as long as reasonably necessary to enforce the Terms of Service, protect users and the Service, investigate abuse, resolve disputes, and comply with applicable obligations.

Backups and technical records. Deleted information may continue to exist for a limited period in system backups, disaster-recovery copies, security logs, or other technical systems. Such information is not ordinarily restored or used except where necessary for security, recovery, legal compliance, or other legitimate operational purposes.

When Personal Data is no longer reasonably necessary for the purposes for which it was retained, Umola will take reasonable steps to delete, anonymise, or otherwise dispose of it, subject to applicable legal, technical, security, and operational requirements.

Umola applies access controls at the database level, such that authorization is enforced independently of application logic. Uploaded images are screened prior to storage. Payment card details are never received by Umola. Credentials, including API keys, are programmatically removed from logs and error reports.

No method of transmission or storage is completely secure, and Umola cannot guarantee absolute security of personal data. Users are encouraged to use a unique, secure means of authentication and to retain independent copies of Content they consider important.

Umola will notify affected users and any competent supervisory authority of a personal data breach where required by applicable law.

Depending on the jurisdiction in which you are located, you may have some or all of the following rights in respect of your personal data:

• to obtain confirmation of, and access to, personal data held about you;
• to obtain correction of inaccurate or incomplete personal data;
• to obtain erasure of personal data, subject to the retention obligations described in Section 11;
• to obtain restriction of, or object to, certain processing;
• to receive a copy of your personal data in a portable format;
• to withdraw consent, where processing is based on consent, without affecting the lawfulness of processing before withdrawal;
• to nominate another individual to exercise these rights on your behalf in the event of death or incapacity, where applicable law provides for this; and
• to lodge a complaint with a competent supervisory authority.

A request may be submitted to support@umola.app from the email address associated with the account. Umola will acknowledge a request within a reasonable period, and in any event within the period required by applicable law, and will respond without undue delay. No fee is charged for exercising these rights, except where applicable law permits a reasonable fee for a manifestly unfounded or excessive request. Umola may decline a request that is manifestly unfounded or excessive, or that would require disclosure of another individual’s personal data.

Umola applies automated rules to detect potentially abusive usage patterns, such as an unusual rate of requests or several accounts associated with the same network address. The automatic consequence of such detection is limited to a temporary reduction in the rate at which an account may generate Content; it does not result in suspension, termination, or any other action with a legal or similarly significant effect on the user. Any decision to suspend or terminate an account, or to remove Content, is made by human review.

The Service is not directed to children below the minimum age described in Section 3 of the Terms of Service, and Umola does not knowingly collect personal data from such a child without appropriate parental or guardian consent. A parent or guardian who believes that a child has provided personal data to Umola without appropriate consent may contact Umola at support@umola.app to request deletion of the account and associated data.

Umola may update this Policy from time to time to reflect changes to the Service or to applicable law. Where a change materially affects the processing of your personal data, Umola will provide notice within the Service or by email before the change takes effect, and will update the date at the top of this document.