Privacy Notice

In compliance with the Mexican Federal Law on Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, LFPDPPP), Jhonatan Villagómez Vázquez, an individual and the data controller for PersonCraft, contact personcraft@zohomail.com, provides you with the following privacy notice.

1. Data we collect

• Email address and password (the password is stored encrypted — PersonCraft never sees it in plain text).
• The character and scene descriptions you write to generate content ("prompts").
• The images, videos and 3D models the AI generates from your descriptions.
• Payment data — Stripe processes and stores your payment method; PersonCraft only receives confirmation of the charge, never the card number.
• If you sign in with Google or Discord: the email, name and profile picture that service shares with us. We never receive your password for those services.
• The images you upload to train or import a character. If they show a real person, upload them only with that person's express consent. We use them only to generate that character, never to identify anyone.
• The game projects you save: design, code, files and verification results.
• Basic technical data (IP address, request time) to prevent abuse and enforce rate limits.
• Aggregated visit statistics (page views, country, device type) through Vercel Analytics, without advertising cookies.

2. What we use your data for

• Running the service: creating your account, generating your characters and scenes, tracking your credit balance.
• Processing your payments and subscriptions.
• Answering your support requests.
• Preventing abuse and fraud (rate limits, content moderation).
• Measuring, in aggregate, which pages are visited to improve the site.

All of these purposes are necessary to provide the service. We do not use your data for secondary purposes such as third-party advertising or commercial profiling; if we ever did, we would ask you first and you could refuse without losing the service.

3. Who we share your data with

PersonCraft uses the following providers ("data processors") to run the service. Each one receives only the data it needs for its function:

• Supabase — database, authentication and storage of your images/videos/models.
• fal.ai — receives your descriptions and images to generate content with AI. For some models, fal passes them to the model developer (Black Forest Labs, Google, Kuaishou, ElevenLabs, CassetteAI or Tripo AI), which processes them on its own servers in the United States, China or other countries.
• Tripo AI — receives your character's image to generate and animate its 3D model.
• Stripe — processes payments and stores your payment method.
• Resend — sends your sign-in emails and account notifications.
• Vercel — hosts the application and runs your game verifications in isolated environments (Vercel Sandbox).
• GitHub — runs automated maintenance and verification jobs that process your game code.
• Upstash — rate-limits requests to prevent abuse.
• Sentry — receives technical reports when something fails, so it can be fixed.
• Google and Discord — only if you choose to sign in with them; they confirm your identity.

We do not sell your data to third parties for advertising. Some of these providers process data on servers outside Mexico (international data transfer) as a normal part of running a cloud service.

If you connect an external AI (for example Claude or ChatGPT) through MCP, that AI receives what you share with it and what PersonCraft returns about your projects, and handles it under its own privacy policy. You choose which AI to connect and can revoke its access from your account.

4. Your ARCO rights

Under Mexican data protection law you hold what are known as ARCO rights over your personal data — Access, Rectification, Cancellation and Opposition. These are the rights defined by the LFPDPPP; they are broadly comparable to, but not identical with, the rights granted under other regimes such as the GDPR. You can exercise them at any time:

• From your account, you can cancel your PersonCraft plans and delete your characters, generations, stored files, profile and API keys. Contact support if deletion does not complete.
• Any other request (access, rectification, opposition): write to personcraft@zohomail.com.

Payment and credit records are retained for auditing and dispute handling. A sign-in identity shared with other services is not deleted from PersonCraft; contact our privacy address to request its complete deletion. Files sent to external providers follow their retention periods. Copies downloaded or shared outside the service cannot be withdrawn from PersonCraft.

5. Cookies and similar technologies

We use necessary cookies to keep you signed in and to protect forms. Vercel Analytics visit statistics do not use cookies or identify individuals. We do not use advertising or social-media cookies.

6. Changes to this notice

If we change this notice in any material way, we will notify you by email or inside the app before it takes effect.

7. Contact

Questions about this privacy notice: personcraft@zohomail.com.