# SketchMonkey — Privacy Policy > **Effective Date:** September 30, 2026 > **Data Controller:** Neural Deep Network Ltd · European Union (Malta) > **Contact & Data Protection Officer:** [3d@neuraldeep.net](mailto:3d@neuraldeep.net) > **Platform URL:** [https://sketchmonkey-neuraldeepnet.adaptive.ai](https://sketchmonkey-neuraldeepnet.adaptive.ai) > **API Origin:** [https://sketchmonkey-neuraldeepnet.on.adaptive.ai](https://sketchmonkey-neuraldeepnet.on.adaptive.ai) At SketchMonkey (a product of Neural Deep Network Ltd), we believe in privacy-first, ethical software engineering. We design our systems to minimize data collection, protect intellectual property, and comply fully with the European Union General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). --- ## 1. Information We Collect ### A. Anonymous Studio Visitors - **Zero Mandatory Registration:** You can use SketchMonkey anonymously without creating an account or providing an email address. - **Rate-Limiting Telemetry:** To protect GPU compute and prevent denial-of-service attacks, we process an anonymized cryptographic hash of your client IP address and an ephemeral session key. This data is used solely for rate-limiting and is purged on a rolling 24-hour cycle. ### B. Registered Account Holders - **Platform Identifiers:** When you sign in via the Adaptive platform, we receive an authenticated platform user ID, handle, and display name. SketchMonkey does not store raw passwords. - **Project & Generation Data:** Design briefs, prompt history, curated mood board visual anchors, and generated media artifacts are stored in your private SQLite database. ### C. Billing & Payment Information - All payment processing is handled by **Stripe Inc.** (PCI-DSS Level 1 certified). - We receive and store only non-sensitive tokens (e.g., Stripe customer ID `cus_...`, subscription ID `sub_...`, and transaction references). - **We NEVER see, process, or store credit card numbers or bank credentials.** ### D. ChatGPT Plugin & Model Context Protocol (MCP) Clients - When you invoke SketchMonkey via the ChatGPT Plugin, custom GPT actions, or the MCP server (`/api/mcp`), we process only the parameters explicitly transmitted by your AI client (e.g., prompt, creative lens, aspect ratio). - We do **not** receive your OpenAI account credentials, email, or broader chat history. - Prompts processed via the ChatGPT Plugin are used strictly to synthesize the requested visual concept and return the render result. --- ## 2. How We Use Your Data We process your data exclusively for the following legitimate purposes: 1. **Fulfilling Generative Design Requests:** Transmitting design briefs and CMF parameters to generative AI inference pipelines (Google AI Studio, Veo 3.1) to render images and video turnarounds. 2. **Account & Subscription Management:** Tracking daily generation allowances, processing plan renewals, and enforcing quota tiers. 3. **Product Security & Abuse Prevention:** Enforcing fair-use limits and blocking automated attacks. 4. **Zero AI Model Re-Training:** **We DO NOT sell your prompts, generated imagery, or project assets to third parties. We DO NOT use your proprietary designs to train public foundational AI models without your explicit consent.** --- ## 3. Third-Party Service Providers & Sub-Processors We partner exclusively with trusted, security-certified sub-processors: - **Google AI Studio (Google LLC):** Generative image rendering and Google Veo 3.1 video generation. Data transmitted is processed under enterprise data protection terms. - **Stripe Inc.:** Payment processing, subscription lifecycle, and customer portal. - **Adaptive Platform:** Cloud hosting, serverless execution, and encrypted database infrastructure. --- ## 4. Cookies & Local Storage SketchMonkey does **not** use third-party advertising cookies, cross-site trackers, or marketing pixels. We utilize standard browser local storage and session storage exclusively for essential operational preferences: - Interface theme preference (dark/light mode). - Active project and creative lens selection. - Chunk-reload protection and error boundary recovery. --- ## 5. Your Rights Under GDPR & CCPA Under applicable data protection laws, you possess the following rights: - **Right of Access (Article 15 GDPR):** Request a copy of your personal data held by us. - **Right to Rectification (Article 16 GDPR):** Correct inaccurate or incomplete profile information. - **Right to Erasure / "To Be Forgotten" (Article 17 GDPR):** Delete your account, project history, and generated gallery items at any time. - **Right to Data Portability (Article 20 GDPR):** Export your generated high-resolution assets and artboards in standard formats (PNG, MP4, JSON). - **Right to Object / Restrict Processing:** Object to data processing or withdraw consent. To exercise any of these rights, email **[3d@neuraldeep.net](mailto:3d@neuraldeep.net)**. We respond to and fulfill all verified requests within 30 calendar days at zero cost. --- ## 6. Data Security & Retention - **Encryption in Transit:** All traffic to and from SketchMonkey is strictly encrypted via TLS 1.3. - **Database Isolation:** User projects and generations are housed in isolated, encrypted SQLite instances with automated daily health audits. - **Retention Period:** Active user data is retained as long as your account remains open. Upon account deletion, all associated project records and generated images are permanently deleted within 14 days. --- ## 7. Updates to This Policy We may update this Privacy Policy from time to time to reflect evolving platform capabilities or regulatory requirements. Any substantive modifications will be reflected with a revised "Effective Date" at the top of this document. For privacy-related inquiries, contact our Data Protection team at: **Neural Deep Network Ltd** Email: [3d@neuraldeep.net](mailto:3d@neuraldeep.net)