Privacy notice

Optional Google Analytics

With a separate, current analytics choice, Google Analytics measures approved public pages, credit checkout starts and confirmed purchases. Google receives browser/device information, approximate location derived from the connection, the referring website’s origin, approved campaign labels, and purchase currency, amount, credit pack and a random transaction reference. We do not send your name, email, account ID, artwork, design briefs, form contents, private project URLs or sign-in tokens. Automatic form/link collection, Google signals and advertising personalization are disabled. Rejecting analytics keeps Google’s tag unloaded; browser privacy signals also disable it. Older permission for LogoTidy-only measurement does not grant permission for Google Analytics.

Google may process analytics information outside your country, including in the United States, under its applicable terms and privacy notices. Google Analytics event/user data retention is set to two months; aggregated reports may remain longer. Change your choice in Cookie settings. Withdrawal stops new collection and removes Google Analytics cookies from this browser; it does not automatically erase records already held by Google. Use Privacy requests for assistance with earlier records.

Agent API and on-chain payments

The optional Agent API uses a separate secret capability for each job; we store its hash, the uploaded image and instructions, payment authorization and transaction references, and a short-lived hashed network identifier for rate limiting. Agent uploads use the same AI and storage providers described below. Coinbase Developer Platform verifies and settles USDC payments on Base, and Stripe records the payment. Payment providers do not need the logo image for payment. Wallet addresses and transfers are public blockchain data and cannot be erased from Base.

For agent jobs, unpaid uploads are removed after 24 hours and file access ends 30 days after payment. Deletion can be delayed by active processing or an unresolved refund. Rate-limit network hashes are cleared after 24 hours. Payment records follow our accounting and legal retention criteria. The general project retention description below applies to website accounts. See /agents for the full agent workflow and terms; privacy requests can identify an agent job without a website account.

Who is responsible

LogoTidy is operated by Marvento Labs LLC, Sharjah Media City, Sharjah, UAE. We are the controller of personal data used to run accounts, billing, security, support and this website. Contact info@mlabs.ae for privacy matters.

Information we receive

You provide your email and account profile, logo uploads (including any names or other personal data in them), design briefs, generated concepts, review comments, support messages and download choices. Google sign-in, if selected, provides the identity and profile details needed to sign you in. We receive payment status, invoice and transaction references from Stripe; full card details go to Stripe, not our application database.

Our hosting and security services process connection information such as IP address, request time, browser information and error logs. With your optional measurement permission, we record a random first-party journey identifier for up to 90 days, broad device category, language, approved page names, campaign labels, referring website host, form progress without answers, milestones and page timings. Consented journeys may be linked to your verified account to report first and recent acquisition sources, purchases and refunds privately to administrators. It does not record artwork, typed form contents, full page URLs or payment card details.

Optional Google and Meta ad measurement

Google ad measurement is a separate choice, available alongside analytics. If you allow it, Google Analytics can share purchase measurements with our linked Google Ads account to connect ad clicks to purchases and help improve campaigns. We pass only supported Google ad click identifiers from the landing address (gclid, gbraid or wbraid), alongside the analytics data described above. Other query values, sign-in tokens and personal form details are excluded. Analytics-only permission does not enable advertising measurement. Google personalised advertising, Google signals and automatic matching remain disabled. With a new advertising choice, Meta Pixel receives selected page views, checkout starts and confirmed purchase amounts in LogoTidy’s dedicated dataset. It receives browser/device data and, where present, the Facebook click identifier. Your artwork, email, account details and form text are excluded. Previous Google ad permission does not enable Meta.

The essential preference cookies lt_ads_v1 and lt_meta_v1 record allow or deny for 180 days. Meta may set _fbp and _fbc advertising cookies. When permitted, Google may use _gcl_* and _gac_* cookies for advertising measurement, typically for up to 90 days. Choosing Analytics only withdraws ad measurement and removes those advertising cookies while keeping analytics. Essential only stops both purposes and clears their Google and Meta cookies. Withdrawal stops future collection; it does not automatically delete information already held by Google or Meta. Use Privacy requests for earlier records. These providers may process this information internationally under its applicable terms and privacy notices.

Purposes and legal grounds

We use account, artwork and order information to provide the service you request; billing records to meet legal obligations; and request records to respond to privacy and consumer-rights requests. Optional measurement relies on consent and can be refused without losing access to the service. Where the EU or UK GDPR applies, contract necessity covers service delivery, legal obligation covers required records, and legitimate interests cover proportionate fraud prevention, security and service troubleshooting. You may object to processing based on legitimate interests. Under UAE law we rely on consent or the relevant statutory exception, including contract performance and legal obligations, as applicable.

Account and payment details are needed to provide paid services. Without an upload or design brief, the related logo operation cannot run. Optional measurement and optional fields are not required. We do not sell personal data or use it for cross-site advertising. This notice is not permission to send marketing emails.

Providers, AI and international processing

Supabase provides authentication, our database and private file storage; the configured database region is Mumbai, India. Vercel hosts the application. OpenAI receives relevant artwork and instructions for AI analysis, generation, upgrades and quality checks, including automatic source suggestions. Resend delivers transactional email. Stripe processes payments and billing; Google provides sign-in when chosen. These providers and their subprocessors may process data outside the UAE, EEA or UK, including in the United States. Payment and identity providers also act as controllers for their own legal and security purposes.

Cross-border processing must be supported by the safeguards required by the applicable law, such as an adequacy decision or approved contractual safeguards. Contact info@mlabs.ae for information about the arrangements applying to your data and a copy of relevant safeguards. We do not promise UAE-only or EU-only processing, or zero provider retention. OpenAI states that API data is not used to train its models by default; its retention depends on the endpoint, account controls and safety obligations.

AI suggestions can be wrong and you can review or correct them. We do not use logo analysis to make decisions with legal or similarly significant effects about individuals. Only upload personal data you are entitled to share; avoid IDs, health records and other sensitive information. Business customers needing us to process personal data on their instructions should contact us to arrange a data processing agreement before uploading that material.

How long information stays

Account data remains while your account is active or until a verified deletion request is handled. Project uploads, results and conversations remain until you delete the project, subject to required records and provider backups. Setup drafts are stored in this browser, separately for each account, until completed, deleted or browser storage is cleared; they do not sync between devices. Deleting a cloud account does not clear copies in your browser or files you downloaded.

Journey measurement records are deleted after 90 days. Resolved support conversations are removed after 90 days without updates. Privacy and withdrawal request records are removed 12 months after closure unless a documented legal hold applies. Payment, tax, credit, refund and administrative records may remain for applicable accounting duties, fraud prevention or legal claims; the required period depends on the record and relevant law. Hosting, email-provider logs and backups follow provider schedules and legal holds. You can ask us which retention criteria apply to your records.

Your rights and controls

Depending on the law that applies, you can request access, a copy or portability, correction, erasure, restriction, objection to processing, or withdrawal of consent. Withdrawal does not undo earlier lawful processing. Use Privacy requests below or email info@mlabs.ae; you do not need an active account. We may verify identity proportionately before disclosing or deleting data. We respond without undue delay and aim to respond within one calendar month; where a lawful extension is needed, we explain it within that month. Requests are normally free, subject only to exceptions allowed by law.

You may complain to the relevant data protection authority, including your local EEA supervisory authority, the UK Information Commissioner or the competent UAE authority. You do not have to contact us first. Turn off measurement in Cookie settings; Global Privacy Control and Do Not Track signals also disable it. Delete individual projects in your workspace. Request account deletion through Privacy requests. Security questions and suspected data incidents can be reported to info@mlabs.ae.

Children and changes

LogoTidy is intended for adults aged 18 or over. If a child has supplied personal data, contact us so we can investigate and remove it where appropriate. We date changes to this notice and will give additional notice for material changes where required. New optional purposes require their own permission before they start.