My Badge Studio Privacy Policy

1. Introduction and Overview

My Badge Studio (“we”, “our” or “us”) runs the website mybadgestudio.com, the badge and magnet design studio, and related services (together, the “Service”). This policy is written to meet the data protection laws that apply to us, including the EU and UK General Data Protection Regulation (GDPR), India’s Information Technology Act and its rules, and the California Consumer Privacy Act (CCPA).

Who is responsible for your data. The data controller is My Badge Studio. You can contact us at support@mybadgestudio.com. Section 10 lists our Grievance Officer.

2. Information We Collect

What we collect depends on how you use the Service.

2.1 Account and Registration Information

You can create an account with an email address and password, or sign in with your Google account. We store your name and email address. If you use Google sign-in, Google shares your name and email address with us. Passwords are handled by Google Firebase Authentication; we never see or store your password in readable form.

When you sign up we also record your country (used for pricing in your local currency and to meet sanctions rules), the IP address you signed up from, and a device fingerprint (see section 2.7).

2.2 Payment and Billing Information

Subscriptions and one-time purchases (watermark-free download packs and AI credit packs) are paid through our payment processor, Razorpay. Razorpay collects your card or other payment details. We do not receive or store your card number. We keep a record of each payment, such as what you bought, the amount, the date and Razorpay’s reference for it. If you are in the EU or EEA, we also record that you agreed to start using the paid service straight away (see our Refund Policy).

2.3 Uploaded Content

We collect and store images, logos, and text that you upload to create badge and magnet templates. Uploads are held for as long as you keep them in the studio. On paid plans, designs you choose to save to My designs are stored in your account until you delete them; otherwise uploads remain only for the working session unless you save a project file to your own device. If you create a share link for a saved design, anyone who has that link can open a copy of the design, including its images, until you stop sharing or delete the design.

In the Badge Designer, your design stays in your browser unless you choose to create a share link or, on the Business Plus and Business Pro plans, to save it to your account. Saved designs stay until you delete them or your account. A share link stores a picture of the design, with its name and size, on our servers for 90 days from when you create or last update it. Anyone who has the link can see the picture, and those with a plan or a pass can add it to the Studio or download it. You can stop sharing from the browser that made the link, which deletes the picture straight away.

We do not sell your uploads, and we do not use them for advertising.

2.4 AI Photo Tools and Image Processing

When you use an AI feature — AI Edit, Remove Background or Centre Face — the image you selected, and any instruction you typed, are sent to Google and processed by the Google Gemini models in order to return the edited image to you. Centre Face detects the position of a face in your photo so the badge can be cropped around it.

These features run only when you choose to use them. If you never open an AI tool, your images are not sent to Google for this purpose. Your use of these features is also subject to Google’s own terms and privacy notice for its AI services.

2.5 Client and Event Portal Submissions

Business Plus and Business Pro customers can share a link or QR code that lets their own clients and event guests design a badge and submit it. If you submit a design through such a page, the name, contact details and images you provide are sent to the business that shared the link, and are stored in that business’s account on our platform so they can fulfil your order. To ask what is held about you, or to have it deleted, please contact that business directly, or contact us and we will help.

2.6 Support Chat

If you use the chat on our website, we store your name, your email address (if you give it), your messages, and any photos, videos or files you send. They are kept with the conversation in our database. The text of your messages is sent to Google Gemini to write an instant automatic reply. A member of our team also reads chats and replies in person.

2.7 Device Fingerprint and Abuse-Prevention Data

When you sign up, your browser computes a device fingerprint: a SHA-256 hash made from characteristics of your browser and device, such as how it draws canvas and WebGL graphics, how it processes audio, and hardware details like screen size and processor count. The same device usually produces the same fingerprint.

For live accounts we store, in a separate abuse-prevention record, your email address in a normalised but readable form, your device fingerprint and your sign-up IP address. We use these only to stop people claiming the free allowance again and again with repeat sign-ups. We do not use the fingerprint for advertising or to track you across other websites.

2.8 Reviews and Feedback

When you rate My Badge Studio in the feedback pop-up, we store your star rating, any comment you write, the first name you type (or “Anonymous” if you leave it blank) and your country. We may show your rating, comment, that first name and your country as a review on our website and in our marketing. We never show your email address or account details. We read every review before it appears and may shorten it or correct obvious typing mistakes without changing its meaning. If you would rather your review was not shown, or want it changed or taken down, contact us at any time and we will do so.

Subscribers may also be asked, once, what else their business makes and what problems they face. Only our team reads these answers; we use them to decide which tools to build next and never publish them. We keep your email address with your answer only if you tick that we may email you about it.

3. How We Use Your Information

We use your information to run the Service, give you support, take payments, keep the platform secure, and improve our features.

Fraud and abuse prevention. We check each new sign-up against the abuse-prevention records described in section 2.7, and against the hashed records kept after account deletion (section 8). This stops the free monthly allowance from being collected repeatedly through duplicate or re-created accounts. An account flagged this way still works normally and can use all paid features — it just does not receive the free allowance.

Marketing and advertising audiences. If — and only if — you opted in to email marketing (when you signed up or later), we may use your contact details, primarily your email address, to send you our own creative tips and offers, and to create Custom Audiences and Lookalike Audiences on Meta (Facebook and Instagram), so we can show our ads to you and to new people who are similar to you. Before it is shared with Meta, your email address is irreversibly hashed — turned into a one-way code that Meta cannot read back into an address. Meta uses it only to match against accounts it already has, and is not permitted to use it for its own purposes. We never do this with customers who have not opted in to marketing, and we never sell your data. You can opt out at any time: switch off Marketing communications under Privacy & Communication Preferences on your account page, use the unsubscribe link in any marketing email, or email support@mybadgestudio.com — we will stop and remove you from these advertising audiences. Opting out never affects your account or your access to any feature.

Measuring our ads (Meta Conversions API). If you consent to marketing cookies/communications, we also send Meta a hashed (SHA-256) email address, your IP address and browser user agent when you sign up or buy, to measure our ads (Meta Conversions API). If you have not given that consent, we do not send these events.

3.1 Legal Bases

Where the GDPR or similar laws apply, we rely on these legal bases:

• Contract — to create and run your account, store your designs, run AI tools you ask for, process payments, send account and order emails, and answer your support requests.
• Legitimate interests — to prevent fraud and abuse of the free tier (device fingerprint, sign-up IP, email checks and the hashed deletion guard), to keep the Service secure (for example bot checks and error monitoring), to answer chat visitors who do not have an account, and to improve the Service. You can object to this processing (section 8).
• Consent — for analytics cookies, the Meta Pixel, the Meta Conversions API, marketing emails and Meta advertising audiences. You can withdraw consent at any time through Cookie Settings in the footer or the preferences on your account page. Withdrawing does not affect processing that happened before.
• Legal obligation — to keep payment and invoice records for tax and accounting, to apply sanctions rules, and to respond to lawful requests from authorities.

4. Cookies and Similar Technologies

We use cookies and similar browser storage. When you first visit, a banner lets you choose which categories to allow. Only the essential category is switched on by default — analytics, marketing and email categories stay off unless you turn them on. You can change your choice at any time via Cookie Settings in the footer.

• Essential. Required for the platform to work — signing in, keeping your session, and security. These cannot be switched off.
• Analytics. Google Analytics, to understand how the site is used. Until you allow this category, our analytics tag runs in a restricted mode that does not store analytics cookies on your device.
• Marketing. The Meta (Facebook) Pixel, used to measure our campaigns. This loads only after you allow the marketing category. The server-side Meta Conversions API described in section 3 also depends on your consent.
• Email communication. Your preference for receiving product updates and offers.

We also use your browser’s local storage and IndexedDB to remember your cookie choice and to keep your unsaved studio work on your own device so it is not lost if you reload the page. That design data stays in your browser and is not sent to us unless you save or export it.

5. Service Providers We Share Data With

We rely on the following providers to run the Service. They receive only what they need for their function, and are not permitted to use your data for their own unrelated purposes.

• Google (Firebase). Sign-in (including Google sign-in), database, file storage and hosting — this is where your account, uploads and support chats live.
• Google (Gemini AI). Processes your images and instructions when you use an AI photo tool (section 2.4), and the text of support chat messages to write automatic replies (section 2.6).
• Google reCAPTCHA (through Firebase App Check). Checks that requests come from our genuine website, to block bots. Google receives technical information about your browser and device for this.
• Razorpay. Payments for subscriptions and one-time packs. We do not store card numbers.
• Google Analytics. Usage measurement, subject to your cookie choice.
• Meta. Campaign measurement through the Meta Pixel and the Meta Conversions API (only with your consent); and, for customers who opted in to email marketing, matching an irreversibly hashed copy of your email address to build Custom and Lookalike advertising audiences, as described in section 3. Meta may use this data only to perform the match, not for its own purposes.
• Zoho ZeptoMail and Resend. Delivery of account, order, support and newsletter emails.
• Sentry. Error reports, so we can diagnose crashes.
• Google Fonts. The studio, storefronts and client portals load fonts from Google’s servers, so Google sees your IP address when they load.
• QR Server (api.qrserver.com). Creates the QR code images shown in the seller dashboard. It receives the link encoded in the QR code and the IP address of the person viewing it.
• Square (and PayPal, if enabled). Payment options in sellers’ storefronts. A seller connects their own account, and the buyer’s payment is handled by that provider.

Pages that embed video or social content (for example YouTube or Instagram) may cause those providers to see your IP address when the embed loads.

6. International Data Transfers

My Badge Studio is used worldwide. Your data may be processed in the United States and other countries outside your own by the providers listed in section 5. These countries may have different data protection laws. We rely on the safeguards those providers offer for international transfers under their standard data processing terms.

7. How Long We Keep Your Data

• Account data (name, email, country, sign-up IP, device fingerprint, preferences): while your account is active. Deleted when you delete your account.
• Uploads and saved designs: as described in section 2.3, and in any case deleted when you delete your account.
• Support chats: chats linked to your account are kept until your account is deleted. You can ask us to delete any chat earlier.
• Client submissions and orders received by a seller: while the seller’s account exists, unless the seller deletes them sooner.
• Abuse-prevention records for live accounts (section 2.7): while the account exists. Deleted when the account is deleted.
• Hashed deletion guard (section 8): 12 months after account deletion, then deleted.
• Payment and invoice records: as long as tax and accounting law requires.
• Analytics and advertising data held by Google Analytics and Meta: according to those services’ own retention settings.

8. Your Data Rights

Depending on where you live, you have the right to:

• access your personal data and get a copy of it;
• correct data that is wrong;
• delete your data;
• receive your data in a portable format;
• restrict how we use your data;
• object to processing based on our legitimate interests, and to direct marketing at any time;
• withdraw consent at any time, where we rely on consent;
• complain to a data protection authority — for example Italy’s Garante per la protezione dei dati personali, or the authority in your own country.

How to exercise them. You can delete your account yourself at any time from the Delete account option on your account page — no need to contact us. You can also email support@mybadgestudio.com from the address your account is registered under, telling us what you would like — for example a copy of your data, or deletion of your account. We will confirm receipt, verify that the request comes from the account holder, and act on it within one month.

Account deletion. Deleting your account is permanent. It removes your sign-in record (including your email address), your profile, your uploads and saved projects, your support chats, your portal and storefront data, and the abuse-prevention record described in section 2.7. Any active subscription is cancelled immediately, and the rest of the paid period is lost.

Kept afterwards: payment and invoice records that tax and accounting law requires us to keep (only if you made a purchase), and one hashed deletion guard. The guard holds a keyed one-way hash (HMAC) of your email address, which cannot be turned back into the address, together with your device fingerprints. It is kept for 12 months and then deleted. Its only purpose is to stop the free monthly allowance from being claimed again by deleting and re-creating accounts; we keep it on the basis of our legitimate interest in preventing abuse. It contains no readable email, no name, no IP address and no usage history. Community posts are anonymised rather than removed, so conversations other users took part in are not destroyed; anonymised posts no longer identify you. Your email address is free to use again for a new account — a new account within the 12-month window simply starts without the free allowance, and paid features are unaffected.

Cancelling a subscription does not require contacting us — you can cancel future renewals at any time from your account page, and deleting your account also ends your subscription.

9. Children

The Service is not directed at children under 13, and children under 13 should not create an account. If you are under the age of digital consent in your country (for example 14 in Italy, 16 in some other EU countries, or 18 in India), you need permission from a parent or guardian to use the Service.

Schools, parents and others who upload photos of children must have the right to do so, including the consent of a parent or guardian where needed. Our Terms of Service (section 3.2) require this for any identifiable minor.

If we learn that we have collected a child’s personal data without the required consent, we will delete it. Please tell us at support@mybadgestudio.com.

10. Contact and Grievance Officer

For any privacy question or request, email support@mybadgestudio.com.

Grievance Officer (India). Under India’s Information Technology Act and its rules, you can contact our Grievance Officer at support@mybadgestudio.com (subject line: “Grievance”). We aim to acknowledge complaints within 24 hours and resolve them within 15 days.