This Privacy Policy (the "Policy") explains how the operator of MochiStamp ("we", "us") handles personal data and other information in connection with MochiStamp, an AI LINE sticker creation service (the "Service"). By using the Service you agree to this Policy.
We comply with the Act on the Protection of Personal Information of Japan (APPI) and other applicable laws when handling personal data.
2. Information we collect
We collect the following information to provide the Service.
Account information
Name or nickname, email address, identifiers provided by the sign-in provider you use (for example Google), and your account settings.
Prompts, reference images and generation data
The text you enter, the style and language options you choose, any reference image you upload, the generated sticker images and ZIP files, and the status and processing logs of generation jobs.
Payment and billing information
The credit packs you purchase, amounts, transaction status and billing details. Payments are processed by Creem (Merchant of Record); we never store your full card number.
Usage and device information
IP address and the approximate region derived from it, device and browser type, pages viewed and the site that referred you (such as a search engine), interaction records, error logs and security logs.
Cookies and similar technologies
We use cookies and local storage to keep you signed in, remember preferences such as language, hold temporary work in progress, prevent abuse and measure how the Service is used (Google Analytics). You can disable them in your browser, but some features may stop working.
3. How we use information
Providing the Service, generating stickers, formatting files and creating ZIP packages
Managing accounts, verifying identity and processing payments and invoices
Saving and showing your creation history
Responding to inquiries and providing support
Detecting and preventing abuse, rights infringement and security threats
Improving quality, developing new features and analyzing usage
Meeting legal obligations
4. How we share information
We do not sell your personal data. We share information only as needed to run the Service, with the following recipients.
AI image generation, text generation and reading text back: we use OpenRouter, Inc. (USA), which passes requests to ByteDance for the Seedream image model and to inference providers for the DeepSeek text model. Processing may take place in the USA, China, Singapore and other countries.
Hosting, file storage and logs: Fly.io, Inc. (USA; data is stored on servers in the Tokyo region)
DNS for our domain and forwarding of support email: Cloudflare, Inc. (USA)
Creem, our payment provider and Merchant of Record (Armitage Labs OÜ, Estonia), which also checks the text you enter before anything is generated (content moderation)
Sign-in with Google and site analytics (Google Analytics): Google LLC (USA)
Courts, government agencies and law enforcement when disclosure is required by law
5. AI processing and uploaded images
You may upload only images you own or have permission to use. Uploaded images and inputs are sent to AI providers for generation and may be stored for as long as processing requires.
We do not use your uploaded images or outputs to train AI models without your consent. OpenRouter states that it does not use inputs or outputs for model training. Some of the model providers it passes requests to may, under their own policies, keep inputs for a period and use them to improve their models.
Images uploaded to the free tools (image converter, sheet splitter) are only processed on our server to convert them; they are not sent to AI providers and are not kept after processing.
6. Retention
We keep personal data for as long as needed to fulfill the purposes above and for any period required by law.
Account data is kept while your account is active and deleted within a reasonable time after a deletion request. Payment records are kept for 7 years under tax and accounting laws. Outputs are kept until you delete the set, and uploaded reference images until you ask us to delete them. Deleting a set removes its image files from our servers at once (backups may keep them for a few days).
7. Security
We apply reasonable technical and organizational safeguards, including access control, encrypted connections and supervision of contractors, to prevent leakage, loss or damage of personal data. No method of transmission or storage over the internet is completely secure, so please keep your sign-in details safe.
8. Your rights
You may ask us to disclose, correct, add to, delete, stop using or stop sharing your personal data.
Send requests to the contact in section 15. We will verify your identity and respond in accordance with applicable law, and will tell you in advance if a fee applies.
9. Deleting generated content
You may ask us to delete specific sticker packs or uploaded images. Deletion may be limited by legal retention duties, backup retention periods or records kept to prevent abuse.
10. Children
The Service is not intended for children under 13. Minors should use the Service with the consent of a parent or guardian. If we learn that we have collected personal data from a child under 13, we will delete it promptly.
11. International processing
AI generation, hosting, payments and other processing are carried out by providers outside Japan. The countries involved and an outline of their data protection regimes are as follows (based on materials published by the Personal Information Protection Commission of Japan and others).
USA (OpenRouter, Fly.io, Cloudflare, Google and some inference providers): there is no comprehensive federal data protection law; personal data is protected by sector-specific federal laws and state laws such as the California Consumer Privacy Act.
China (providers such as ByteDance and DeepSeek): the Personal Information Protection Law applies, but laws such as the National Intelligence Law allow government agencies to require businesses to provide information.
Singapore (some providers): the Personal Data Protection Act (PDPA) places data protection obligations on businesses.
Estonia (Creem): the EU General Data Protection Regulation (GDPR) applies, and Japan recognizes the EU as having a level of protection equivalent to its own.
We operate the Service from China and take security measures in light of the Chinese regime described above.
We use these providers after reviewing their terms and data handling policies.
12. Cookies and external transmission
To understand how the Service is used and improve it, we use Google Analytics, an analytics tool provided by Google LLC (USA). When you open a page of the Service, your device sends the following to Google.
The address of the page (without URL parameters, except the utm parameters that identify campaigns) and the site that referred you
Browser and device type, screen size, language setting, and your IP address (Google states that it uses it only to estimate your approximate region and does not store it)
Interactions on the page, such as scrolling and clicking links to other sites, and the time of your visit
A random ID stored in a cookie to recognize your browser
We never send your name, email address, the text you enter or the images you upload to Google Analytics, and we do not use advertising tags. See Google’s explanation of how it handles this information. To stop it, use the Google Analytics Opt-out Browser Add-on or disable cookies in your browser.
Apart from this, information is sent from your device to external providers only when you do one of the following.
Sign in with Google: the information needed to sign in is sent to Google LLC (USA)
Buy a credit pack: the information needed for payment (the product, your email address and card details) is sent to Creem (Estonia). Card details are entered directly on the Creem checkout page and never reach us
13. Third-party links
The Service links to third-party sites such as LINE Creators Market and payment services. Their handling of personal data is governed by their own policies, for which we are not responsible.
14. Changes to this Policy
We may update this Policy when laws or the Service change. The current version is always published on this page, and we will announce significant changes within the Service. Continued use after a change means you accept the updated Policy.
15. Contact
For questions about this Policy or to exercise your rights, contact us at:
Data controller: the operator of MochiStamp Address: China The name of the operator and the full address are provided without delay on request. Email: support@mochistamp.com
為了解本服務的使用情況並加以改善，我們使用 Google LLC（美國）提供的流量分析工具 Google Analytics。開啟本服務的頁面時，你的裝置會將以下資訊傳送給 Google。
瀏覽的頁面網址（除了用來辨識行銷活動的 utm 參數，不傳送網址參數）和來源網站
瀏覽器和裝置類型、螢幕大小、語言設定，以及 IP 位址（Google 表示只用來推斷大致地區，不會保存）
在頁面上的操作（例如捲動、點擊連往其他網站的連結）和瀏覽時間
存在 Cookie 中、用來辨識瀏覽器的隨機 ID
我們不會將你的姓名、電子郵件地址、輸入的文字或上傳的圖片傳送給 Google Analytics，也不使用廣告標籤。Google 如何處理這些資訊，請參閱 Google 的說明。如要停止傳送，可以安裝 Google 提供的 Google Analytics 停用外掛程式，或在瀏覽器中停用 Cookie。
