Last updated: 5 October 2026
This is a courtesy translation. Only the French version is legally binding.
This policy explains how the ThumbLead service (https://thumblead.com, the "Service") processes your personal data, in accordance with the GDPR and the French Data Protection Act (loi Informatique et Libertés).
1. Data controller
- Enzo Violante, sole trader (micro-entreprise)
- 6 rue Émile Barthe, 34500 Béziers, France
- SIRET: 948 968 318 000 14
- Contact: contact@thumblead.com
2. User data
We process your identity (name, e-mail address, profile picture if you sign in with Google), your hashed password (never stored in plain text), your plan and the status of your subscription as transmitted by Stripe, your searches and their history, the channels saved in My leads and your notes, your client records, your orders and the files you attach to them, the events in your agenda, your Inspiration library, your Feedback links and their content, your support requests, your preferences (language, theme) and technical logs (IP address, date, errors).
We neither see nor store your credit card numbers, which are processed directly by Stripe. The Crash test, In the feed, Colors and Showcase tools of the Studio run in your browser: the image you load into them is not sent to our servers.
3. Purposes and legal bases
This data is used to create and manage your account, provide the features and quotas, manage the subscription and send you service e-mails (the link to confirm your e-mail address at sign-up, the password reset link, Feedback responses, replies from support, a Pro trial ending reminder sent only once, 2 days before the trial ends): this processing is based on the performance of the contract (Art. 6.1.b GDPR). The retention of accounting records is based on a legal obligation (Art. 6.1.c). Security, abuse prevention and error diagnosis are based on our legitimate interest (Art. 6.1.f).
We display no advertising, sell no data and use no visitor analytics tools.
4. Users' clients (Feedback links)
A user may send their client, who needs no account, a private link valid for 7 days to approve or correct a thumbnail. If you are that client and you respond, we record your drawings and text on the image, your notes (2,000 characters maximum), any voice messages (no more than 2 per submission, 2 minutes each, only if you allow microphone access), your decision and the dates of opening and submission.
This data is used solely to pass your feedback on to the user (legitimate interest). Under our Terms of Use, the user undertakes to inform you of this. When the link expires or is deleted, the image, its versions and all your content are erased; only a technical record (date, status) is kept. You may exercise your rights with the user or at contact@thumblead.com, stating the link concerned.
5. YouTube channel owners
Search contains only information drawn from publicly available YouTube data: channel name, public statistics, thumbnails, public links and business e-mail address where the channel displays it publicly. A score is calculated from these figures alone. This processing, based on legitimate interest, helps thumbnail professionals identify channels. The Service sends no messages to channels.
The thumbnails in Inspiration are public YouTube thumbnails, tagged by an AI (Google Gemini) from the public images and titles alone. You may object to this processing and request the removal of your channel by writing to contact@thumblead.com.
6. Recipients and processors
Your data is accessible only to the publisher and, where necessary, to the following providers:
- Railway Corporation: hosting of the application and the database (United States);
- Stripe: payments and billing;
- Google: sign-in with Google, YouTube Data API, Gemini API (without user data), Gmail for service e-mails, Google Fonts (which receives your IP address);
- YouTube: display of thumbnails from its servers (i.ytimg.com), which receive your IP address;
- Sentry, where applicable: tracking of technical errors.
Transfers outside the European Union, in particular to the United States for hosting, are governed by the European Commission's standard contractual clauses or by the EU-US Data Privacy Framework.
7. YouTube API and sign-in with Google
ThumbLead uses YouTube API Services. YouTube data is subject to the YouTube Terms of Service and the Google Privacy Policy. If you sign in with Google, we receive only your name, your e-mail address and your profile picture. You may revoke this access on the Google permissions page, which does not delete your ThumbLead account.
8. Retention periods
Your account, usage and support data are kept for as long as your account exists and are erased as soon as it is deleted. Feedback content is erased no later than 7 days after the link is created. Technical logs are kept for no more than 12 months. Accounting records are kept for 10 years (Art. L123-22 of the French Commercial Code). Public information about YouTube channels is kept for as long as it is useful to the catalogue or until an objection is made.
9. Security
We apply measures appropriate to the risk: hashed passwords, encrypted exchanges (HTTPS), unguessable and time-limited Feedback links, restricted access. In the event of a breach presenting a risk to your rights, we notify the CNIL and, where necessary, inform you.
10. Your rights
You have the rights of access, rectification, erasure, portability, objection and restriction, as well as the right to set instructions regarding the handling of your data after your death.
You may delete your account at any time from Settings > Privacy > Delete account, after confirmation: the account and all its data are erased immediately and your Stripe subscription is terminated, subject to the accounting records kept under a legal obligation. For other rights, write to contact@thumblead.com. We reply within one month.
You may lodge a complaint with the CNIL: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.
11. Cookies
The Service uses only strictly necessary cookies and local storage (sign-in session, security, language, preferences), which are exempt from consent: no banner is therefore displayed. No advertising or audience measurement cookies are used. Details are provided in the Cookie Policy.
12. Minors and changes
The Service is reserved for adult professionals and is not intended for minors. If we learn that a minor has provided us with data, we delete it. This policy may change; in the event of a significant change, users are informed by e-mail or within the Service.