Privacy Policy

Magical Prompt Studio — Last updated: 22 September 2026

This Privacy Policy explains what personal data Magical Prompt Studio (“we”, “us”) collects when you visit tatianalychy.com or subscribe to the Studio, and what we do with it.

We are operated by Tatiana Allen, a UK-based sole trader. Contact: tatianalychy@gmail.com. For the data described in this policy, we act as the data controller under UK GDPR.

1. What data we collect ourselves

Our website itself collects very little:

  • A sign-in cookie. When you log in through Whop, we set one small, secure cookie in your browser that just remembers which Whop account you’re signed in as, so you don’t have to log in again on every visit. It contains no card details, password, or other personal data — only an account reference, and it is encrypted/signed so it can’t be tampered with. It expires automatically after 30 days.
  • A language preference. If you switch the site between English and Russian, we remember that choice in your browser’s local storage, on your device only. We don’t send it anywhere.

We use Vercel Analytics, a privacy-friendly, cookieless visit counter, to see how many people visit the site and which pages they view. It does not use cookies, does not track you across other websites, and does not collect your name, email, or any other personally identifying information — only anonymous, aggregated visit counts. We do not run any advertising trackers, and we do not maintain our own database of customer names, emails, or payment details.

2. Service providers we use

To run the Studio, we share a small amount of data with a few outside services that process it on our behalf:

  • An AI content-generation service. When you type something into a generator (a scene description, an idea, or answers about your own offer), or upload an image to a generator, that text and/or image is sent to a third-party AI provider to produce your result. No name or email is included — only what you typed or uploaded. These providers process the content in the United States.
  • Cloud storage and hosting providers. Images that some generators create for you, and public reviews people submit (name if given, review text, rating), are stored with our hosting/cloud storage provider (processing in the United States).
  • A private notification tool. When someone submits a review, it is automatically translated by an AI service so we can read it, and a short notification (the rating, name if given, and a snippet of the text) is sent to us through a private messaging tool so we know to check it — this goes only to us, for moderation.
  • A rate-limiting service. To enforce free-use limits fairly, we store a simple usage counter linked to your IP address or account ID — no text or images, just a count.

We don’t sell this data, and we only send each provider what’s needed to run the specific feature you’re using.

3. Data collected by Whop (our payment provider)

When you subscribe, checkout is handled entirely by Whop, our payment and subscription processor. Whop collects and processes information such as your email address, name, billing address, and payment card details, in order to process payment, apply tax (VAT/sales tax) where required, and manage your subscription.

For that data, Whop acts as an independent data controller in its own right (not simply as our processor) — Whop decides how it handles payment, fraud-prevention, and tax data for its own regulatory and business purposes. We only ever see your Whop account ID and your subscription/membership status (active, trialing, cancelled) — never your card number or full billing details. For full details of what Whop collects and how it’s used, see Whop’s own Privacy Policy at whop.com.

4. What we use this data for, and our legal basis

  • To let you log in and access the Studio you’ve paid for — necessary to perform our contract with you.
  • To check that your subscription is active before letting you use the generators — necessary to perform our contract with you.
  • To respond if you contact us for support — necessary to perform our contract with you, or based on our legitimate interest in providing customer support.

We do not sell your data. We only share it with the service providers described in Section 2, Whop (to process your subscription), and, if legally required, relevant authorities.

5. How long we keep it

The sign-in cookie expires automatically after 30 days of inactivity, or immediately if you log out or clear your browser’s cookies. We don’t keep any copy of it on our own servers — it lives only in your browser.

  • Usage counters (IP address or account ID). The counters that enforce free-use limits are short-lived and expire automatically — guest counters keyed to an IP address after about 90 days.
  • Your Whop account ID and subscription status are only briefly cached (a few minutes) so we don’t re-check on every request; we keep no lasting database of them.
  • Generated images and saved galleries are kept for a limited time and then removed.
  • Public reviews you submit are kept while they are shown on the site; you can ask us to remove yours by email.

6. Your rights

If you are in the UK or EU, under GDPR you have the right to ask what personal data is held about you, ask for it to be corrected or deleted, restrict or object to how it’s used, and (where technically possible) receive it in a portable format. Since we hold almost no personal data ourselves (it’s held by Whop as an independent controller — see Section 3), most such requests about your account, billing, or subscription should go to Whop directly. For anything relating to our own website (the cookie, language preference, or service providers described above), email tatianalychy@gmail.com and we’ll help.

If you’re not satisfied with how we’ve handled your data, you have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk, or your local data protection authority if you’re outside the UK.

7. Cookies and local storage

We use only essential cookies, strictly necessary for the service to work — no tracking or advertising cookies, so no separate consent is required under UK/EU cookie law. Our visit counter is cookieless. The cookies we set are:

  • whop_session — keeps you signed in after you log in through Whop; expires after 30 days.
  • whop_oauth_pkce — a short-lived security cookie used only during the sign-in step; expires after 10 minutes.
  • seasonal_session — links your Seasonal Miniatures gallery to your browser; expires after 1 year.

We also use your browser’s local storage, on your device only, for small conveniences — such as your language choice and some apps’ recent history. This never leaves your device and we cannot read it.

8. Children

The site and its tools are intended for adults (18+). They are not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, email tatianalychy@gmail.com and we will delete it.

9. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we’ll update the “Last updated” date above.

10. Contact

For questions about this policy or your data, email tatianalychy@gmail.com.