This Privacy Policy (the "Policy") explains how Song Tao ("we", "us") handles personal data and other information in connection with MochiStamp, an AI LINE sticker creation service (the "Service"). By using the Service you agree to this Policy.
We comply with the Act on the Protection of Personal Information of Japan (APPI) and other applicable laws when handling personal data.
2. Information we collect
We collect the following information to provide the Service.
Account information
Name or nickname, email address, identifiers provided by the sign-in provider you use (for example Google), and your account settings.
Prompts, reference images and generation data
The text you enter, the style and language options you choose, any reference image you upload, the generated sticker images and ZIP files, and the status and processing logs of generation jobs.
Payment and billing information
The credit packs you purchase, amounts, transaction status and billing details. Payments are processed by Creem (Merchant of Record); we never store your full card number.
Usage and device information
IP address and the approximate region derived from it, device and browser type, pages viewed and the site that referred you (such as a search engine), interaction records, error logs and security logs.
Cookies and similar technologies
We use cookies and local storage to keep you signed in, remember preferences such as language, hold temporary work in progress and prevent abuse. You can disable them in your browser, but some features may stop working.
3. How we use information
Providing the Service, generating stickers, formatting files and creating ZIP packages
Managing accounts, verifying identity and processing payments and invoices
Saving and showing your creation history
Responding to inquiries and providing support
Detecting and preventing abuse, rights infringement and security threats
Improving quality, developing new features and analyzing usage
Meeting legal obligations
4. How we share information
We do not sell your personal data. We share information only as needed to run the Service, with the following recipients.
AI image generation, text generation and reading text back: we use OpenRouter, Inc. (USA), which passes requests to ByteDance for the Seedream image model and to inference providers for the DeepSeek text model. Processing may take place in the USA, China, Singapore and other countries.
Hosting, file storage and logs: Fly.io, Inc. (USA; data is stored on servers in the Tokyo region)
DNS for our domain and forwarding of support email: Cloudflare, Inc. (USA)
Creem, our payment provider and Merchant of Record (Armitage Labs OÜ, Estonia)
Sign-in with Google: Google LLC (USA)
Courts, government agencies and law enforcement when disclosure is required by law
5. AI processing and uploaded images
You may upload only images you own or have permission to use. Uploaded images and inputs are sent to AI providers for generation and may be stored for as long as processing requires.
We do not use your uploaded images or outputs to train AI models without your consent. OpenRouter states that it does not use inputs or outputs for model training. Some of the model providers it passes requests to may, under their own policies, keep inputs for a period and use them to improve their models.
6. Retention
We keep personal data for as long as needed to fulfill the purposes above and for any period required by law.
Account data is kept while your account is active and deleted within a reasonable time after a deletion request. Payment records are kept for 7 years under tax and accounting laws. Outputs are kept until you delete the set, and uploaded reference images until you ask us to delete them. Deleting a set removes its image files from our servers at once (backups may keep them for a few days).
7. Security
We apply reasonable technical and organizational safeguards, including access control, encrypted connections and supervision of contractors, to prevent leakage, loss or damage of personal data. No method of transmission or storage over the internet is completely secure, so please keep your sign-in details safe.
8. Your rights
You may ask us to disclose, correct, add to, delete, stop using or stop sharing your personal data.
Send requests to the contact in section 15. We will verify your identity and respond in accordance with applicable law, and will tell you in advance if a fee applies.
9. Deleting generated content
You may ask us to delete specific sticker packs or uploaded images. Deletion may be limited by legal retention duties, backup retention periods or records kept to prevent abuse.
10. Children
The Service is not intended for children under 13. Minors should use the Service with the consent of a parent or guardian. If we learn that we have collected personal data from a child under 13, we will delete it promptly.
11. International processing
AI generation, hosting, payments and other processing are carried out by providers outside Japan. The countries involved and an outline of their data protection regimes are as follows (based on materials published by the Personal Information Protection Commission of Japan and others).
USA (OpenRouter, Fly.io, Cloudflare, Google and some inference providers): there is no comprehensive federal data protection law; personal data is protected by sector-specific federal laws and state laws such as the California Consumer Privacy Act.
China (providers such as ByteDance and DeepSeek): the Personal Information Protection Law applies, but laws such as the National Intelligence Law allow government agencies to require businesses to provide information.
Singapore (some providers): the Personal Data Protection Act (PDPA) places data protection obligations on businesses.
Estonia (Creem): the EU General Data Protection Regulation (GDPR) applies, and Japan recognizes the EU as having a level of protection equivalent to its own.
We (Song Tao) operate the Service from China and take security measures in light of the Chinese regime described above.
We use these providers after reviewing their terms and data handling policies.
12. Cookies and external transmission
We do not use analytics tools or advertising tags. Information is sent from your device to external providers only when you do one of the following.
Sign in with Google: the information needed to sign in is sent to Google LLC (USA)
Buy a credit pack: the information needed for payment (the product, your email address and card details) is sent to Creem (Estonia). Card details are entered directly on the Creem checkout page and never reach us
13. Third-party links
The Service links to third-party sites such as LINE Creators Market and payment services. Their handling of personal data is governed by their own policies, for which we are not responsible.
14. Changes to this Policy
We may update this Policy when laws or the Service change. The current version is always published on this page, and we will announce significant changes within the Service. Continued use after a change means you accept the updated Policy.
15. Contact
For questions about this Policy or to exercise your rights, contact us at:
Data controller: Song Tao Address: China (the full address is provided without delay on request) Email: support@srakb.com
