Privacy Policy

The data controller for GuiMint (the website, the Figma plugin, the Roblox Studio plugin, the API and the GuiMint Discord bot) is the operator named in Contact. We follow the EU General Data Protection Regulation (GDPR).

Your account

• Email address, username, display name and profile picture.
• Your password, stored only as a one-way hash. We never see the password itself.
• Your settings, such as whether you want marketing emails (off by default).

Linked accounts

• Roblox: your Roblox user ID and username, and the access tokens that let us upload images to your inventory. Tokens are stored encrypted.
• Discord: your Discord user ID and username (the identify scope only). We do not read your messages, servers or email.

What you make with GuiMint

• Figma frames you convert, the images in them, import codes, saved UIs and library items.
• The Roblox asset IDs of images uploaded for you, so the same image is not uploaded twice.

Payments

• Your plan, payment history and Stripe customer ID. Card details go straight to Stripe and never reach our servers.

Usage and security

• Conversion counts, to apply the daily limit of the Free plan.
• Security logs: IP address, account and the event (for example failed logins or blocked requests), to stop abuse.
• Page views without cookies: the page, the referring site and the device type, plus a daily code made from your IP address and browser. The code changes every day, so we can count visitors but not follow you from day to day.
• If you arrive through an affiliate link, which affiliate referred you.

• To provide the service (account, conversions, uploads, plugins, Discord linking): performance of our contract with you, GDPR Art. 6(1)(b).
• Payments, invoices and accounting: contract and legal obligation, Art. 6(1)(b) and (c).
• Security, abuse prevention and statistics: our legitimate interest in keeping GuiMint safe and improving it, Art. 6(1)(f).
• Marketing emails: only with your consent, Art. 6(1)(a). You can withdraw it at any time in your account settings.

We do not sell your data. We share it only with services needed to run GuiMint:

• Stripe processes payments (privacy policy).
• Roblox receives the images you choose to upload through Open Cloud (privacy policy).
• Discord confirms your account when you link it (privacy policy).
• Figma runs the GuiMint plugin inside its app (privacy policy).
• Our hosting provider, which stores the data on our behalf.
• Authorities, when the law requires it.

Some of these companies are in the United States. Transfers are covered by the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

We use no advertising or tracking cookies, so there is no cookie banner. We use only:

• guimint_session: a necessary cookie that keeps you logged in, for up to 7 days.
• guimint_ref in your browser's local storage: the affiliate code of a link you came through, removed when you create an account.

• Account data: until you delete your account.
• Import codes: they stop working after a short time (30 minutes at most).
• Security logs and page-view statistics: as long as needed for security and statistics, at most 12 months.
• Payment and accounting records: as long as accounting law requires (6 years in Finland).

You have the right to:

• see the data we hold about you and get a copy of it,
• correct wrong data,
• delete your data. You can do this yourself in Account settings → Deactivate My Account. Images already uploaded to Roblox stay in your Roblox inventory, and Roblox controls them,
• restrict or object to processing based on legitimate interest,
• get your data in a machine-readable format (data portability),
• withdraw consent at any time,
• complain to a data protection authority. In Finland this is the Data Protection Ombudsman; you can also contact the authority in your own country.

Email us to use these rights. We reply within one month.

GuiMint is not meant for children under 13, and we do not knowingly collect their data. If you are under the age of digital consent in your country (16 in some EU countries, 13 in Finland), a parent or guardian must agree to your use. If you believe a child has given us data, contact us and we will delete it.

Passwords are hashed, linked-account tokens are encrypted and all traffic uses HTTPS. No system is perfectly secure, but if a breach affects your data, we will tell you and the authorities as the law requires.

If we change this policy, we update the date at the top. For important changes we tell you by email or on the website before they take effect.

GuiMint is operated by HUEHUE, Finland.

Email: guimintstudio@gmail.com · Discord: join our server