UrTheProduct

Legal

Privacy Notice

Last updated: July 19, 2026. This editable operational draft requires review by qualified counsel for the jurisdictions in which UrTheProduct operates.

1. Scope and controller details

This notice covers the UrTheProduct website, marketplace, checkout coordination, customer API, support, engine requests, Partner Picks, administration, and creator program. The final legal entity, address, representative, and jurisdiction-specific controller disclosures must be inserted after business and counsel review.

2. Information we collect

  • Catalog interactions, consent choice, path-only analytics events, approximate network/device data, and security logs.
  • Support and engine-request contact details, message content, project requirements, timing, and anti-spam evidence.
  • Local order reference, product/package, expected amount/currency, payment and refund status, purchase-session proof, and Whop identifiers. We do not store raw card numbers.
  • API-key public identifier, non-reversible HMAC, status, quota, expiration, and usage events; the raw reveal copy is temporarily encrypted.
  • API inputs, verified private uploads, normalized results, jobs, signed-output metadata, errors, rates, cost reservations, and abuse/security signals.
  • Creator identity/contact, concept, workflow, samples, rights/cost evidence, agreements, product/batch records, earnings, payout readiness, and review history.
  • Administrator authentication identity, actions, approvals, alerts, and audit history.

3. Why we process it

We process information to provide and secure the requested service; create and fulfill orders; authenticate keys; meter quota; run approved workflows; deliver outputs; prevent fraud and abuse; answer requests; review providers and creators; reconcile fees/refunds/earnings; maintain records; enforce terms; and comply with law. Depending on the location and context, the legal basis may be contract, steps requested before contract, legitimate interests, consent, or legal obligation.

4. Google Analytics and clean URLs

Google Analytics measurement ID G-HNBJBQBWDK loads with advertising signals and ad personalization disabled. Analytics storage is denied by default and is enabled only after “Allow analytics.” Page-view payloads contain the path without the query string. UrTheProduct also removes common referral and campaign parameters such as source, utm_*, gclid, and fbclid from inbound page URLs. Your consent choice is stored locally in the browser. See the Cookie and Analytics Policy.

5. AI processing

Inputs are routed only to the provider/model approved for the purchased workflow. Publication review records permitted operation, downstream/commercial use, region, configuration, attribution, prohibited uses, retention, cost ceiling, and approval expiry. We do not use customer inputs to activate an unreviewed provider. Provider identity may be withheld from public DTOs for security and commercial reasons, but legally required material disclosures will be made.

6. Payment processing

Whop and its financial partners independently collect and process payment, identity, fraud, tax, and dispute information under their notices. UrTheProduct receives the payment and order facts required to reconcile, fulfill, refund, prevent fraud, and keep financial records. Do not send card details through UrTheProduct forms.

7. Sharing and subprocessors

Information may be shared with hosting, database/storage, payment, approved AI, security, analytics (with consent), and professional-service providers under appropriate terms; with authorities or parties where required for law, rights, safety, fraud, or a corporate transaction; or at your direction. Partner Pick destinations are independent sites and receive a request only when you choose their redirect. We do not sell raw API keys or creator private workflows.

8. Storage, retention, and deletion

The encrypted purchase reveal expires after ten minutes or confirmation; the HMAC remains for authentication. Pending upload authorizations, private inputs, synchronous idempotent results, signed output URLs, jobs, rate/concurrency leases, and purchase sessions follow short operational expiries and cleanup jobs. Orders, usage ledgers, audit records, tax/payment evidence, disputes, security incidents, creator agreements, and payout records may remain longer when required for contract, accounting, fraud, claims, or law. A formal record-by-record retention schedule must be adopted before launch.

9. Security

Controls include server-only secrets, HMAC verification, AES-256-GCM temporary encryption, private buckets, short-lived signed URLs, MIME/magic/checksum validation, origin and rate controls, least-privilege database access, row-level security, audit logs, webhook verification, secret redaction, and publication/payment gates. No system can guarantee absolute security.

10. International transfers

Hosting, Whop, approved providers, and other subprocessors may process data outside your country. Applicable contractual, organizational, and legal safeguards must be selected based on the launched entity, provider, transfer route, and user jurisdiction.

11. Your rights and choices

Depending on applicable law, you may request access, correction, deletion, restriction, objection, portability, consent withdrawal, or information about processing, and may complain to a supervisory authority. We may verify identity and limit requests where records must be retained for payment, security, fraud, disputes, freedom of expression, legal claims, or other lawful reasons. Declining analytics does not block core service functionality.

12. Children and sensitive data

The service is not directed to a child who cannot lawfully enter the relevant transaction. Do not submit child data, special-category/sensitive data, biometric identifiers, patient records, government credentials, or regulated secrets unless the exact workflow and legal basis have been expressly approved—which current general catalog packages do not represent.

13. Requests, incidents, and changes

Send privacy requests to privacy@urtheproduct.com and security reports to security@urtheproduct.com. Never send a raw key. We will date changes and provide additional notice or consent where required.