Mnml

Users represent they hold rights to content they upload and retain ownership of it. The policy frames uploaded images as user content and does not claim ownership over inputs.

Generated assets are assigned to the user for personal or commercial use for paid users. However, free-user generations may be displayed publicly on a community page, which qualifies the practical exclusivity of ownership for free users.

The privacy policy and security page both commit not to use uploaded images or outputs for AI model training without explicit consent. Service improvement uses anonymized data only. This is a favorable, clearly stated position.

The policy specifies account data is retained while active and deleted within 30 days of a deletion request, with financial records kept up to 7 years by law. The security page adds users can request deletion of outputs, logs, and sessions via support.

The policy discloses sharing with cloud hosting, third-party AI processing providers, Lemon Squeezy (payments), and Google (auth), all contractually bound to protect data, and explicitly denies selling data or sharing with advertisers. However, the specific list of third-party AI providers is only available to enterprise customers on request, limiting consumer transparency into where inputs are processed.

Users can withdraw consent to marketing and optional analytics at any time, disable cookies, and exercise GDPR rights including objection to legitimate-interest processing. Training use requires opt-in consent, so it is off by default.

The vendor claims GDPR, CCPA, and APPI alignment and states its infrastructure partners hold SOC 2 Type II and ISO 27001, and offers to provide SOC 2 reports and DPA documentation on request. These are claimed/partner-held rather than vendor-held attestations evidenced in the supplied text, so they cannot be treated as vendor certifications. No ISO 42001, NIST CSF, or EU AI Act references appear.

The documents describe comprehensive activity/audit logging and role-based access with export capabilities, which support operational auditing. However, there is no disclosure about model behavior transparency, how the AI models work, or the ability to audit model decisions/outputs.

The security page and privacy policy disclose AES-256 at rest, TLS 1.3 in transit, hashed passwords, access controls, DDoS protection, 24/7 monitoring, and a 72-hour breach notification commitment. A dedicated security page and status page are referenced, and security reports/DPA are available on request. No breach history is disclosed.

There is a material free-vs-paid delta: free-user generations may be made public in the community gallery and commercial-use asset assignment is stated for paid users, while paid/enterprise plans get slower/faster support tiers and enterprise-only sub-processor lists. Enterprise/Team accounts shift ownership to the organization and the DPA/MSA governs data handling, but consumers face weaker transparency (AI provider list withheld from non-enterprise).

The documents do not explicitly grant staff a right to read user prompts or outputs, but free-user images are curated and selected for public showcasing, which implies human review of at least some generated content. There is no explicit statement about human access to private content for moderation or support.

The documents are silent on government/law-enforcement data requests and disclose no litigation. Governing law is UAE (Dubai) with exclusive jurisdiction in Dubai courts, which may limit remedies for users elsewhere, though mandatory local consumer-protection rights and injunctive relief are preserved. The silence on legal-request handling lowers confidence.

The collected data is limited and clearly enumerated: email, optional name, hashed password, Google profile data, uploaded/generated images, usage data, and technical data (IP, browser, device). Payment card data is not stored (handled by Lemon Squeezy). No sensitive SPI categories are collected, and purposes are defined with legal bases.

All policy documents are dated Last Updated: June 23rd, 2026, well within 12 months of the 2026-08-10 analysis date. The privacy policy explicitly addresses AI image generation, third-party AI processing providers, and integrations consistent with the product surface (SketchUp/Revit/Blender rendering, image generation), demonstrating coverage of the AI capabilities shipped.

Three consumer documents (Terms, Privacy Policy, Security page) were supplied and are consistent on key points: no-training-without-consent, 72-hour breach notice, EU/multi-region storage, encryption, and 30-day deletion. No material or critical contradictions were found across them; minor differences (e.g., EU-primary storage in privacy policy vs. multi-region on security page) are reconcilable as primary-plus-redundancy descriptions.