Legal

Privacy Policy

Last updated: October 20, 2026

1. About Us

Maat Scan is operated by Hoot Hall LLC.

2. Information We Collect

Uploaded Images

Images uploaded for analysis are processed in memory on Maat Scan's servers and are discarded from our servers as soon as the analysis is complete. We do not write them to disk or store them in any database on our servers. To analyze an image, we send a resized copy to Google's Gemini API, and Google retains that copy for up to 55 days to detect policy violations and for legally required disclosures. See Section 4 for details.

* For Standard and Pro subscribers, a small thumbnail image is saved in Firebase Storage to enable scan history. See Section 5 for details.

File Metadata

When you upload an image, we analyze the file's embedded metadata (such as EXIF camera data, XMP properties, C2PA content credentials, and image file headers) to detect markers of AI generation or editing. If such markers are found, the name of the detected tool (e.g., "Stable Diffusion") is included in your analysis result. This metadata is processed only in memory on our servers and is not stored separately. If a tool name is detected, it may be included in the text we send to Gemini to write your result comment (see Section 4).

Account Information

When you sign in with Google or Apple, we receive your email address and the user ID provided by the authentication provider. We do not store your password.

Usage Data

We record scan counts, plan information, and other data necessary to provide the service. Image content is not included. For users who watch ads to earn bonus scans, we also record the number of bonus scans available and the number of ads watched today (reset daily at UTC midnight).

Anonymous Session Data

If you use the Service without signing in, we assign a Firebase anonymous user ID and store a scan counter and related fields in Firestore: the number of scans used, the session creation date and an expiration date, and, in the mobile app, the bonus scan balance, the day's ad-view and photo-labeling counts, and the client platform. Website data is automatically deleted 30 days after it is created; mobile app data is automatically deleted 30 days after it was last used. We also set a first-party cookie (maat_trial, 180 days) containing a random identifier used solely to count trial scans in this browser.

Rate Limiting

To prevent abuse, we use Upstash, Inc. to enforce request limits. We send Upstash your IP address (for scans made without signing in, sign-in, feedback, and browser security reports) or your Maat Scan user ID (for actions taken while signed in, such as scans, payments, data export, and account deletion) as a rate-limit key. Upstash retains each key only for the duration of the rate-limit window (up to 24 hours). Maat Scan does not log your IP address separately from the standard access logs described below. See Section 4 for details.

Access Logs

Standard server logs including IP address, browser information, and access timestamps are collected for security and troubleshooting purposes. These logs are recorded by our hosting providers, Vercel and Google Cloud (see Section 4).

3. How We Use Your Information

Computing and displaying naturalness scores
Storing scan history (Standard and Pro subscribers only)
Operating, improving, and troubleshooting the service
Managing scan quotas and processing payments
Preventing fraud and unauthorized use
Complying with applicable laws
Featuring user-consented scorecard images on social media and the Maat Scan website (only where explicit consent has been provided via the scorecard download modal)
Managing anonymous trial scan quotas and enforcing rate limits to prevent abuse

4. Third-Party Services

We do not sell your personal information. We share data only with the following services necessary to operate Maat Scan:

Google Gemini API (Important)

We use the Gemini API, provided by Google, for AI image analysis, and we entrust the analysis of uploaded images to Google. Because the images may be handled by Google group companies, including Google LLC in the United States, we treat this as a provision of personal data to a third party in a foreign country under Japan's Act on the Protection of Personal Information (APPI) and provide the following information.

Recipient: Google LLC (United States) and its affiliates
What we send: A copy of your uploaded image, resized so that its longest side is no more than 768 pixels and converted to JPEG. The copy does not include EXIF data, such as the date taken or location information, or comments embedded in the file. To improve accuracy depending on the initial analysis, or to switch models during a temporary outage, the same image may be processed by more than one Gemini model within our API account. We also use Gemini to write the comment shown with your result; for that step we send only the scores and analysis results (including the name of any editing or AI tool detected in the file metadata), not the image.
How Google handles it: We use the paid Gemini API. Under the Gemini API Additional Terms of Service and Google's Data Processing Addendum, Google processes images on our behalf, only within the scope of our instructions, and does not use them to improve its products. Separately, Google retains prompts (including images) and responses for 55 days solely to detect and prevent violations of its Generative AI Prohibited Use Policy and for legally required disclosures, and authorized Google employees may review content flagged as a possible violation. According to Google, this retained data is not used to train or fine-tune any AI models other than those used specifically for policy enforcement.
Country where processing takes place: Under Google's terms, data may be processed or temporarily stored in any country where Google or its subprocessors maintain facilities, so we cannot identify in advance the country in which a particular image will be processed. Google LLC is located in the United States. Google publishes the locations of its data centers.
Laws in the United States that may affect Google's measures: In the survey published by Japan's Personal Information Protection Commission (based on information as of October 2021), no regime requiring companies to store personal information within the country, and no regime obliging companies to cooperate with government information gathering in a way that may significantly affect individuals' rights, is listed for the United States (federal) or for California, where Google LLC is located. However, the United States has laws under which government agencies can require companies to disclose information for national security or criminal investigation purposes, such as the Foreign Intelligence Surveillance Act (FISA) and the CLOUD Act. We treat these as laws that may affect the measures Google takes and include them in our periodic checks. The United States has no comprehensive federal law on the protection of personal information; personal information is protected by sector-specific federal laws and by state laws such as the California Consumer Privacy Act. The United States participates in the APEC Cross-Border Privacy Rules (CBPR) System. For details, see the survey of foreign personal information protection systems published by the Personal Information Protection Commission (in Japanese).
Legal basis and our measures: Google has established its system through its contract with us: the Gemini API Additional Terms of Service and Google's Data Processing Addendum. These require Google to handle images only within the scope of our instructions (except where applicable law requires otherwise), implement security measures including encryption, maintain ISO/IEC 27001 certification or other appropriate measures, ensure that its personnel are bound by confidentiality, bind its subprocessors by written contract to the same terms, notify us of security incidents promptly and without undue delay, assist us in responding to requests from individuals, and delete data when the service ends. If an incident that must be reported occurs, we will report it to the Personal Information Protection Commission and notify the affected individuals. On this basis, we have determined that Google has established a system meeting the standards under Article 28(1) of the APPI (Article 16, item 1 of the Enforcement Rules), and we provide images to Google as an entrustment of data processing. At least once a year, we check how Google is implementing these measures by reviewing Google's terms, Data Processing Addendum, and security certifications and documentation, and we check whether any foreign laws that may affect those measures exist, and what they provide, by reviewing information published by government bodies in Japan and abroad, including the Personal Information Protection Commission. As of September 29, 2026, we have not identified any obstacle to Google's implementation of these measures. If an obstacle arises, we will take necessary and appropriate action, and if continued implementation of these measures can no longer be ensured, we will stop providing images to Google.
Requesting further information: Under the APPI, the individual concerned, including a person shown in an uploaded image who does not use Maat Scan, may request further information, such as how Google's system was established, an overview of Google's measures, how often and by what method we check them, the foreign laws that may affect them, and whether there are any obstacles to their implementation and how we are addressing them. Please contact support@hoothall.com. We will respond without undue delay.

Google's terms: Gemini API Additional Terms of Service / Data Processing Addendum / Abuse monitoring

We also entrust the handling of personal data to the service providers below, which are located outside Japan. As with the Gemini API, we treat each of these as a provision of personal data to a third party in a foreign country under the APPI and provide the following information. For all of them, the section "Laws in the United States that may affect Google's measures" above also describes the United States system that applies, and you may request further information in the same way.

Firebase and Google Cloud (Google)

Recipient: Google LLC (United States) and its affiliates
What we provide and why: Firebase Authentication: your email address, the user ID provided by Google or Apple, and sign-in records, including the IP address and browser information that Firebase Authentication records. Cloud Firestore: account information, plan information, scan counts, scan results (scores and analysis results, not images), anonymous session data, and bonus-scan data. Cloud Storage for Firebase: thumbnails saved for scan history (Standard and Pro plans only). Cloud Run and Cloud Logging: our analysis server, which holds uploaded images in memory only while analyzing them, and its access logs, which include IP addresses. We use these services to sign you in, store your account and scan history, and run the analysis.
How Google handles it: Under the Google Cloud Platform Terms of Service and the Cloud Data Processing Addendum, which cover all of the services above, Google processes this data on our behalf as our processor, only to provide, secure, and monitor the services in accordance with our instructions. Firebase Authentication also uses IP addresses and browser information to protect accounts and prevent abuse, and keeps logged IP addresses for a few weeks.
Country where processing takes place: Firebase Authentication: United States only. Cloud Firestore and Cloud Run: Japan (Tokyo region). Cloud Storage for Firebase (thumbnails): United States (Iowa region). Cloud Logging: our logs are stored in Google's "global" location, which is not tied to one country, so we cannot identify the country in advance. Under Google's terms, data may also be processed in any country where Google or its subprocessors maintain facilities, within the locations we select for each service. Google LLC is located in the United States.
Legal basis and our measures: The Cloud Data Processing Addendum requires Google to process data only in accordance with our instructions, implement technical, organizational, and physical security measures, maintain ISO/IEC 27001 certification and SOC 2 and SOC 3 reports, ensure that its personnel are bound by confidentiality, bind its subprocessors by written contract, notify us of security incidents promptly and without undue delay, assist us in responding to requests from individuals, and delete data when the service ends. On this basis, we have determined that Google has established a system meeting the standards under Article 28(1) of the APPI (Article 16, item 1 of the Enforcement Rules), and we provide this data to Google as an entrustment of data processing. At least once a year, we check how Google is implementing these measures and whether any foreign laws affect them, in the same way as for the Gemini API. As of September 29, 2026, we have not identified any obstacle. If an obstacle arises, we will take necessary and appropriate action, and if continued implementation of these measures can no longer be ensured, we will stop providing data to Google.

Google's terms: Cloud Data Processing Addendum / Privacy and Security in Firebase

Stripe (payments)

Recipient: Stripe, LLC (United States). Our payment services agreement is with Stripe Japan, Inc. (Japan), and Stripe Payments Europe, Limited (Ireland) is also a party for the processing of personal data.
What we provide and why: To process payments for paid plans, we provide your email address, your Maat Scan user ID, and the plan you selected, and we exchange your Stripe customer ID and subscription status with Stripe. Your card number and other payment details are entered directly on Stripe's payment page. We do not receive or store them.
How Stripe handles it: Under the Stripe Services Agreement and Stripe's Data Processing Agreement, Stripe processes this data on our behalf and in accordance with our instructions to provide payment services. Stripe also uses this data as an independent controller for its own purposes, such as fraud monitoring and prevention, managing loss and security risks, complying with anti-money-laundering and other legal requirements, and improving its services. For those purposes, Stripe handles the data under its own privacy policy.
Country where processing takes place: Stripe's Data Processing Agreement provides that personal data is transferred to Stripe, LLC in the United States. Stripe also uses service providers in other countries, which it lists publicly. Ireland is a member of the European Union, which the Personal Information Protection Commission has designated as having a personal information protection system equivalent to Japan's.
Legal basis and our measures: Stripe, LLC holds Global Cross-Border Privacy Rules (CBPR) certification. In addition, Stripe's Data Processing Agreement requires Stripe to process data in accordance with our instructions, limit access to personnel who need it and bind them to confidentiality, bind its subprocessors to comparable obligations, notify us of security incidents without undue delay, assist us in responding to requests from individuals, and delete data when the agreement ends. Stripe is certified to PCI DSS Level 1. On this basis, we have determined that Stripe has established a system meeting the standards under Article 28(1) of the APPI (Article 16, items 1 and 2 of the Enforcement Rules). We provide data to Stripe as an entrustment of data processing for payment processing. Stripe's use of the data for its own purposes goes beyond that entrustment, so we provide the data for those purposes only with your consent, which we ask for before you proceed to payment. We check Stripe's measures at least once a year in the same way as for the Gemini API, and we have not identified any obstacle as of September 29, 2026.

Stripe's terms: Data Processing Agreement / Privacy Policy / Service providers

Upstash (rate limiting)

Recipient: Upstash, Inc. (United States)
What we provide and why: To prevent abuse, we send your IP address or your Maat Scan user ID as a rate-limit key, as described in Section 2. Upstash keeps each key, with a count of recent requests, only for the rate-limit window (up to 24 hours).
How Upstash handles it: Under Upstash's Data Processing Agreement, Upstash processes this data on our behalf as our processor, only in accordance with our written instructions.
Country where processing takes place: Under Upstash's terms, data may be processed globally, including by its cloud infrastructure providers, so we cannot identify in advance every country in which it is processed. Upstash, Inc. is located in the United States.
Legal basis and our measures: Upstash's Data Processing Agreement requires Upstash to process data only in accordance with our written instructions, bind its personnel by written confidentiality agreements, implement security measures, require its subprocessors to provide at least an equivalent level of protection, notify us of confirmed security incidents without undue delay, assist us in responding to requests from individuals, and return or delete data when the agreement ends. On this basis, we have determined that Upstash has established a system meeting the standards under Article 28(1) of the APPI (Article 16, item 1 of the Enforcement Rules), and we provide this data to Upstash as an entrustment of data processing. We check Upstash's measures at least once a year in the same way as for the Gemini API, and we have not identified any obstacle as of September 29, 2026.

Upstash's terms: Data Processing Agreement / Privacy Policy

Vercel (website hosting)

Recipient: Vercel Inc. (United States)
What we provide and why: Our website and its server functions run on Vercel. All requests to maatscan.com pass through Vercel, including your IP address, browser information, and access times, your sign-in token (which contains your user ID and email address), and images you upload on the website. Vercel passes images to our analysis server without storing them.
How Vercel handles it: Under Vercel's Data Processing Addendum, Vercel processes this data on our behalf as our processor, only in accordance with our documented instructions.
Country where processing takes place: Our server functions run in the United States (Washington, D.C. area). Requests are first received at the Vercel location nearest to you, which for users in Japan is usually in Japan. Under Vercel's terms, its primary processing facilities are in the United States, and data may be processed in any country where Vercel or its subprocessors operate.
Legal basis and our measures: Vercel's Data Processing Addendum requires Vercel to process data only in accordance with our documented instructions, bind its personnel to confidentiality, implement security measures including encryption and maintain a SOC 2 Type 2 report, bind its subprocessors by written agreement to substantially similar obligations, notify us of security incidents without undue delay, assist us in responding to requests from individuals, and delete data when the agreement ends. On this basis, we have determined that Vercel has established a system meeting the standards under Article 28(1) of the APPI (Article 16, item 1 of the Enforcement Rules), and we provide this data to Vercel as an entrustment of data processing. We check Vercel's measures at least once a year in the same way as for the Gemini API, and we have not identified any obstacle as of September 29, 2026.

Vercel's terms: Data Processing Addendum

Google Analytics and Google AdSense (cookies and similar identifiers)

We use Google AdSense to display advertisements on the Service. Google AdSense may use cookies and similar technologies to serve ads based on your prior visits to this or other websites. You can opt out of personalized advertising by visiting Google Ads Settings. For users in the EEA, UK, and Switzerland, a consent banner will be shown before ads are displayed. We also use Google Analytics (see Section 11).

For both services, Google collects cookie identifiers and browsing information directly from your browser through Google's tags on our pages. We do not send Google your name, email address, Maat Scan user ID, or uploaded images for these services, and we do not link these identifiers to your account. Under the APPI, information of this kind is generally treated as personally referable information (個人関連情報), not personal data. Because Google collects it directly, we do not provide it to Google, and Google handles it under its own privacy policy. Google states that where it links such information with personal data it holds, it obtains the individual's consent itself. See Google's statement on the APPI.

5. Image Data Handling

Free Plan and Credit Packs

On Maat Scan's servers, uploaded images exist only in memory during processing
Images are deleted from our servers' memory after analysis (typically within seconds)
We do not write image files to storage or databases on our servers
Maat Scan staff cannot view your images

Standard and Pro Plans

A reduced-size thumbnail is saved in Firebase Storage (United States; see Section 4) to enable the scan history feature
Thumbnails are accessible only to you via your account
Original full-size images are not stored on our servers — only the thumbnail
Thumbnails are deleted when you delete your account or upon request

On every plan, a resized copy of each uploaded image is sent to Google's Gemini API for analysis, and Google retains it for up to 55 days to detect policy violations and for legally required disclosures. We cannot delete that copy before the period ends. See Section 4.

6. Cookies

We use cookies issued by Firebase to maintain your authentication session. We also set a first-party cookie (maat_trial, 180 days) to count anonymous trial scans per browser; this cookie contains only a random identifier and is strictly necessary to enforce the free-tier scan limit. We also use Google AdSense, which may set cookies to serve relevant advertisements. AdSense cookies are subject to Google's Privacy Policy. Users in the EEA, UK, and Switzerland will be asked for consent before any ad-related cookies are set.

7. Your Rights

You may request access to, correction of, or deletion of your personal data (including account information, scan history, and thumbnail images) at any time. Contact us at support@hoothall.com and we will respond within a reasonable timeframe after verifying your identity.

Please note that copies of images retained by Google under its Gemini API abuse-monitoring policy (up to 55 days; see Section 4) cannot be deleted by us before that period expires.

8. Security

We protect your information through HTTPS/TLS encryption, Firebase security rules, and access controls. We conduct periodic security reviews to prevent unauthorized access, leaks, or data loss.

Understanding the external environment

We handle personal data in the following foreign countries, including through the service providers we entrust with it. We take our security measures after understanding the personal information protection systems of these countries.

United States: Google LLC (Firebase Authentication, thumbnail storage in Cloud Storage for Firebase, Gemini API), Stripe, LLC (payments), Upstash, Inc. (rate limiting), and Vercel Inc. (website hosting)
Ireland: Stripe Payments Europe, Limited (payments)
Countries that cannot be identified in advance: the Gemini API, Cloud Logging, and Upstash may process data in any country where the provider or its subprocessors maintain facilities. All of these providers are located in the United States.

Cloud Firestore and Cloud Run store and process data on servers in Japan (Tokyo region), but the provider, Google LLC, is located in the United States. For the United States system, see "Laws in the United States that may affect Google's measures" in Section 4. Ireland is a member of the European Union, which the Personal Information Protection Commission has designated as having a system equivalent to Japan's.

9. Users Under 18

Maat Scan is intended only for people aged 18 and older. If you are under 18, please do not use the Service. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from someone under 18, we will take steps to delete it without undue delay. If you believe that someone under 18 is using the Service, please contact us at support@hoothall.com.

10. Changes to This Policy

We may update this policy in response to legal changes or service updates. For material changes, we will notify you through the service. Continued use after changes constitutes acceptance of the updated policy.

11. Analytics (Google Analytics 4)

We use Google Analytics 4 (GA4), a web analytics service provided by Google LLC, to understand how visitors use Maat Scan. GA4 collects the following data and transmits it to Google's servers:

Cookie identifiers (anonymous client ID)
Pages viewed and features used
Device type, operating system, and browser
Approximate geographic location (country / region level, derived from IP address)

According to Google, GA4 does not log or store IP addresses; it uses them only to estimate approximate location. No names, email addresses, Maat Scan user IDs, or uploaded images are sent to Google Analytics. For how this data is treated under the APPI, see "Google Analytics and Google AdSense" in Section 4. The purpose of collection is site usage analysis to improve the service.

Data recipient: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. For users in the EEA, UK, and Switzerland, analytics storage defaults to denied in accordance with Consent Mode v2; no analytics data is collected until consent is granted.

For more information on how Google handles this data, see Google's partner sites policy.

12. Copyright / DMCA Takedown Notices

If you believe that content on Maat Scan infringes your copyright, please send a written notice to our designated DMCA agent:

Service Provider: Hoot Hall LLC (Maat Scan)

DMCA Registration: DMCA-1070963

Designated Agent Email: support@hoothall.com

Your notice must include: (1) identification of the copyrighted work; (2) identification of the infringing material and its location; (3) your contact information; (4) a good-faith belief statement; and (5) a statement of accuracy under penalty of perjury. We will respond expeditiously to valid notices.

13. Contact

For privacy-related inquiries, contact us at support@hoothall.com.