Privacy at KawaiiDraw

Controller

The controller responsible for processing personal data within the meaning of the General Data Protection Regulation (GDPR) is:

In short

KawaiiDraw has no user accounts and no forms. The text you enter for an image goes to an image service; I don't store it. The site runs advertising (Google AdSense) and statistics (Google Analytics). Both only set cookies after you have agreed in Google's consent dialog.

There is no automated decision-making that affects you legally, and I don't build a profile of you.

When you open the site

When you open the site, your browser sends details the site cannot be delivered without: IP address, date and time, the requested address, the previous page and the browser identifier.

The site is hosted at Netlify. Cloudflare sits in front of it: it encrypts the connection, blocks attacks and produces aggregated traffic statistics (Cloudflare Web Analytics, without cookies). Cloudflare inserts a small script into the page for this. The image function limits requests per minute and briefly keeps your IP address and browser identifier in memory for that, with no file or database.

The legal basis is Art. 6(1)(f) GDPR. My legitimate interest: delivering the site securely, limiting abuse and seeing how often it is opened. How long the providers keep their logs follows their own terms.

Cloudflare, Inc.

101 Townsend St., San Francisco, CA 94107, USA

Data may be transferred to the USA. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework; the legal basis is the European Commission’s adequacy decision (Art. 45 GDPR).

Provider’s privacy policy

Netlify, Inc.

101 2nd Street, San Francisco, CA 94105, USA

Data may be transferred to the USA. Netlify, Inc. is certified under the EU-U.S. Data Privacy Framework; the legal basis is the European Commission’s adequacy decision (Art. 45 GDPR).

Provider’s privacy policy

Creating images

When you generate an image, the text you enter (at most 500 characters) is sent together with my fixed image template through my server to Cloudflare Workers AI. If that service fails, the request may go to Hugging Face. The image is created there and returned to you. Your text and the image are not stored on my side. Extra text you place on the image is added in your browser only and never leaves it.

So don't type names or other personal details into the input field that you don't want to pass on. What the two providers do with the input is described in their privacy notices.

The legal basis is Art. 6(1)(b) GDPR: without passing it on I cannot create the image.

Cloudflare, Inc.

101 Townsend St., San Francisco, CA 94107, USA

Data may be transferred to the USA. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework; the legal basis is the European Commission’s adequacy decision (Art. 45 GDPR).

Provider’s privacy policy

Hugging Face, SAS

9 rue des Colonnes, 75002 Paris, France

Provider’s privacy policy

Consent for ads and statistics

On your first visit Google shows a consent dialog (Funding Choices). Until you decide, advertising and statistics cookies are blocked through Google Consent Mode. During that time Google Analytics may still send requests without cookies.

Google stores your decision in a cookie (FCCDCF). The legal basis is Art. 6(1)(a) GDPR and, for storing and reading on your device, section 25(1) TDDDG. You can withdraw at any time: click "Privacy settings" at the bottom of the page and the dialog opens again.

Google Ireland Limited

Gordon House, Barrow Street, Dublin 4, Ireland

Data may be transferred to the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework; the legal basis is the European Commission’s adequacy decision (Art. 45 GDPR).

Provider’s privacy policy

Advertising

KawaiiDraw runs Google AdSense. If you have consented, Google may use cookies and advertising identifiers to load ads and may process details such as IP address and device information. Google decides which data exactly; it does not flow back to me.

If you have not agreed, the Consent Mode restrictions apply. The legal basis is your consent (Art. 6(1)(a) GDPR, section 25(1) TDDDG).

Google Ireland Limited

Gordon House, Barrow Street, Dublin 4, Ireland

Data may be transferred to the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework; the legal basis is the European Commission’s adequacy decision (Art. 45 GDPR).

Provider’s privacy policy

Statistics

I use Google Analytics 4 to see which pages are opened and how long visitors stay. Your browser sends page views, shortened IP details and device information to Google. Analytics only sets cookies after your consent.

The legal basis is Art. 6(1)(a) GDPR and section 25(1) TDDDG. How long Google keeps the data depends on the setting in the Analytics account; I cannot document that value here.

Google Ireland Limited

Gordon House, Barrow Street, Dublin 4, Ireland

Data may be transferred to the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework; the legal basis is the European Commission’s adequacy decision (Art. 45 GDPR).

Provider’s privacy policy

Children

KawaiiDraw is meant for families creating coloring pages for children. An adult should give the consent for ads and statistics. If you are under 16, ask your parents before you agree in the dialog.

I don't ask for personal details and there are no accounts. A child should not type a real name into the input field, because the text goes to the image service.

Storage on your device

KawaiiDraw itself sets no cookies and writes nothing to browser storage. A short image cache lives only in the memory of the open page and disappears when you close it.

Cookies come from Google (your consent decision, and with consent advertising and statistics) and from Cloudflare (technically necessary security cookies, where set). Reading technically strictly necessary cookies is allowed by section 25(2) no. 2 TDDDG.

Links to other sites

The site links to Buy Me a Coffee in case you want to support the project. By clicking you leave KawaiiDraw; the provider's own notice applies to data there.

Your rights

You have the right of access to your data (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object to processing based on legitimate interests (Art. 21). An email to the address above is enough.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example in the country where you live.