Privacy

Last updated: 18 October 2026

This English version is a convenience translation. Only the German version is legally binding. In case of any discrepancy, the German version prevails.

1. Controller

The controller for data processing on this website is Infynu Engineering Group UG (haftungsbeschränkt), Hellseifen 12, 57518 Betzdorf, Germany, represented by its managing director Dogus Ünsalan, email: info@doodlhero.com, phone: +49 1567 8818489. DoodlHero is a service of Infynu Engineering Group UG (haftungsbeschränkt).

We have not appointed a data protection officer because the legal requirements for doing so are not met.

2. Summary

• For the free preview, we process your drawing and your email address; for an order, we also process your order, delivery and payment data.
• Two AI services create the preview automatically: Replicate creates an image of the figure from your drawing, and Tencent Cloud creates the 3D model from that image. In the process, your drawing is also processed in the USA and the generated image in Singapore (section 5.4).
• We only use analytics and advertising services from Google, TikTok and Meta if you consent in the cookie banner.
• We do not send a newsletter.
• Please send any requests about your data to info@doodlhero.com. You will receive a reply within one month.

3. Legal bases

We process personal data on the basis of

• Art. 6(1)(b) GDPR (contract and pre-contractual measures, in particular preview, order and shipping),
• Art. 6(1)(a) GDPR (consent, in particular analytics and marketing services and the publication of photos),
• Art. 6(1)(c) GDPR (legal obligation, in particular retention obligations under commercial and tax law),
• Art. 6(1)(f) GDPR (legitimate interests, in particular the secure operation of the website and the handling of warranty claims).

Storing information on your device and accessing it, for example through cookies, is additionally governed by § 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG).

4. Hosting and server log files

Our website and our order system with its database run on servers of Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, in the Falkenstein data centre (Germany). Hetzner processes the data on our behalf; a data processing agreement under Art. 28 GDPR is in place. When you visit the website, the following data is recorded automatically: IP address, date and time, page visited, referrer URL, browser type and version, and operating system. We process this data to provide the website, to ensure its secure operation and to defend against attacks (Art. 6(1)(f) GDPR). We delete the log files after 14 days.

Error reports (Rollbar)

If a technical error occurs in our order system, the service Rollbar of Rollbar, Inc. (USA) receives an error report. It contains the type of error, the time and internal identifiers of the process, such as your order number. Fields such as name, email address, IP address, access keys and cookies are masked before sending; your drawing is not transmitted. Rollbar processes the reports on our behalf (Art. 28 GDPR). The transfer to the USA is based on the EU-US Data Privacy Framework, under which Rollbar, Inc. is certified. The legal basis is our legitimate interest in error-free and secure operation (Art. 6(1)(f) GDPR). Rollbar deletes the reports after 30 days.

5. Free preview

5.1 What data we process

The uploaded image file (JPG, PNG or WebP) without metadata (section 5.5), your email address, the chosen set, the time of the upload, your change requests and technical identifiers of your request (section 9). When you upload, we also store which version of our privacy notice was shown to you, together with the time, your IP address and your browser identifier (user agent).

5.2 Purpose and legal basis

We create the 3D preview, send you the link, make the changes you request and prepare the order (Art. 6(1)(b) GDPR, pre-contractual measures at your request). We do not ask for consent for this.

We also use your email address and your IP address to limit misuse: no more than three previews can be created per email address and per IP address within 24 hours. The stored privacy notice shows that we informed you before the upload. In both cases the legal basis is our legitimate interest in protecting the services in section 5.4, which cost us money for each preview, against misuse, and in being able to provide proof (Art. 6(1)(f) GDPR).

5.3 Storage of the drawing with Backblaze

We store the uploaded file in the Backblaze B2 cloud storage of Backblaze, Inc., 2261 Market Street STE 81006, San Francisco, CA 94114, USA, in a data centre in the USA. Your drawing is kept there in a non-public area. We and the services in section 5.4 only access it via links that expire after one hour. Backblaze processes the data on our behalf (Art. 28 GDPR). The transfer to the USA is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework, under which Backblaze is certified (Art. 45 GDPR); in addition, our contract with Backblaze contains the European Commission's standard contractual clauses.

The image of the figure and the 3D model created from your drawing (section 5.4) are also stored in this non-public area, and we show them to you in your preview via links that expire after one hour.

5.4 Creation of the preview by Replicate and Tencent Cloud

Your preview is created automatically in two steps.

In the first step, the service Replicate of Replicate, LLC, 101 Townsend Street, San Francisco, CA 94107, USA, creates an image of the figure from your drawing. For this, Replicate retrieves your drawing via a link that expires after one hour. Replicate deletes the inputs and results of our request after one hour. Replicate processes the data on our behalf and only to create the image (Art. 28 GDPR). The transfer to the USA is based on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR), which we have agreed with Replicate.

In the second step, the Hunyuan 3D service of Tencent Cloud creates the 3D model from this image. Tencent only receives the generated image, not your drawing and no contact details. Our contractual partner is Tencent Cloud Europe B.V., Buitenveldertselaan 1-5, 1082 VA Amsterdam, Netherlands; the image is processed in a data centre in Singapore. Under our contract, Tencent does not use the data to train AI models. Tencent provides the link to the finished model for 24 hours; we transfer the model to our storage (section 5.3). Tencent processes the data on our behalf (Art. 28 GDPR). There is no adequacy decision of the European Commission for Singapore. We transfer the image on the basis of the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR), which are part of our contract with Tencent.

You can obtain a copy of the standard contractual clauses on request. Without these two services, we currently cannot create a preview.

5.5 Metadata in your file

Image files can contain metadata, for example the time of capture and the device type, for phone photos taken with location services switched on also the place of capture. We remove this metadata automatically when you upload. Only the image itself is stored and transferred to Replicate.

5.6 Children's drawings

A drawing can contain personal data, such as a child's name or age if they are written on the sheet. Please only upload drawings that you are allowed to use for this purpose. Our service is aimed exclusively at adults, such as parents or grandparents; children should not send us any data themselves. If a child's name or age appears on the drawing, we only process this information as part of the image and do not use it separately. The legal basis for this is our legitimate interest and the child's interest in the figure (Art. 6(1)(f) GDPR). Please cover up names before uploading.

5.7 Storage period

If you do not place an order, we delete your drawing, the 3D model, the preview and the related information 30 days after the last preview link was sent. Deletion runs once a week, so no more than seven days pass between the end of the period and the deletion. After an order, we keep the drawing and the 3D model until six months after delivery so that we can make an identical figure in the event of damage or a defect, and delete them afterwards. Deleted data may remain in recycle bins and backups of our service providers for up to 30 days before it is permanently removed.

6. Order, payment and shipping

6.1 What data we process

Your name, your delivery address or addresses, your email address, the ordered figures and the set, the price and the payment status, and for the Grandparents Set the text of the greeting card and the names and addresses of the recipients. We process a billing address if it is requested in the payment step. In addition, there is any information you provide voluntarily in the order form, for example a phone number.

In the order step, we store your confirmation of the terms and conditions and the version of the notice on the right of withdrawal that was shown to you, each together with the time, your IP address and your browser identifier, so that we can prove them.

6.2 Purpose, legal basis and retention

We process this data to perform the contract: production, shipping, communication with you and payment processing (Art. 6(1)(b) GDPR). We keep invoices and other accounting records for eight years and business letters such as order confirmations for six years, in each case from the end of the calendar year (§ 257 German Commercial Code, HGB; § 147 German Fiscal Code, AO; § 14b German VAT Act, UStG; Art. 6(1)(c) GDPR). We delete the remaining order data two years after delivery, i.e. after the statutory warranty period has expired (Art. 6(1)(f) GDPR; our legitimate interest is handling warranty claims). If you have reported a defect, we only delete the related data once the warranty claims have become time-barred or the case has been closed. We keep the proof described in sections 5.1 and 6.1 for three years from the end of the year in which the order was completed; without an order, we delete it together with the preview (section 5.7). The legal basis is our legitimate interest in being able to provide proof until possible claims become time-barred (Art. 6(1)(f) GDPR, §§ 195, 199 German Civil Code, BGB).

6.3 Addresses of gift recipients

If you enter the address of another person, for example for the Grandparents Set, we process their name and address only for shipping (Art. 6(1)(b) and (f) GDPR; the legitimate interest lies in delivering the gift). Please make sure that the person agrees to this.

6.4 Payment via Stripe

Payments are processed by Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). Stripe receives the data required for the payment, in particular name, email address, amount and payment method. Stripe does not pass on your full card or account details to us. Stripe processes the data partly on our behalf and partly as an independent controller, for example to prevent fraud and to comply with legal obligations (privacy notice at stripe.com/de/privacy). A transfer to Stripe, Inc. in the USA is possible; this is based on the EU-US Data Privacy Framework, under which Stripe, Inc. is certified.

If you choose PayPal, Stripe redirects you to PayPal. PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg, then processes your data as an independent controller (privacy notice at paypal.com/de/legalhub/privacy-full).

The legal basis is Art. 6(1)(b) GDPR.

6.5 Shipping with DHL

For shipping, we transfer your name and delivery address to DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany (Art. 6(1)(b) GDPR). We only pass on your email address or phone number to DHL if you have expressly consented to this in the order so that DHL can notify you of the delivery (Art. 6(1)(a) GDPR).

6.6 Order system and workspace at monday.com

We store preview requests and orders in the database of our order system (section 4). So that our workshop can process the orders, we also transfer the necessary details to a workspace of monday.com (monday.com Ltd., Tel Aviv, Israel). It contains your email address, the chosen set, your drawing and the preview as a file or link, the processing status and, if you order, your order and delivery data including the greeting card text. monday.com processes this data on our behalf (Art. 28 GDPR). There is an adequacy decision of the European Commission for Israel. monday.com stores the data in Amazon Web Services data centres, including in the USA; this is based on the EU-US Data Privacy Framework, under which the US company monday.com Inc. is certified. How long the data remains with monday.com is set out in sections 5.7, 6.2 and 17.

6.7 Email (Microsoft 365)

Emails such as the link to your preview and the order confirmation are sent by our order system via the email service Microsoft 365 (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). We also receive and answer your messages to info@doodlhero.com via Microsoft 365. Microsoft processes the data on our behalf. A transfer to the USA is possible; this is based on the EU-US Data Privacy Framework, under which Microsoft Corporation is certified.

The legal basis is Art. 6(1)(b) GDPR.

7. Contact by email

Our customer service can only be reached by email at info@doodlhero.com. When you write to us, we process your email address, your name and the content of your message to deal with your request. The legal basis is Art. 6(1)(b) GDPR if your request concerns a preview or an order, otherwise Art. 6(1)(f) GDPR; our legitimate interest is answering your request. The emails are kept in our Microsoft 365 inbox (section 6.7). We delete emails that do not relate to a preview or an order six months after the last message. We keep emails relating to an order as business letters for six years (§ 257 HGB, § 147 AO).

8. Support for the website and order system (access from Indonesia)

Our website and order system are developed and maintained for us by the IT service provider Palm Code, based in Germany. Palm Code processes the data on our behalf (Art. 28 GDPR) and uses subcontractors in Indonesia for this. Where necessary for operation, maintenance and support, they can access preview and order data from there. There is no adequacy decision of the European Commission for Indonesia. Palm Code has concluded the European Commission's standard contractual clauses with the subcontractors (Art. 46(2)(c) GDPR). You can obtain a copy on request.

9. Cookies and consent management

Cookies are small text files that your browser stores. We set technically necessary cookies without consent because the website and the preview and order process do not work without them (§ 25(2) no. 2 TDDDG; Art. 6(1)(b) and (f) GDPR). We only set all other cookies and similar technologies with your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR).

On your first visit, a consent banner asks for your choice. You can reject or accept all optional services or select individual categories. Until you consent, we do not load any analytics or marketing services. You can change or withdraw your decision at any time via the "Cookie settings" link at the bottom of every page. The banner is based on the open-source software CookieConsent (vanilla-cookieconsent), which we run on our own server; no data is transferred to third parties in the process.

10. Google Tag Manager and Google Analytics 4

With your consent to the analytics category, we use Google Analytics 4 (property G-ZY8T70JN3E), a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics sets cookies (table in section 9) and processes usage data such as pages visited, time spent, source of the visit, device, browser and your approximate location in order to create reports for us on the use of the website. According to Google, your IP address is only used to determine your approximate location and is not stored. The data is also transferred to Google LLC in the USA; this is based on the EU-US Data Privacy Framework, under which Google LLC is certified. Google deletes user-level event data after 14 months.

We integrate Google Analytics via Google Tag Manager (container GTM-KGLDW8HM), also a service of Google Ireland Limited. We only load Tag Manager after you have consented to analytics or marketing; it then only loads the services you have consented to.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time via the cookie settings.

11. TikTok Pixel

With your consent to the marketing category, we use the TikTok Pixel. The providers are TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, and TikTok Information Technologies UK Limited, Kaleidoscope, 4 Lindsey Street, London, EC1A 9HP, United Kingdom. It allows us to measure whether our ads on TikTok lead to visits, preview requests and orders, and to show ads on TikTok to visitors of our website. In the process, your IP address, device and browser information, the pages you visit and events such as a preview request or an order are transferred to TikTok.

We are jointly responsible with TikTok for collecting and transferring this data and for the reports on the success of our ads (Art. 26 GDPR). In essence, we have agreed the following: we obtain your consent and inform you about the joint processing, and TikTok informs you about its own processing. You can exercise your rights with us and with TikTok. We and TikTok are each independently responsible for creating audiences and selecting ads, and TikTok alone is responsible for any further processing. How TikTok processes data, which legal bases it relies on and how you can exercise your rights against TikTok is explained in TikTok's privacy policy at tiktok.com/legal/page/eea/privacy-policy.

There is an adequacy decision of the European Commission for the United Kingdom. According to its own information, TikTok also stores data in the USA, Malaysia and Singapore and allows group companies, including in China, to access it on the basis of standard contractual clauses. Data protection in China is not comparable to the EU. The legal basis for using the pixel is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

12. Meta Pixel and Conversions API

With your consent to the marketing category, we use the Meta Pixel and the Conversions API of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. They allow us to measure whether our ads on Facebook and Instagram lead to visits, preview requests and orders, and to show ads there to visitors of our website.

The pixel transfers your IP address, device and browser information, the pages you visit and events such as a preview request or an order from your browser to Meta. Via the Conversions API, we also send such events from our server to Meta, for example a completed order with the order value. If we transfer your email address in this process, we only do so as a hash value: a character string from which Meta cannot recover the address but which it can match against its own data. We also only use the Conversions API if you have consented to marketing.

We are jointly responsible with Meta for collecting and transferring the data (Art. 26 GDPR); the agreement is available at facebook.com/legal/controller_addendum. Meta alone is responsible for any further processing. Meta also transfers data to Meta Platforms, Inc. in the USA; this is based on the EU-US Data Privacy Framework, under which Meta Platforms, Inc. is certified. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

13. Images in the journal, fonts and embedded content

We provide the images in our journal (blog) via Cloudinary (Cloudinary Ltd., 20 Aharon Bart St., Petah Tikva, Israel). If your browser loads a journal image from Cloudinary, Cloudinary receives your IP address and technical information about your browser. The legal basis is our legitimate interest in delivering the images quickly (Art. 6(1)(f) GDPR). There is an adequacy decision of the European Commission for Israel; insofar as data is transferred to the USA, this is based on the EU-US Data Privacy Framework, under which Cloudinary Inc. is certified. Uploaded drawings are not stored with Cloudinary.

We load fonts from our own server; no connection is made to Google or other providers. We do not embed videos, maps or posts from other providers.

14. Our profiles on Instagram and TikTok

We run profiles on Instagram (Meta Platforms Ireland Limited) and TikTok (TikTok Technology Limited). On our website, we only link to these profiles; data only flows to the platforms when you click a link. When you visit our profiles, the operators process your data in accordance with their own privacy notices. We are jointly responsible with the operators for the statistics they provide to us about our profiles (Art. 26 GDPR). For confidential requests, please write to us by email.

15. Photos of your figure

We do not publish uploaded drawings, previews or photos of customers unless you have expressly allowed us to do so. If you would like to give us a photo of your painted figure for our gallery, our social media channels or advertising, we will ask for separate consent, which you can withdraw at any time with effect for the future (Art. 6(1)(a) GDPR). If a photo shows a child, we need the consent of the persons with parental responsibility; we do not show children's faces.

16. Recipients and transfers to third countries

You can obtain a copy of the standard contractual clauses we have agreed by writing to info@doodlhero.com.

17. Storage periods at a glance

Deleted data may remain in recycle bins and backups of our service providers for up to 30 days before it is permanently removed. Statutory retention obligations take precedence over the periods stated.

18. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)), and cookie consent via the "Cookie settings" at the bottom of every page.

An email to info@doodlhero.com is enough for any request. Your request is handled by our managing director Dogus Ünsalan. We reply within one month of receipt. If a request is particularly extensive, this period can be extended by up to two further months (Art. 12(3) GDPR); we will inform you of this within the first month.

Right to object

If we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz), Hintere Bleiche 34, 55116 Mainz, Germany, poststelle@datenschutz.rlp.de.

19. No automated individual decision-making

There is no automated individual decision-making, including profiling, within the meaning of Art. 22 GDPR. The 3D preview is created automatically and is not checked by anyone before it is sent. However, it has no legal effect on you: you decide yourself whether to order.

20. Obligation to provide data

Providing the drawing, your email address and the delivery and payment data is necessary for the preview and the contract. Without this data, we cannot make and deliver the figure. All other information is voluntary.

21. Data security

We transmit our website and all data you send through it in encrypted form (TLS).

22. Changes

We update this privacy policy when our processing or the legal situation changes. The version published at doodlhero.com/datenschutz applies.