Privacy Policy

• Account information. When you create an account we collect your email address and, optionally, a display name. Your password is stored only as a one-way hash and can never be read in plain text.
• Creative content. The prompts, reference images, and other inputs you provide, along with the images, videos, 3D models, and web prototypes the Service generates for you. This is processed to deliver the Service and is associated with your account.
• Human-verification signals. When you sign in, register, or reset a password, Cloudflare Turnstile may collect device and interaction signals to distinguish humans from automated bots. See Cloudflare's Privacy Policy.
• Transactional email. If you request a password reset or email verification, we send a message to the address you provided for that sole purpose.
• Payment information (via Dodo). Subscriptions and credit purchases are handled by our payment provider Dodo Payments. DotDraw never sees or stores your full card number. Dodo collects payment details directly and shares with us only what is needed to fulfill your order. See Dodo's Privacy Policy.
• Optional Google sign-in. If you choose to sign in with Google, Google shares with us your basic profile (name and email). We use it only to create and sign you into your account. We do not post anything to your Google account. See Google's Privacy Policy.

The Service uses only a single strictly necessary session cookie to keep you signed in. This cookie is required for the Service to function and does not track you across other websites. No consent banner is shown because the only cookie in use is strictly necessary.

We do not use advertising cookies or third-party analytics that identify you across sites. If we add such tools in the future, we will update this policy and provide a consent choice before enabling them.

• To create and manage your account and keep you signed in.
• To generate the images, videos, 3D models, and pages you request.
• To process subscriptions and one-off credit purchases.
• To send transactional emails (verification, password reset).
• To prevent fraud, abuse, and automated attacks.
• To maintain and improve the Service.

For users in the European Economic Area and the United Kingdom, we process personal data on the following legal bases:

• Performance of a contract — to provide the Service you requested, including account, generation, and payment.
• Legal obligation — where we are required to keep records.
• Legitimate interests — to prevent fraud, abuse, and security threats, to the extent those interests are not overridden by your rights.
• Consent — for optional processing such as signing in with Google, which you can revoke at any time.

We do not sell your personal information. We share it only:

• With the processors listed above (Dodo, Cloudflare, Google) to deliver the Service;
• With infrastructure and hosting providers that run the Service for us, under contracts that require them to protect the data; and
• If required by law or to protect our rights and the safety of others.

We keep your account and creative content for as long as your account is active. If you request account deletion, we remove your personal information from our active systems within a reasonable period, except where we are required to retain certain records by law.

Subject to your jurisdiction, you may have the right to:

• Access, correct, or delete the personal data we hold about you;
• Object to or restrict certain processing;
• Withdraw any consent you have given (this does not affect processing that has already occurred);
• Receive a copy of your personal data in a portable format; and
• Lodge a complaint with your local data protection authority.

California residents may also have rights under the California Consumer Privacy Act (CCPA), including the right to opt out of any future “sale” or “sharing” of personal information. We do not currently sell or share personal information as defined by the CCPA.

To exercise any of these rights, email us at [email protected].

Your information may be processed in countries other than your own, including the United States, where DotDraw operates. Where this involves a transfer out of the EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

We use reasonable technical and organizational measures to protect your information, including hashed passwords, encrypted connections (HTTPS), and strict access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

The Service is not directed to children under 13 (or the minimum age in your jurisdiction), and we do not knowingly collect personal information from them. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this policy from time to time. The revised date at the top of this page indicates when it last materially changed. If we make a significant change, we will notify you through the Service or by email where appropriate.

Questions about this policy or your data? Email [email protected].