Privacy

Drawn Real is built around children's drawings, first names and ages, so we treat everything you give us as children's data and hold it to the standard of the UK GDPR, the Data Protection Act 2018 and the ICO's Age Appropriate Design Code (the Children's Code). This page explains what we collect, why, for how long, and how to ask us about it. It is written for parents; the service is for adults to use on a child's behalf, and we do not knowingly deal with children directly.

Who is responsible

Drawn Real is the data controller. Email hello@drawnreal.co.uk, or write to TODO: postal address, London, United Kingdom. You can also reply to any email we send.

What we collect and why

• The photo of the drawing, and the cleaned-up version we make from it. This is needed to make the picture. It is the only image we ask for; please do not upload photos of people.
• What the drawing shows, your child's first name and age, and the title you choose. These go on the plaque and help the picture stay faithful to the drawing. Please use a first name only.
• Your email address. To show you the preview, send order updates and deal with any problems. If you tick the box, we also send occasional news about new styles; you can unsubscribe at any time and we never sell or share your address.
• Your delivery address and phone number, collected by Shopify at checkout and shared with our print partner only to deliver a framed print.
• Technical data: a hashed (one-way scrambled) version of your IP address to limit abuse of the free previews, and standard server logs. We do not use advertising trackers or analytics cookies. The only cookies are a session cookie that links your browser to your drawing and, for the site owner, an admin cookie.

Our lawful basis is performance of a contract (making and delivering your order, including the free preview) and, for the optional newsletter, your consent. We do not use children's data for profiling, advertising or any purpose other than making their picture.

Who else sees it

• Google Gemini generates the made-real picture from the cleaned drawing and a description. We send only the drawing image and the description, never your child's name or your email.
• Vercel hosts the site and stores files in a private, access-controlled store in London.
• Shopify handles payment and holds your order and address.
• Prodigi, our UK print partner, receives the print file and your delivery address for framed prints.
• Resend delivers our emails.

Each of these processes data under its own agreement with us and cannot use it for anything else.

How long we keep it

• Drawings and generated pictures are deleted automatically 30 days after your order has shipped or your download link was sent. Drawings that never lead to an order are deleted after 45 days.
• Print files (the framed layout) are kept for six months so we can replace a damaged print.
• Order records (name on the plaque, product, dates) are kept for six years for tax and consumer-law reasons, without the images.
• Marketing consent lasts until you unsubscribe.

Your rights

You can ask us for a copy of the data we hold about you and your child, ask us to correct it, ask us to delete it (we will do so unless we must keep an order record by law), and withdraw marketing consent at any time. Email hello@drawnreal.co.uk to do so and we will respond within a month. You can also complain to the Information Commissioner's Office at ico.org.uk.

Security

Files are stored in a private store that is not reachable by URL. Previews are watermarked and only shown to the browser that uploaded the drawing. Download links for digital purchases are time limited. Staff access to orders is protected by a passcode.

Changes

If we change how we use data we will update this page and, where the change matters, email you before it takes effect.