Privacy Policy

Contact Details

For privacy-related questions or requests, contact us at support@drawpaw.io.

What Information We Collect and Why

We collect and process information necessary to provide, maintain, and improve DrawPaw. This includes:

Information You Provide Directly

• Account Information: Your name, email address, password, and optionally your institution or role when you register. Why: to create and manage your account, provide access, and communicate with you.
• Payment Information: Billing details when you subscribe to paid services. Payment processing is handled by our third-party partner Stripe. We do not store your full card or bank details. Why: to process subscription payments.
• User-Generated Content: Prompts, text, lesson plans, presentation content, images, and other materials you create or upload while using DrawPaw. Why: to provide core product features (generating and editing lesson materials).
• Communications: Information you provide when you contact us for support. Why: to respond and assist.
• Marketing Preferences: Your preferences for receiving marketing communications and records of consent. Why: to send updates where permitted and respect your choices.

Information Collected Automatically

• Usage Data: How you interact with the website and service (features used, pages visited, clicks, time spent). This may involve analytics tools such as PostHog or Google Analytics. Why: to understand behaviour, improve the service, and troubleshoot issues.
• Device and Connection Information: IP address, browser type, operating system, and similar technical details. Why: security, analytics, and service delivery.
• Cookies and Similar Technologies: See our Cookie Policy for details. Why: functionality, preferences, analytics, and (where applicable) marketing.

Legal Bases for Processing (GDPR)

• Contract: Processing needed to perform our service contract with you (account management, content generation, payments).
• Legitimate Interests: Improving the service, security monitoring, usage analysis, and limited communications about similar services, where these do not override your rights.
• Consent: Where required (for example, non-essential cookies or certain marketing). You may withdraw consent at any time.
• Legal Obligation: Processing required to comply with law (for example, financial record-keeping).

Where We Get Personal Information From

• Directly from you: When you sign up, use the service, pay, or contact us.
• Automatically: Through use of the website and service.
• Third parties: Such as Google, if you choose to sign in with Google.

Data Retention

We retain personal data only as long as needed for the purposes in this policy, to comply with law, resolve disputes, and enforce our agreements. Typical periods:

• Account Information: While the account is active, and up to 7 years after closure for legal and operational needs.
• Payment Records: Up to 7 years for financial compliance and audit.
• Marketing Preferences: Until you opt out or withdraw consent.
• User-Generated Content: While the account is active, or until you delete it.
• Deleted Content Backups: Up to 90 days after a deletion request is processed, then permanently removed.
• Analytics & Usage Data: Up to 26 months (often anonymised or aggregated sooner).

You may request deletion at any time, subject to legal or operational requirements (see Your Data Protection Rights below).

Sub-Processor Disclosure

We use trusted third parties to operate DrawPaw. Key categories include:

• OpenAI / Anthropic (via Vercel AI Gateway): Prompts and lesson content for AI generation. Lawful basis: Contract.
• Vercel: Application hosting, edge delivery, and related infrastructure. Contract / Legitimate Interests.
• Supabase / PostgreSQL hosting: Account data, application data, and related storage. Contract.
• Vercel Blob: User-uploaded and generated files (for example, images). Contract.
• Stripe: Billing name, email, and tokenised payment details. Contract.
• Google: Name, email, and profile picture if you sign in with Google. Contract / Consent.
• PostHog or Google Analytics: Usage and device data for product analytics (where enabled). Legitimate Interests / Consent.
• Resend (or similar email provider): Email and name for transactional and (where consented) marketing email. Contract / Consent.
• Sentry: Error and performance data (for example, IP, user ID, browser/OS, stack traces), where enabled. Legitimate Interests.

Where sub-processors are outside the UK/EEA, we use appropriate safeguards such as Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms.

Who We Share Information With

We do not sell your personal data. We share information only with processors who help us run DrawPaw under confidentiality and data processing terms, including AI providers (for generation), hosting and storage providers, Stripe for payments, Google for optional sign-in, and analytics/support tools as described above.

We may also share data if required by law, to protect rights and safety, or in connection with a business transfer (for example, a merger), with appropriate safeguards.

Data Hosting & International Transfers

DrawPaw is hosted primarily on infrastructure operated by Vercel and database services (including Supabase-backed PostgreSQL). Data may be processed in the United States, the European Economic Area, or other regions depending on the provider.

When we transfer personal data internationally, we use appropriate safeguards (such as SCCs) so that UK/EU GDPR standards continue to apply where required.

Cookies and Similar Technologies

We use cookies and similar technologies for essential operation, preferences, analytics, and (where applicable) marketing. For types of cookies, purposes, and how to manage them, see our Cookie Policy.

AI Consent Management

By creating an account and using DrawPaw's generation features, you consent to AI processing of the content you submit for those features.

You may withdraw AI consent by emailing support@drawpaw.io with the subject line "Withdraw AI Consent". We aim to process requests within 5 business days. After withdrawal, AI features will be unavailable; your account and previously generated content remain accessible unless you request deletion.

FERPA Compliance (U.S. Educational Institutions)

If DrawPaw is used by a U.S. school or district under contract:

• Where applicable, we act as a "school official" with legitimate educational interests under FERPA.
• Any student data provided is used only to deliver the contracted educational service—not for targeted advertising.
• DrawPaw is not intended for direct collection of sensitive student PII inside prompts or generated materials. Schools and users should avoid entering student names, grades, or ID numbers into prompts. The school remains the primary controller of student data under FERPA.
• Schools may request access, review, or deletion of student data associated with their contract by contacting us.
• In the event of a breach involving student data, we will notify affected schools promptly.

Your Data Protection Rights

Depending on your location, you may have rights including:

• Access: Request a copy of personal data we hold about you.
• Rectification: Ask us to correct inaccurate or incomplete information.
• Erasure: Request deletion in certain circumstances.
• Restrict processing: Ask us to limit processing in specific cases.
• Object: Object to processing based on legitimate interests or to direct marketing.
• Data portability: Request data in a structured, commonly used, machine-readable format where applicable.
• Withdraw consent: Where processing is based on consent, withdraw it at any time (without affecting prior lawful processing).

There is usually no fee. We aim to respond to verifiable requests within one calendar month. Contact us at support@drawpaw.io. We may need to verify your identity first.

How to Complain

Please contact us first so we can try to resolve your concern. If you remain unsatisfied, you may lodge a complaint with your local supervisory authority (for example, the UK Information Commissioner's Office at ico.org.uk, or your EU member state DPA). FERPA matters in the U.S. are typically handled via the educational institution or the Student Privacy Policy Office.

Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify you by email and/or in-product notice at least 30 days before the changes take effect. Continued use after the effective date constitutes acceptance of the revised policy.

See also our Terms of Use and Refund Policy.