Back

Privacy Policy for DoodleKino

Last updated: 17 December 2025

Controller: Magnus Robinson Johansen / Johansen Apps, Org. nr. 935143586

Location: Norway

Contact: doodlekino.studio@gmail.com

1. Overview

We care about privacy, especially because the Service involves children's artwork. We follow data minimisation: collecting only what is necessary to provide the Service.

DoodleKino is intended for adults (18+).

2. What We Collect

2.1 Adult user data

  • Email address (if you provide it for delivery, account access, or support)

  • Payment metadata/status via Stripe (we do not store full card numbers)

  • Technical and security data: We do not store IP addresses in our application database for consent proof. However, our hosting/CDN providers and servers may process IP addresses in infrastructure logs to deliver the Service and protect it against abuse (e.g., fraud prevention, rate limiting, attack detection).

  • Checkout acceptance record: We store a record that you accepted key checkout confirmations (e.g., withdrawal waiver and Terms/Privacy acceptance), including checkbox status, timestamp, locale shown, and the version identifiers of the Terms/Privacy/waiver text.

2.2 Child-related data (provided by the adult)

  • Child's first name or nickname (optional)

  • The drawing image you upload

  • Optional story/description text you provide

2.3 Image metadata handling

When you upload a drawing image, we automatically strip EXIF metadata (including GPS location, camera information, and timestamps) from the image before storing it. This means:

  • Location data embedded in photos taken with smartphones is removed

  • Camera/device identifiers are removed

  • Original capture timestamps are removed

This processing happens server-side before the image is stored, ensuring that sensitive metadata from your device is not retained in our systems.

3. Why We Process Data (Purposes & Legal Bases)

We process personal data for:

  1. Providing the Service (generate Output, host Premiere Page) — contract necessity

  2. Customer support — contract / legitimate interests

  3. Security, abuse and fraud prevention — legitimate interests

  4. Accounting and legal obligations (payments/bookkeeping) — legal obligation

  5. Documenting checkout acknowledgements (withdrawal waiver / Terms acceptance) — legitimate interests / compliance (as applicable)

4. Children's Privacy

DoodleKino is intended for adults (18+). If you provide a child's drawing/name, you confirm you are authorised as parent/guardian (or have explicit permission).

We do not sell child-related data and do not use it for advertising profiling.

5. Sharing & Processors (Third Parties)

We share data only with service providers needed to run DoodleKino, such as:

  • Stripe (payments)

  • Hosting/storage/CDN providers (to host the website, Premiere Pages, and video files)

  • AI providers (to process the drawing/text and generate the Output)

We do not sell your personal data.

6. AI Providers & Training

We use uploaded Input to generate your requested Output. Where providers offer controls and contractual options, we aim to configure/require settings that limit use of customer content for public model training. (Exact provider behaviour may depend on the provider and the specific service used.)

7. International Transfers

Some providers may process data outside Norway/EEA. Where required, transfers rely on appropriate safeguards (such as standard contractual clauses) and vendor agreements.

8. Retention

  • We retain drawings and generated videos long enough to provide access via your Premiere Page and handle support.

  • We retain purchase/accounting records as required by law.

  • We retain infrastructure/security logs only as long as necessary for security and abuse prevention, and we minimise retention where possible.

9. Your Rights

Depending on your jurisdiction, you may have rights to access, correct, delete, restrict processing, and object to processing under GDPR. Contact doodlekino.studio@gmail.com to exercise rights.

You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).

10. Deletion

10.1 Self-service deletion

You can delete your films directly from the "My Films" page in your account. When you delete a film:

  • The video file is permanently deleted from our storage

  • The original drawing image is permanently deleted

  • The processed/illustrated image is permanently deleted

  • The thumbnail is permanently deleted

  • Associated generation records are removed from our database

Deletion is immediate and cannot be undone.

10.2 Account deletion

You can delete your entire account from the Profile/Settings page. When you delete your account:

  • All your films and associated files are permanently deleted

  • Your account data, preferences, and consent records are removed

  • Credit transaction history is anonymized (we retain amounts and dates for bookkeeping, but remove the link to your identity)

We process account deletion immediately. We respond to all deletion requests within 1 month as required by GDPR.

10.3 Manual deletion requests

If you cannot access your account, email doodlekino.studio@gmail.com with your request. We will process deletion within a reasonable time, subject to legal retention obligations (e.g., anonymized payment records for accounting as required by Norwegian law).

11. Cookies

We use essential cookies required for site functionality (e.g., session, checkout). We do not use third-party advertising cookies.

12. Security

We use reasonable technical and organisational measures to protect data. No internet system is 100% secure, but we work to minimise risk.

12.1 Technical privacy measures

We implement the following technical measures to protect your privacy:

  • Search engine exclusion: Premiere Pages and user-specific pages are marked with X-Robots-Tag: noindex, nofollow headers and excluded via robots.txt to prevent search engine indexing. While we cannot guarantee all search engines will honor these directives, we take reasonable steps to keep your content out of public search results.

  • Metadata stripping: Uploaded images are processed to remove EXIF metadata (see Section 2.3).

13. Changes

If we update this Privacy Policy, we will update the "Last updated" date and publish the new version.