Privacy Policy

The controller of personal data processed through drawflat.com is Drawflat, Warsaw, Poland. We follow the EU General Data Protection Regulation (GDPR) and Polish law. For any privacy question or request, write to privacy@drawflat.com.

• No accounts and no registration: we do not ask for your name, email or password.
• No plans: everything you draw stays in your browser’s local storage and in the files you download. It never reaches us.
• No advertising, no tracking cookies, no profiling and no automated decisions.

Because we hold nothing about you, there is nothing on our side to delete. To remove your plans, clear the site’s data in your browser.

The site is hosted by Vercel. Like any web server, it receives technical data with every request: your IP address, the time, the page requested, the referrer and your browser’s user agent. Vercel uses this data to deliver the pages and to protect the site from attacks and abuse.

Legal basis: our legitimate interest in a working, secure website (GDPR Art. 6(1)(f)). The logs are kept for a short period set by the hosting provider, as a rule no more than 30 days.

We use Vercel Web Analytics to count visits and see which pages are useful. It sets no cookies and stores nothing in your browser. It records the page, the referrer, the approximate location derived from the request (country, region, city), the browser, the operating system and the device type.

Visitors are told apart by a hash of the request that is discarded after 24 hours. We only see aggregated numbers and cannot identify you from them. Legal basis: our legitimate interest in improving the site (GDPR Art. 6(1)(f)). A content blocker or your browser’s tracking protection will stop it.

If you write to us, we receive your email address and whatever you put in the message. We use it only to answer you and keep it only as long as that takes.

Legal basis: our legitimate interest in answering (GDPR Art. 6(1)(f)), and our legal duty when you exercise your rights (Art. 6(1)(c)).

• Vercel Inc. (USA): hosting, server logs and the anonymous statistics.
• Namecheap, Inc. (USA): forwards email sent to our drawflat.com addresses to the mailbox where we read it.

They act on our instructions under data processing agreements. We never sell or rent personal data, and we disclose it to authorities only where the law requires.

These providers may process data in the United States. Such transfers rely on the EU–U.S. Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s Standard Contractual Clauses.

Under the GDPR you have the right to:

• know whether we process your data and get a copy;
• have it corrected or erased;
• restrict its processing or object to it;
• receive it in a portable format.

Write to privacy@drawflat.com; we answer within one month. You can also complain to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO) in Warsaw, or to the data protection authority of the country where you live or work.

The site can be used from anywhere. Wherever you are, we do not sell personal data and do not share it for advertising, and never have. This also answers the questions asked by laws such as California’s CCPA. You keep any additional rights your local law gives you, and you can exercise them by writing to us.

Drawflat is not aimed at children under 16, and we do not knowingly receive their data. If a child has emailed us, ask us and we will delete the message.

We may update this policy. The date at the top shows the current version.

Drawflat, Warsaw, Poland. Email: privacy@drawflat.com.