Privacy Policy
Paint Love (the “Service”) is provided by FutureForce OÜ, a company registered in Estonia under registry code 16205299, with its registered office at Mannimae/1, Pudisoo kula, 74626 (“we”, “us”, “our”). We are the controller of the personal data described in this Privacy Policy.
This Privacy Policy explains what data we collect, why we collect it, on what legal basis, how long we keep it, who we share it with, and what rights you have. Terms defined in our Terms and Conditions have the same meaning here unless stated otherwise.
Data We Collect
We do not require you to create an account. We do not ask for your email address, your telephone number, or any other contact details, and we do not collect them.
We collect the following data through the Service:
- The name you enter. When you first open the app, you are asked to enter a name. This name is shown to the person you draw with. You may enter any name you wish; we do not verify it and we do not require it to be your real name.
- Your drawings and uploaded images. The content you create in the app is stored on our servers so that it can be shown to the person you draw with.
- Technical connection data. When your device connects to our servers, it sends your IP address, the approximate country derived from that IP address, your user agent, and standard request headers. This data is necessary to deliver the Service and to keep it secure.
We also process crash data, usage data, subscription data, and advertising data, as described in the sections that follow.
Legal Bases for Processing
Where the General Data Protection Regulation applies, we rely on the following legal bases:
- Performance of a contract. To provide the Service to you, including storing and delivering the name you enter and the content you create, and administering your premium subscription.
- Consent. For personalised advertising and, where the law of your jurisdiction requires consent, for analytics. You may withdraw your consent at any time, and withdrawal does not affect the lawfulness of processing carried out before it.
- Legitimate interests. To keep the Service secure, to prevent abuse of the Service, and to identify and fix faults in the app. We have assessed that these interests are not overridden by your rights and freedoms.
- Legal obligation. To retain transaction records for the period required by accounting and tax law.
Crash Data
When the app crashes, Firebase Crashlytics collects a crash report that may include your IP address, the device model, the operating system version, the app version, the state of the app at the time of the crash, and the date and time of the crash. We use this data solely to identify and fix faults in the app.
Subscriptions
Premium subscriptions are purchased and processed by Apple and Google through the App Store and Google Play. We do not receive or store your payment card details or your billing information. We receive only the subscription status and the transaction identifier issued by the platform, which we use to confirm your entitlement to premium features. Payments are governed by the privacy policies of Apple and Google.
Advertising and Analytics
The Service is funded by advertising and by optional premium subscriptions. We use the following third-party providers for advertising and analytics, each of which processes data under its own privacy policy:
- Google AdMob — advertising
- Mintegral — advertising
- Pangle — advertising
- Google Analytics for Firebase — analytics
- Firebase Crashlytics — crash reporting
- Google Play Services — platform services
Google Analytics for Firebase collects usage data while you use the app. This includes events such as app launches, screens opened, and features used, together with your device model, operating system version, app version, and approximate location derived from your IP address. We use this data to understand how the Service is used and to improve it.
Where the law of your jurisdiction requires your consent for personalised advertising, we ask for that consent when you first open the app. You may change your choice at any time in the app settings. If you do not consent, you will continue to see advertising, but it will not be personalised.
If you hold an active premium subscription, advertising is disabled and no data is sent to our advertising providers for the duration of your subscription. Analytics and crash reporting continue to operate as described above.
These providers do not receive your drawings, your uploaded images, or the name you entered. They receive the data described in their own privacy policies, which typically includes your advertising identifier, your IP address, and information about your device.
Network and Security Provider
All requests to our servers pass through the network of Cloudflare, Inc., which acts as our processor. Cloudflare processes technical request data on our behalf, including your IP address, the approximate country derived from that IP address, request headers, your user agent, and the requested URL, solely in order to deliver, secure, and accelerate the Service. Cloudflare's privacy policy is available at cloudflare.com/privacypolicy.
Where Your Data Is Stored
The data we store ourselves, including the name you enter and the content you create, is held on servers located within the European Union. This applies to every user of the Service, irrespective of the country from which the Service is used.
The third-party providers named in this Privacy Policy may process data outside the European Economic Area, including in the United States and in other countries. Where they do so, those transfers are made under the safeguards provided for in Chapter V of the General Data Protection Regulation, in particular the standard contractual clauses adopted by the European Commission. Details are set out in the privacy policies of the providers concerned, which are linked above.
How Long We Keep Your Data
- Drawings and uploaded images. Retained only for as long as they remain in use. When new content is uploaded, the content it replaces is deleted automatically. Where content has not been changed, it is deleted automatically after six months.
- The name you enter. Retained for as long as the associated content is retained, and deleted with it.
- Server and security logs. Retained for no longer than 90 days, after which they are deleted.
- Subscription records. Retained for as long as your subscription is active, and afterwards for the period required by applicable accounting and tax law.
Data held by the third-party providers named above is retained in accordance with their own retention policies.
Abuse Prevention
We operate automated systems that protect the Service against abuse, tampering, and unauthorised access. Where those systems detect activity indicating a possible violation, they may automatically carry out a more detailed inspection of the requests and content concerned, and may restrict or block access, in order to stop and prevent breaches of our Terms and Conditions. We carry out this processing to protect the security and integrity of the Service and of its users.
If your access has been restricted or blocked by an automated decision, you may contact us at the address given below to express your point of view, to obtain a review of the decision by a member of our staff, and to contest the decision.
Age Signals
The Service is available to users of any age. Where the law applicable in your jurisdiction requires it, we apply additional restrictions to the way your data is processed.
When you first open the app, we determine your age category using the platform-level age signals provided by the operating system vendors: Google Play Age Signals on Android and Declared Age Range on iOS. We receive the age category alone; we do not receive your date of birth or any other account data held by the platform. The age category is processed on your device only. It is not transmitted to our servers and it is not stored by us; it is used locally to configure advertising and analytics on your device.
Where you are identified as a child or a minor under the law applicable in your jurisdiction, we disable personalised advertising and analytics. In that case our advertising providers are instructed to serve non-personalised advertising only, and no advertising identifier is used to build a profile of you.
Your Rights
Where the General Data Protection Regulation applies, you have the right to request access to your personal data, to request its rectification or erasure, to request the restriction of its processing, to object to processing carried out on the basis of our legitimate interests, and to receive the data you have provided to us in a structured, commonly used, and machine-readable format. Where processing is based on your consent, you may withdraw that consent at any time.
Because we do not collect an email address, a telephone number, or any other identifier that would allow us to link stored data to you as an individual, we may be unable to identify your data from a request alone. In that case we may ask you for additional information that allows us to locate the data concerned. Where we cannot identify you, we may be unable to act on the request, as provided for in Article 11 of the General Data Protection Regulation.
You also have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), aki.ee. You may also lodge a complaint with the supervisory authority of the country in which you live.
Security
We implement appropriate technical and organisational measures to protect your data. Traffic between the app and our servers is encrypted in transit, including the connection between our network provider and our origin servers. However, no method of transmission over the internet and no method of electronic storage is entirely secure, and we cannot guarantee absolute security.
Links to Other Sites
The Service may contain links to other sites. If you follow a third-party link, you will be directed to a site that we do not operate. We therefore encourage you to review the privacy policy of any site you visit. We have no control over, and accept no responsibility for, the content, privacy policies, or practices of any third-party site or service.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Any changes will be published on this page, and the date at the top of this policy will be updated accordingly. We encourage you to review this page periodically.
Contact Us
If you have any questions or requests concerning this Privacy Policy or your data, please contact us at [email protected].