Privacy Policy

Pencil2Reality is operated by the legal entity identified in our Imprint. We are the data controller for personal data processed through the App and Site.

We have assessed that we are not required to appoint a Data Protection Officer (DPO) under GDPR Art. 37 given the scale of our operations. For all privacy-related enquiries, contact us at support@pencil2reality.app.

If you are located in the European Economic Area (EEA), we process your personal data on the following legal bases under GDPR Art. 6:

• Contract performance (Art. 6(1)(b)): Processing necessary to provide you with the App — account creation, image generation, credit management, subscription administration, and transactional emails.
• Legitimate interests (Art. 6(1)(f)): Crash reporting and error monitoring (Sentry) to ensure App stability; security and fraud prevention. Our legitimate interests are not overridden by your rights because the data is anonymised and the purpose is proportionate.
• Consent (Art. 6(1)(a)): Product analytics (PostHog) and push notifications (Firebase FCM). Where processing is based on consent, you have the right to withdraw it at any time without affecting the lawfulness of processing before withdrawal.
• Legal obligation (Art. 6(1)(c)): Retention of billing and transaction records as required by applicable tax and commercial law.

• To provide and operate the App and its image transformation service
• To manage your account, credits, and subscriptions
• To generate AI images and AI titles from your uploaded drawings using OpenAI gpt-image-1
• To send transactional emails (e.g. password reset) — no marketing emails without your consent
• To send push notifications about your generation results (only if you grant permission)
• To diagnose bugs and improve the App using anonymised crash reports and product analytics
• To comply with legal obligations

We share data with the following processors only to the extent necessary to operate the service. Each processor has signed a Data Processing Agreement (DPA) or equivalent contractual safeguard:

We do not sell your personal data to any third party.

The App may be used by children aged 13 and over, provided a parent or guardian holds the account and supervises use for users under 18. Account holders must be at least 13 years old.

We do not knowingly collect personal information directly from children under 13. If a parent or guardian becomes aware that their child under 13 has provided personal data without their consent, they should contact us at support@pencil2reality.app and we will promptly delete it.

Drawings uploaded through the App may depict children's artwork. These images are processed solely to generate the requested AI transformation and are stored privately for the account holder only. They are never used for advertising or shared with third parties beyond the processors listed in Section 5.

We retain personal data for the following periods:

• Account data and uploaded content: For as long as your account is active. If you delete your account, personal data and associated images are deleted within 30 days.
• Transaction and billing records: Retained for 10 years from the transaction date as required by Portuguese and EU tax law.
• Crash and error logs: Retained by Sentry for up to 90 days in line with Sentry's standard retention policy.
• Analytics data: Retained by PostHog for up to 12 months in anonymised form.
• Push notification tokens: Deleted when you delete your account or revoke notification permissions.

Depending on your location, you may have the following rights regarding your personal data:

• Access (Art. 15 GDPR): Request a copy of the data we hold about you
• Correction (Art. 16 GDPR): Request correction of inaccurate or incomplete data
• Deletion (Art. 17 GDPR): Request deletion of your account and data
• Restriction (Art. 18 GDPR): Request restriction of processing in certain circumstances
• Portability (Art. 20 GDPR): Request your data in a portable, machine-readable format
• Objection (Art. 21 GDPR): Object to processing based on legitimate interests
• Withdraw consent: Where processing is based on consent (analytics, push notifications), you may withdraw it at any time without affecting prior processing

To exercise any of these rights, contact us at support@pencil2reality.app. We will respond within one month as required by GDPR Art. 12(3).

Supervisory authority: If you are located in Portugal or the EEA, you have the right to lodge a complaint with your local data protection supervisory authority. In Portugal, the competent authority is the Comissão Nacional de Proteção de Dados (CNPD) at www.cnpd.pt.

We apply industry-standard security measures including:

• Encrypted connections (TLS/HTTPS) for all data in transit
• Row-Level Security on all database tables, ensuring only you can access your data
• Private cloud storage buckets with signed URL access
• Access controls limiting employee access to personal data to those with a need to know

In the event of a personal data breach that is likely to result in high risk to your rights and freedoms, we will notify you without undue delay as required by GDPR Art. 34.

Your data is stored and processed by Supabase, PostHog, Sentry, OpenAI, Firebase, and RevenueCat, which may operate servers in the United States and other countries outside the European Economic Area (EEA). Where data is transferred outside the EEA, we rely on appropriate safeguards including Standard Contractual Clauses (SCCs) approved by the European Commission under GDPR Art. 46(2)(c), or the provider's participation in an applicable adequacy framework.

We do not make decisions about you that produce legal or similarly significant effects solely through automated means (GDPR Art. 22). The AI image transformation is a creative tool operated at your explicit request and does not constitute automated profiling or decision-making.

The App uses device local storage to store your authentication session and preferences. No advertising or tracking cookies are used in the App.

The Site (pencil2reality.app) may use cookies for session management and to understand general site traffic via analytics. No advertising cookies are used. You can control cookies through your browser settings.

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice in the App or on this page with a revised “Last updated” date. Continued use of the App after changes constitutes acceptance of the updated policy.

For any privacy questions, requests, or to exercise your rights, please contact us at:
support@pencil2reality.app

For complaints, you may also contact the Portuguese supervisory authority:
CNPD — Comissão Nacional de Proteção de Dados
www.cnpd.pt