Privacy policy

Controller

Christian Grieger
Doodle Gone Real
Zur Melmke 6
59846 Sundern
Email: hello@doodlegonereal.com

Your rights

You can exercise the following rights at any time using the contact details above:

• Access to your data stored by us and how it is processed (Art. 15 GDPR)
• Rectification of inaccurate personal data (Art. 16 GDPR)
• Erasure of your data stored by us (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to the processing of your data (Art. 21 GDPR)

If you have given us your consent, you can withdraw it at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority.

Hosting with Cloudflare

This website and the technology behind it run on services of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (“Cloudflare”): Cloudflare Pages delivers the website, Cloudflare Workers run our server functions under doodlegonereal.com/api, and Cloudflare’s network protects the website against attacks.

When you visit the website, technically necessary data is processed in order to deliver it securely: IP address, date and time, requested page, referrer and browser information. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is a secure, fast and reliable website. We do not combine this data with other data and do not use it to create profiles.

Cloudflare processes data on our behalf on the basis of a data processing agreement, which is part of Cloudflare’s terms (Data Processing Addendum). Cloudflare may also process data in the USA. Cloudflare is certified under the EU-US Data Privacy Framework; in addition, the EU standard contractual clauses apply.

Database and file storage in the EU

Data that we store ourselves, such as submissions and their status, is kept in a Cloudflare D1 database and Cloudflare R2 storage that we have set up with EU data location (jurisdiction EU).

Cloudflare Turnstile

To protect forms against spam and abuse, we use Cloudflare Turnstile. When a form with Turnstile is loaded, Cloudflare evaluates technical signals of your browser and device (for example IP address, browser type and interaction data) to tell people and bots apart. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is protecting our service against automated abuse.

Cloudflare Access

Protected areas, such as our administration area, are secured with Cloudflare Access. Only authorised persons log in there; Cloudflare processes their email address and login data and sets a session cookie for this purpose. Visitors of the public website are not affected.

Contact by email

If you write to us at hello@doodlegonereal.com, we process your email address, your message and any data you provide in order to answer your request. The legal basis is Art. 6 (1) (b) GDPR if your request concerns a submission, otherwise Art. 6 (1) (f) GDPR. We delete the data once your request has been dealt with, unless statutory retention periods apply.

Our mailbox is hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany, on servers in Germany, on the basis of a data processing agreement.

Submitting drawings

The following applies to our submission form:

• We process the drawing you upload, your email address and, if you want to be credited, a name or social media handle. The email address is used to tell you whether your drawing was selected and to send you a personal link for status and deletion.
• Optionally, you can add a short comment about the drawing and your handles on individual social media channels. If your drawing is selected, we publish the comment (which we may shorten or edit) with the post and tag you with the handle on the respective channel. Without a handle, we only mention your name there.
• If your drawing is selected, we show the drawing, the photo, the clip and your comment in the gallery on this website. Your name and handles only appear there if you agreed to be credited.
• We remove metadata such as location (EXIF/GPS) from uploaded images. Please do not upload photos showing people or a child’s full name.
• The legal basis is Art. 6 (1) (b) GDPR (handling your submission under our participation terms) and, for publishing your name or handle, your consent under Art. 6 (1) (a) GDPR.
• For people under 16, a parent or guardian submits the drawing and gives the necessary consent.
• To prevent abuse, we count submissions per email address and per IP address. We store both only as hashes and delete the counters after two days.

Image and video generation with Higgsfield

To turn selected drawings into photos and clips, we use the AI service Higgsfield (Higgsfield AI, USA), which processes the drawing. Higgsfield uses sub-processors for this, currently xAI (USA) for the photo and Kling by Kuaishou (China) for the clip. The clip model only receives the generated photo, not the drawing. We only transmit the drawing itself, never your name, email address or other metadata.

Data is therefore transferred to third countries, the USA and China. For China there is no adequacy decision by the EU Commission. The transfer is based on the EU standard contractual clauses or another suitable safeguard under Art. 44 et seq. GDPR.

Higgsfield may keep a copy of the drawing and the results on its servers. Our deletion cannot reach this copy; where possible, we ask Higgsfield to delete it.

Final versions with GitHub Actions

To prepare selected results for posting (the drawing small in the corner, the label “AI-generated”, image formats for the individual channels and the gallery), we process the drawing and the generated photo or clip with GitHub Actions, a service of GitHub, Inc. (USA). Only these image and video files are processed there, never your name, email address or other data; the files are deleted after each run. GitHub processes the data on our behalf on the basis of its data protection agreement, which includes the EU standard contractual clauses.

Emails about your submission

We send emails about your submission (confirmation with your personal link, selection, planned publication date, publication, rejection, deletion confirmation and, on request, login codes and new personal links) automatically from noreply@doodlegonereal.com via the mail servers of ALL-INKL.COM – Neue Medien Münnich in Germany, on the basis of a data processing agreement. Only your email address and the content of the message are processed for this.

“My drawings” and new personal links

On “My drawings” you can see all submissions made with your email address. To log in, we email you a one-time code; on request, we send you new personal links instead. We only send these emails if there are submissions for the address. For this we store the code only as a hash for 15 minutes and, after a successful login, a session for 24 hours with your email address and a session cookie. Expired codes and sessions are deleted automatically. To prevent abuse, we count requests per email address and IP address, stored only as hashes, and delete these counters after a short time. The legal basis is Art. 6 (1) (b) GDPR.

Storage period

Submissions that we do not select, and rejected submissions, are deleted automatically 90 days after they were submitted; we let you know by email. Selected submissions are stored as long as needed for creation and publication, published ones until you ask us to delete them. You can delete your submission at any time using your personal link, on “My drawings” or by sending us an email; we then delete the drawing and your data and remove published posts as far as this is in our control.

Our social media channels

We publish selected results on our social media channels (TikTok, Instagram, YouTube, Facebook, Pinterest, Threads and Bluesky) under the handle @doodlegonereal, credited with the name or handles you chose. Our website only contains plain links to these channels; no data is transmitted to the platforms until you click a link.

When you visit our profiles, the respective operators process your data under their own responsibility and privacy policies: TikTok Technology Limited (Ireland), Meta Platforms Ireland Limited for Instagram, Facebook and Threads, Google Ireland Limited for YouTube, Pinterest Europe Limited (Ireland), Bluesky Social PBC (USA) and X Corp. (USA). For statistics about our Instagram and Facebook presence, we are jointly responsible with Meta under Art. 26 GDPR. Data may be transferred to the USA or other third countries.

Cookies and consent

We set technically necessary cookies on the basis of § 25 (2) TDDDG. Optional services, currently only the cookieless statistics described below (Cloudflare Web Analytics), are only loaded after your consent via our cookie banner (Klaro, hosted locally). You can change your decision at any time in the cookie settings.

Cloudflare Web Analytics

With your consent, we use Cloudflare Web Analytics by Cloudflare, Inc. (USA), which already hosts our website, for cookieless audience measurement. A small script then records page views, the referring page, country, device type and load times; we only see this data in aggregated form. No cookies or local storage are used, no profiles are created across websites, and according to Cloudflare the IP address is not stored for this purpose.

The legal basis is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. Without consent, the script is not loaded. You can withdraw your consent at any time with effect for the future in the cookie settings. Cloudflare is certified under the EU-US Data Privacy Framework.

Independently of this, Cloudflare provides us with traffic statistics derived from the requests that reach our website (for example number of requests, countries and error rates), without any script in your browser. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is operating and improving a secure and reliable website.

Fonts

All fonts are loaded locally from our own server. There is no connection to third-party servers.

SSL/TLS encryption

To protect your data, this website is delivered exclusively via HTTPS.

Changes to this privacy policy

We update this privacy policy when legal requirements or our services change, for example when submissions open. Last updated: October 2026.