Privacy policy
Last updated: October 7, 2026
kidAR turns children's drawings into augmented reality experiences. This page explains which personal data we process, why, who receives it, how long we keep it, and what rights you have.
Data controller
- Company
- Dev Ai EOOD
- Company ID / VAT no.
- BG208553841
- Address
- 1 Bogdan Voyvoda St., Ruse 7002, Ruse Region, Municipality of Ruse, Bulgaria
- Contact for privacy requests
- contact@devaieood.com
1. Who the service is for
kidAR is meant for adults: parents, legal guardians and educators. Children do not create their own accounts.
The drawings you upload usually belong to a child. That is why we ask you to confirm that you are the parent or legal guardian before the first upload and, separately, before you add a voice.
Please upload the drawing only, without photos of faces or other information that identifies a child (full name, school, address).
2. What data we process
| Data | Purpose | Legal basis |
|---|---|---|
| Email address and sign-in session | Creating your account and signing you in with a magic link | Performance of a contract (Art. 6(1)(b) GDPR) |
| Drawings (photo or scan), derived images, the 3D model and scene settings | Creating the figurine and the AR experience | Performance of a contract; the parent or guardian confirmation, recorded with date and version |
| Recorded or uploaded voice and the character's text message | Playing the voice on the project's AR page | Consent (Art. 6(1)(a) GDPR), which you can withdraw at any time |
| The published AR page (3D model, target image, audio) | Showing the experience to anyone who opens the link or QR code | Performance of a contract |
| Payment data (processed by Stripe, we never see your card number) | Collecting subscriptions and meeting accounting obligations | Performance of a contract; legal obligation (Art. 6(1)(c)) |
| Technical data in server logs (IP address, browser, time of access) | Security and operation of the service | Legitimate interest (Art. 6(1)(f)) |
| Preferred language (cookie) | Showing the site in the language you chose | Strictly necessary; see the Cookies page |
3. Your phone camera in the AR experience
The AR page asks for camera access to recognise the printed drawing. The camera image is processed on your phone, in the browser. It is not recorded and it is not sent to us or to anyone else.
4. Public AR pages
When you publish a project, its AR page can be opened by anyone who has the link or the QR code. The pages are not indexed by search engines, but they are not password protected. Do not include names, addresses or other personal data in them.
Deleting a project removes it from the app. If you also want the public page withdrawn, contact us using the details above.
5. Who receives the data
We do not sell data, we do not run personalised advertising and we do not use analytics or tracking tools. We use providers that process data on our behalf under data processing agreements:
| Provider | Role |
|---|---|
| Appwrite Cloud (Frankfurt region, Germany) | Accounts, database and uploaded files |
| Cloudflare R2 | Storage of public AR page files |
| Vercel | Website hosting |
| Railway | Background processing (generating pages and models) |
| Tripo (Tripo3D) | Generating the 3D model from the drawing, only when this feature is enabled. The drawing is sent to the provider for this purpose only |
| OpenAI | Studio idea chat: the short text you type is sent only when you have consented and the feature is enabled. We do not send drawings or images in this step. The reply chooses Studio settings (motion, decor, colours, lighting) |
| Stripe | Payments |
6. Transfers outside the European Economic Area
Some providers may process data outside the EEA, for example in the United States. In that case we rely on adequacy decisions (such as the EU-US Data Privacy Framework) or on standard contractual clauses approved by the European Commission.
OpenAI processes data in the United States. We use the AI chat only with your explicit consent and only for the text you send in Studio.
7. How long we keep data
- Account and project content: as long as the account exists or until you delete the project.
- Deleting your account and all associated data: on request, within 30 days at most.
- Server logs: for short periods set by the hosting providers.
- Payment and accounting records: for the period required by applicable accounting and tax law.
- AI chat messages: we do not store a conversation history in kidAR; short logs may exist at the provider under their policy.
8. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw your consent at any time without affecting processing done before the withdrawal.
Send your request using the contact details above. We reply within one month at the latest.
You can lodge a complaint with the Commission for Personal Data Protection of Bulgaria (www.cpdp.bg) or with the authority in your own country. In Romania: ANSPDCP (www.dataprotection.ro).
9. Security
We use encrypted connections (HTTPS), restricted accounts and short-lived signed links for private files. Access to uploaded drawings is limited to the account holder and our systems. If a security breach affects you, we will tell you and the competent authority within the legal deadlines.
10. Changes
If we change this policy in a significant way, we update the date above and, where needed, ask for your confirmation again.