Privacy

last updated 16 October 2026

Controller

Der Eddy, Austria (full details in the imprint). privacy@kadotz.com. KADOTZ is a brand of Der Eddy.

What we store, and why

Creation limit. To enforce one creation per 24 hours we set a signed, anonymous cookie (kdz_v) and store a hashed, salted form of your IP address for 24 hours. This is strictly necessary for the service and needs no consent (Art. 6(1)(f) GDPR, § 25(2) TTDSG / § 165 TKG).

Your idea and drawing. The text you type is sent to OpenAI (USA, EU data-processing terms and Standard Contractual Clauses) to generate the drawing and is checked against their moderation service. The drawing stays purchasable for 24 hours. Its page (the link you can share) stays online for up to a year, and the drawing appears, without your text, in the public “Recent KADOTZ” feed on our home page, and a selection of drawings appears together with the typed idea, without any name or personal data, on our own channels and in our advertising (the drawings belong to KADOTZ, see the terms); if a drawing or idea contains personal data about you, write to us to have it removed. Print files are deleted after 90 days; the artwork of an order is kept with the order.

Bag. Your bag lives in your browser's local storage only.

Orders. Payment is handled by Stripe (Stripe Payments Europe, Ireland). We never see your card details. Name, address, email and the ordered items are passed to our print partner Printful (Printful Latvia, Riga, EU) to produce and ship your order, together with the drawing to be printed, and kept as long as tax law requires (7 years in Austria, 10 in Germany). Your order confirmation reaches you through our email provider Resend (Resend, Inc., USA), which sends it from its EU region in Ireland. With a checkout we also note where your visit came from: the campaign tags in the link you arrived with (such as utm_source), the page you landed on, the referring website's domain and whether the link came from a TikTok, Meta or Google ad, never the ad platforms' click ids. This is kept with the order at Stripe so we know which ads work; your browser holds it in memory only, nothing is stored on your device for it.

Reminder emails. If you leave your email address on your drawing's page, we send you the link back to it right away, a reminder when 6 hours and when 2 hours are left, and one last mail with a €5 store credit once it has expired. Nothing else, no newsletter, and the reminders stop as soon as you order it. Every mail has an unsubscribe link. The mails go out through Resend (Resend, Inc., USA), which sends them from its EU region in Ireland. We keep the address for 35 days after the drawing expired (long enough for the credit), then it is deleted. So you don't have to type it again for your next drawing, we also keep it next to your anonymous visitor ID for 35 days after you last used it; the page then only shows a shortened form (like “se…@outlook.com”) and offers to send it there. Legal basis: your consent when you send the form (Art. 6(1)(a) GDPR), which you can withdraw with the unsubscribe link at any time. One more drawing. If you have already drawn today, you can leave your email address on the start page: we send you a link that unlocks one more drawing until your 24 hours are up (one per address and day, and only once you open the link), the same reminders for the drawing you made and for the extra one, and one mail when you can draw again. For that we keep the address, a hash of it (to allow one unlock per day) and the link for at most 24 hours, the “draw again” note until it is sent, and the reminders as above. Every mail has a link that stops all of it.

Hosting. The site runs on Vercel (EU region, Frankfurt) with Vercel Blob and Upstash Redis in Frankfurt.

Cookies and analytics

Necessary. The signed cookie above (kdz_v, 12 months) and your cookie choice (kdz_consent, 12 months). Your bag lives in this browser's local storage.

Analytics without cookies. Vercel Web Analytics counts page views and funnel steps (create, reveal, add to bag, checkout, purchase) without cookies, without identifying you, without cross-site tracking or fingerprinting. No consent needed.

Statistics (Google Analytics). Only if you allow “Statistics” in the cookie banner (or choose “Accept all”) do we use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to learn how visitors find KADOTZ and use the shop: pages viewed, how you arrived (the referring site or the campaign link), device, browser and approximate location (country and city, derived from your IP address, which Google does not store), and shop steps (pieces viewed, added to the bag, checkout, and a purchase with its order number, pieces and amount). The cookies _ga and _ga_<ID> (13 months) hold a random ID; when you pay, our server sends the purchase to Google with that ID so it counts for your visit. Events from before your choice stay in your browser's memory and are only sent once you allow statistics. Google keeps the data for 14 months. Google may process data in the USA; Google LLC is certified under the EU-US Data Privacy Framework. Google signals and ad personalisation stay off unless you also allow marketing. Legal basis: your consent (Art. 6(1)(a) GDPR, § 165(3) TKG). You can withdraw it any time via “Cookies” in the footer; the Google Analytics cookies in this browser are then deleted.

Statistics (Microsoft Clarity). Under the same “Statistics” choice we use Microsoft Clarity, a service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, to understand how the site is used: it replays anonymised sessions (mouse movement, scrolling, taps, pages viewed) and builds heatmaps, so we see where visitors get stuck. Text you type is masked and never recorded. The cookies _clck (13 months) and _clsk (1 day) hold a random ID. Microsoft may process data in the USA; Microsoft Corporation is certified under the EU-US Data Privacy Framework. Legal basis: your consent (Art. 6(1)(a) GDPR, § 165(3) TKG). You can withdraw it any time via “Cookies” in the footer; the recording stops and the Clarity cookies in this browser are then deleted.

Marketing. Only if you allow “Marketing” (or choose “Accept all”) do we use the Meta pixel (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland) and the TikTok pixel (TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, Ireland), and allow Google ads signals, to measure our ads and show KADOTZ to people like you: pages viewed and shop steps (pieces viewed, added to the bag, checkout, purchase with its amount) are sent to these providers with a random ID from their cookies (Meta: _fbp, 3 months; TikTok: _ttp and _tt_enable_cookie, 13 months). A purchase also carries its order number, so each order counts only once (your browser notes the order numbers it has already sent), and goes to TikTok together with your email address as a one-way SHA-256 hash, which TikTok uses only to match the purchase to a TikTok account and the ad it came from; Meta does not receive your email address. If you arrived through one of their ads and allow marketing on a later page, the ad's click id from the address you arrived at is handed to the pixel in its own cookie (Meta: _fbc, 3 months; TikTok: ttclid, 1 day), so the visit still counts for that ad. These providers may process data in the USA under the EU-US Data Privacy Framework. Legal basis: your consent (Art. 6(1)(a) GDPR, § 165(3) TKG). You can withdraw it any time via “Cookies” in the footer; the pixels stop and their cookies in this browser are then deleted.

Your rights

Access, rectification, erasure, restriction, portability, objection and complaint to your supervisory authority. Write to privacy@kadotz.com.