Your data

Privacy Notice

Last updated 16 July 2026

Kroki is built privacy-first: we ask for as little as possible, we keep it briefly, and your original upload never leaves our care to reach a printer. This notice explains, in plain language, what we do with your data and the rights you have. It is our notice under Articles 13–14 of the General Data Protection Regulation (GDPR).

1. Who is responsible

The controller of your personal data is VMB support, established in the Netherlands, registered with the Dutch Chamber of Commerce (Kamer van Koophandel) under number 74677209, VAT / BTW number NL002119325B34, registered at Prins Willem-Alexanderstraat 8, 1396 KC Baambrugge, the Netherlands. For anything about your privacy, email hi@kroki.app.

2. What we collect

The photo or drawing you upload, and the artwork we generate from it. The artwork may be made by, or a photo may show, a child.
Details you add — an optional title, and optionally the artist's first name or age, to personalise the piece.
An anonymous device identifier — a random id stored on your own device that lets us keep your session and your gallery together. It is not linked to your name and we do not use it to track you across other sites.
Order and delivery details — the product you chose and the shipping address for a purchase.
Payment — handled by our payment provider. We never see or store your card details.

We do not run advertising trackers or third-party analytics, and we ask for no account and no password.

3. Why we use it, and our legal basis

What for	Legal basis (GDPR Art. 6)
Turning your upload into style previews at your request	Your consent, and steps taken at your request (Art. 6(1)(a) / (b))
Producing and shipping a piece you buy	Performance of our contract with you (Art. 6(1)(b))
Taking payment and preventing fraud	Contract (Art. 6(1)(b)) and our legitimate interest in secure payment (Art. 6(1)(f))
Keeping invoices and tax records	Our legal obligation (Art. 6(1)(c))
Answering your messages and handling complaints	Contract / our legitimate interest (Art. 6(1)(b) / (f))

You confirm that you created what you upload, or that you have the permission of the person who did — and where that person is a child, that you are their parent or guardian or have their permission. We process the upload solely to create your product. We do not use your images to train AI.

4. Who we share it with

We only share what a step genuinely needs, with providers acting on our instructions under a data-processing agreement:

Our print partner — to make and post your item, our fulfilment partner receives only the finished artwork file and your shipping address. It never receives your original photo or drawing.
Our payment provider (Stripe) — to process your payment securely; your card details go straight to them and not through us.
Our hosting and storage provider (Cloudflare) — your photos and generated files are held in object storage set to an EU jurisdiction.
A cloud AI image provider — to generate the styled artwork from your upload. Depending on capacity, this styling step may be performed on infrastructure inside the EU/EEA or, where it is not, under an EU-approved transfer safeguard such as Standard Contractual Clauses (see section 5).

We do not sell your data, and we do not share it for anyone else's marketing. A current list of our providers is available on request from hi@kroki.app.

5. Where your data is processed

Your photos and generated files are stored in the European Union. The AI styling step may, at times, run outside the EEA; where it does, we rely on an appropriate safeguard under Chapter V GDPR (such as an adequacy decision or EU Standard Contractual Clauses) so your data keeps its European-level protection. You can ask us for details of the safeguard in place.

6. How long we keep it

We keep things only as long as we need them:

Your original upload and the generated files are deleted automatically after your order is delivered plus 90 days (or shortly after you finish, if you don't order).
You can delete everything yourself at any time, in one tap, from the app.
Invoice and order records we must keep for tax purposes are retained for the period Dutch law requires (currently seven years), then deleted.

7. Your rights

Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to how we use it, to receive it in a portable form (data portability), and — where we rely on your consent — to withdraw that consent at any time without affecting what we did before. To exercise any of these, email hi@kroki.app; we answer within one month.

If you think we've handled your data wrongly, you can lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or with the authority in your own EU country. We'd appreciate the chance to put things right first.

8. Cookies and local storage

We don't use advertising or analytics cookies. To make the app work, we store a small amount of data in your browser — including the anonymous device identifier described above — which stays on your device and is not used to track you.

9. Changes to this notice

If we change how we handle your data, we'll update this page and its date. For questions about anything here, contact hi@kroki.app.