PRIVACY POLICY — Sketch Hero

Last updated: 3 August 2026 Scope: the website www.sketchhero.app and the Sketch Hero mobile applications for iOS and Android (hereinafter, together, the “Application” or the “Service”).

In accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), we inform you of how we process your personal data.

1. WHO IS THE DATA CONTROLLER?

• Controller: Sketch Hero S.L.
• Tax ID (NIF/CIF): B88704671
• Registered office: c/ Enric Granados 103, entlo. 2, 08008 Barcelona, Spain
• Contact email: robert@sketchhero.app
• Phone: +34 938 524 433
• Registration details: Registered with the Commercial Registry of Barcelona, Folio 1, Sheet B 656713, Entry 1
• Data protection contact: privacidad@sketchhero.app

2. WHAT DATA DO WE PROCESS?

You can browse the website without providing personal data, unless you voluntarily choose to leave us your email address in the waitlist form (see point h). To use the Application it is necessary to create an account. We process the following categories of data:

a) Account and identification data Email address, username or alias, photo or avatar (if you provide one), internal user identifier, and —if you sign in through third-party identity providers (Google, Apple)— the identifier and basic data that those providers pass on to us. We do not store your password in clear text.

a bis) Date of birth During registration we ask for your date of birth for the sole purpose of verifying that you meet the minimum age required to use the Service (see section 10). We only keep a record of the check carried out and its date; we do not use this data for any other purpose, nor to personalize content, nor for advertising.

b) User-created content (drawings) The drawings, sketches, strokes, layers and other graphic content you create or upload to the Application, together with their associated metadata (exercise or lesson they correspond to, date, duration, app version, canvas dimensions, tools used).

c) Progress and learning data Lessons and exercises completed, scores, ratings and comments you submit, evaluations and comments generated by the artificial intelligence system about your drawings, usage statistics and progress within the Application.

d) Technical and diagnostic data IP address, device and installation identifiers, device model, operating system and version, language, time zone, push notification tokens, and error and crash logs.

e) Communication and support data The data you provide when contacting us through forms, email, social media or support channels.

f) Transaction data If you purchase subscriptions or paid content, the transaction is processed entirely by Apple App Store or Google Play. We do not receive or store your card or payment-method data. We only receive confirmation of the status of your purchase or subscription and, where applicable, the data necessary for billing and compliance with tax obligations.

g) Diagnostic and stability data

When the Application suffers an unexpected crash or a serious error, a technical report is automatically generated that includes: the crash trace (a record of the state of the program at the moment of the error), the device model and manufacturer, the operating system version, the Application version, memory and storage status, screen orientation and a random installation identifier that does not allow you to be personally identified and is not associated with your account. These reports do not include the content of your drawings, your credentials, or the content of your communications. We do not use behavioural analytics tools: we do not record which screens you visit, how long you spend on them or how you navigate the Application.

h) Waitlist data (non-registered users)

If, before the Application launches, you decide to join our waitlist through the form on the website, we process your email address, together with the language of the page and a technical reference to the button from which you opened the form (a purely statistical item that tells us which sections of the site work best). Providing this data is voluntary: it is not required in order to browse the website and it does not condition your future access to the Service. We do not ask you for any other data and we do not require you to create an account.

Important: please do not include in your drawings, file names or comments any personal data of third parties or special categories of data (health data, ideology, racial or ethnic origin, sexual orientation, etc.). The Application is not designed to process that type of information.

3. FOR WHAT PURPOSE AND ON WHAT LEGAL BASIS DO WE PROCESS YOUR DATA?

Regarding the diagnostic and stability purpose. The legal basis is the controller’s legitimate interest (art. 6.1.f GDPR) in ensuring the proper functioning and security of the Service. The corresponding balancing test has been carried out, concluding that the processing is necessary and proportionate, that the data is technical in nature and minimally intrusive, and that it does not override the rights and freedoms of the data subject. You may object to this processing at any time by writing to privacidad@sketchhero.app.

Where processing is based on your consent, you may withdraw it at any time from the Application settings or by writing to us, without this affecting the lawfulness of processing prior to the withdrawal.

4. USE OF ARTIFICIAL INTELLIGENCE TO ANALYZE YOUR DRAWINGS

The main feature of Sketch Hero is to automatically evaluate your drawings and return an assessment and educational feedback. To do so:

• When you submit an exercise, your drawing (and, where applicable, the exercise prompt and certain metadata) is transmitted through our secure servers to one or more providers of artificial intelligence models acting as processors or sub-processors on our behalf.
• The drawing is not accompanied by identifying data beyond what is strictly necessary to associate the result with your account.
• The result of the analysis (score, comments, corrections) is stored associated with your account to let you review your progress.
• Our AI providers are contractually obliged to not use the content submitted to train their own models. The only training carried out is that described in section 5, on models intended for this Service.

Automated decisions. The evaluation of your drawings constitutes automated processing. It does not produce legal effects concerning you nor similarly significantly affect you: it is limited to an indicative educational assessment within a learning service. The results generated by AI systems may contain errors or inaccuracies and must not be interpreted as a professional or certified evaluation. In any case, you may ask us for a human review of the result or challenge it by writing to privacidad@sketchhero.app

Profiling. We use your history of exercises and scores to adapt the difficulty and content recommendations within the Application. This profiling has an exclusively pedagogical purpose and is not used for advertising purposes nor disclosed to third parties.

5. USE OF YOUR DRAWINGS TO IMPROVE OUR ARTIFICIAL INTELLIGENCE MODELS

General-purpose artificial intelligence models do not evaluate drawings with the precision required by a learning service. For this reason, we use the drawings created in the Application, together with their pedagogical metadata (associated exercise, score obtained, corrections and, where applicable, your rating of whether the correction was accurate), to train, fine-tune, validate and evaluate the artificial intelligence models that grade Sketch Hero exercises.

Legal basis: legitimate interest (art. 6.1.f GDPR).

The legitimate interest we pursue is to improve the quality and reliability of the automatic evaluation of drawings, which constitutes the core feature of the Service. We have carried out the corresponding balancing test, weighing the necessity of the processing and its impact on your rights, and we have concluded that the processing is proportionate considering, among other factors, that: the data is obtained directly from you; the use of your drawings to improve the system that grades them falls within the reasonable expectations of a user of this Service; the content processed (sketches and drawing exercises) has a very limited impact on your private life; and we apply the mitigating measures described below. You may ask us for a copy of that analysis by writing to privacidad@sketchhero.app.

Your safeguards

1. Right to object (art. 21 GDPR). You may object at any time to this processing, without needing to give reasons and at no cost or consequence to the rest of the Service, by means of a simple toggle in Settings → Privacy of the Application. The objection takes effect immediately.
2. Effects of the objection. From that moment on, we will stop incorporating your drawings into new datasets and new training processes, and we will remove them from the datasets we keep active. However, we transparently inform you that it is not always technically possible to remove the influence of a specific piece of data from an already-trained model; in that case, the resulting model does not contain your personal data in an identifiable form and does not allow it to be reconstructed.
3. Pseudonymization. Before incorporating the content into a training dataset, we remove or pseudonymize the identifiers that link it to your account.
4. Only for our models. The data is used exclusively to train and tune the models that serve Sketch Hero. We do not assign, license or sell your drawings or the datasets derived from them to third parties for training purposes. Training is carried out on infrastructure contracted by us, under a data processing agreement, and the infrastructure provider may not use that data for its own purposes.
5. Exclusion of minors. We do not use the drawings of users under 18 years of age for training. They are excluded by default and without needing to do anything.
6. Intellectual property. You retain ownership of your drawings. The limited license that allows us to use them for these purposes is governed by our Terms and Conditions.

If in the future we wished to use your drawings for a purpose other than the one described here —for example, transferring datasets to third parties—, we would first request your express consent.

6. PUBLIC GALLERY AND COMMUNITY FEATURES

The Application may include a gallery displaying users’ drawings, as well as rating or commenting features.

• Publishing in the gallery is always voluntary and is done drawing by drawing: no content is published unless you expressly tap the publish button on that specific drawing. That act constitutes your consent (art. 6.1.a GDPR) regarding that content.
• Published drawings will be shown alongside the alias or username you have chosen. We recommend using an alias that does not allow you to be identified if you wish to preserve your anonymity. Your email address will not be shown.
• Content published in the gallery is accessible by other users and, where applicable, publicly, and may be viewed, shared or indexed by search engines. Once published, third parties may have copied or stored it, so its removal from our platform does not guarantee its disappearance from the internet.
• You may unpublish a specific drawing at any time from the artwork itself, or remove all your drawings from the gallery at once from Settings → Privacy.
• We reserve the right to moderate, hide or delete content that is unlawful, offensive, that infringes third-party rights or that contravenes our Terms of Use. The Application provides a mechanism enabling any user to report inappropriate content.

7. TO WHOM IS YOUR DATA DISCLOSED?

We do not sell your personal data. Your data may be disclosed to the following categories of recipients, which act as processors on our behalf, under a contract in accordance with art. 28 GDPR:

• Cloud infrastructure, hosting, database, storage and authentication providers (currently Google Ireland Ltd. / Google LLC — Firebase and Google Cloud Platform services: Authentication, Firestore, Storage, Cloud Functions, App Check).
• Providers of artificial intelligence services and models for the analysis and evaluation of drawings (currently Google, through its AI model APIs) and, where applicable, other equivalent providers.
• Google Ireland Limited / Google LLC — Firebase Crashlytics service — purpose: error and stability reporting. International transfers covered by the EU-U.S. Data Privacy Framework and, subsidiarily, by the Standard Contractual Clauses approved by the European Commission.
• Communication, email and support service providers.
• Web3Forms — provider of the website’s waitlist form — purpose: to receive the data you enter in that form and forward it to us by email. [TO CONFIRM: legal entity, country of establishment and, if it processes data outside the EEA, the applicable transfer mechanism — see section 8]
• Distribution and payment platforms (Apple Inc. and Google), regarding transactions carried out in their stores, which act as independent controllers in accordance with their own privacy policies.
• Advisors, agencies and professionals (accounting, tax, legal), when necessary.
• Authorities and public bodies, where there is a legal obligation.

8. INTERNATIONAL DATA TRANSFERS

Some of our providers are located or may process data outside the European Economic Area, in particular in the United States.

These transfers are carried out with the appropriate safeguards provided for in Chapter V of the GDPR, by means of:

• The Adequacy Decision (EU) 2023/1795 on the EU-U.S. Data Privacy Framework, in the case of providers adhering to it; and/or
• The Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914, together with the supplementary measures that may be necessary.

You may ask us for information about the safeguards applicable to each provider by writing to privacidad@sketchhero.app.

9. FOR HOW LONG DO WE KEEP YOUR DATA?

• Account, drawings and progress data: for as long as you keep your account active. If you request deletion of the account, they will be erased or anonymized within a maximum of 30 days, except for copies in backup systems, which are overwritten within 90 days.
• Inactive accounts: we may delete accounts with no activity for 24 months, after prior notice to the associated email.
• Content published in the gallery: until you remove it or delete your account.
• Content incorporated into training datasets: until you exercise your right to object, with the exceptions in section 5.2. Data that is effectively anonymized may be kept indefinitely as it does not constitute personal data.
• Support and communication data: until your request is resolved and, subsequently, blocked for a maximum of 3 years to address possible liabilities.
• Billing and accounting data: 4 years for tax purposes (arts. 66 to 70 of the Spanish General Tax Law) and 6 years for commercial purposes (art. 30 of the Spanish Commercial Code).
• Waitlist data: until you withdraw your consent or ask to be removed and, in any event, for a maximum of 12 months from the launch of the Application, at which point the purpose is exhausted. If you create an account within that period, your data will then be governed by the general retention periods of this policy.
• Security records and technical logs: 12 months.
• Record of age verification and of consents given or withdrawn: for as long as you keep your account and, after its deletion, for 3 years, as proof of compliance with our obligations (art. 7.1 GDPR).
• Crash reports are kept for a maximum of 90 days from the time they are generated, after which they are automatically deleted.

Once these periods have elapsed, the data will be erased or irreversibly anonymized.

10. MINIMUM AGE OF USE

Sketch Hero is intended for persons over 14 years of age. To register and use the Service you must be at least 14 years old.

• During registration you will be asked for your date of birth. If you are under 14 years of age, you will not be able to create an account.
• If you reside in a country whose legislation sets a higher minimum age to consent to the processing of data in information society services, that age will apply.
• The Application is not designed, marketed or directed at children under 14 years of age, and we do not knowingly collect personal data from such minors.
• If we become aware that we have collected personal data from a child under 14 years of age, we will delete their account and data without undue delay.
• If you are a parent or guardian and believe that a minor in your care has registered in the Application by providing an incorrect date of birth, please let us know at privacidad@sketchhero.app and we will delete the account and associated data.

11. INFORMATION SECURITY

We apply appropriate technical and organizational measures in accordance with art. 32 GDPR, including: encryption in transit (TLS) and at rest, user authentication, security-rule-based access control, management of secrets and API keys in secure vaults, protection against unauthorized automated use (device attestation), request rate limiting, access logging and regular backups.

No system is infallible; in the event of a security breach entailing a high risk to your rights, we will inform you and notify the Spanish Data Protection Agency in accordance with arts. 33 and 34 GDPR.

12. WHAT ARE YOUR RIGHTS?

You may exercise the following rights at any time:

• Access: obtain confirmation of whether we process your data and access it.
• Rectification: correct inaccurate or incomplete data.
• Erasure (“right to be forgotten”): request the deletion of your data and your account.
• Restriction of processing: request that we suspend processing, keeping the data only for claims.
• Portability: receive your data, including your drawings, in a structured, commonly used and machine-readable format, or request its transmission to another controller.
• Objection: object to processing based on our legitimate interest, in particular to the use of your drawings to improve our AI models, which you can disable directly from Settings → Privacy.
• Withdrawal of consent: at any time, without retroactive effect on the lawfulness of prior processing.
• Not to be subject to automated decisions: request human intervention regarding the evaluations generated by AI (see section 4).

How to exercise them? By sending a request to privacidad@sketchhero.app, stating the right you wish to exercise and attaching a document proving your identity. You may also delete your account and your data directly from the Application settings.

Rights are strictly personal and will be exercised by the data subject, or by their duly accredited legal representative. We will respond within one month of receipt of the request, extendable by a further two months depending on the complexity or number of requests, informing you of the extension and its reasons.

Complaint to the supervisory authority. If you consider that your rights have not been duly addressed, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es — C/ Jorge Juan, 6, 28001 Madrid).

13. ACCURACY OF THE DATA

The User warrants that the personal data provided is truthful, accurate and up to date, and undertakes to communicate any modification to it. The User will be solely responsible for false or inaccurate statements and for any harm they may cause. Likewise, the User warrants that they hold the necessary rights over the content they upload to the Application and that it does not infringe third-party rights.

14. COOKIES AND SIMILAR TECHNOLOGIES

The website www.sketchhero.app does not use analytics, advertising or third-party cookies, nor any tracking or profiling tools. Only cookies or local storage strictly necessary for the provision and security of the service may be used, which are exempt from the consent requirement under art. 22.2 of the Spanish LSSI. Fonts and other assets are served from our own domain, with no requests to third parties. The mobile Application does not use cookies, but it does use device and installation identifiers for the purposes described in this policy.

15. CHANGES TO THIS POLICY

We reserve the right to modify this Privacy Policy to adapt it to legislative or case-law developments or to changes in the Service. Any substantial modification will be published on the website and communicated through the Application with reasonable advance notice. Where the modification affects processing based on your consent, we will request a new one.

16. CONTACT

For any matter relating to this policy or the processing of your data: privacidad@sketchhero.app — c/ Enric Granados 103, entlo. 2, 08008 Barcelona, Spain