Legal
Privacy Policy
Version 1.1 · Last updated: October 8, 2026
Service notice · October 18, 2026: all tools and exports are now free without sign-in. We plan to retire accounts and begin account data cleanup no earlier than November 2, 2026 (UTC+8). Local images and drafts are unaffected. Read the account retirement announcement. The account and payment descriptions below document the previous service and retained records.
Operator and scope
DrawGrid.org is operated by seven, an individual operator responsible for the personal information handled by DrawGrid. This policy covers our website, drawing tools, accounts, support, and subscription-related records. Contact us at seven.qwq027@gmail.com. External services, including Google sign-in and Waffo checkout, also process information under their own privacy policies.
Images and drafts stay in your browser
Images selected in our editors are processed locally in your browser. DrawGrid does not upload these editor images or local drafts to its servers. Saved artwork and drafts may be stored in your browser's local database. Signing in does not enable cloud backup or synchronization. Pro export authorization sends the requested capability to our server to check your account's access; it does not send the image for rendering.
You can remove local data through the available editor controls or your browser's site-data settings. Clearing site data may permanently remove drafts. Information you separately choose to email to support is handled as a support message.
Google sign-in and account information
When you sign in, we receive and store your Google account identifier, name, email address, email verification status, and profile image URL when provided. We also store account timestamps, authentication records, and session information, which may include your IP address and browser user agent. Google authorization tokens may be retained in encrypted form for authentication. DrawGrid does not receive your Google password.
We use this information to identify your account, maintain sign-in, secure the service, and associate Pro access with the correct user. Necessary cookies support login sessions, while browser storage may coordinate sign-in state and checkout attempts. Sessions are configured to expire after 14 days and may be renewed during use; signing out ends access through that session but does not delete the account.
Waffo checkout and subscription records
Live subscriptions are not open yet; test checkout, where available, can still create account and test transaction records. When you start a Waffo checkout, we send an internal account identifier, order reference, selected product, currency, and return address to associate the checkout with your account.
Waffo and its payment providers collect payment and billing information directly in checkout. DrawGrid does not collect or store your full card number or card security code. We receive and store checkout, order, payment, refund, and subscription identifiers and statuses, amounts and currencies, paid periods, cancellation requests, and verification records. Payment notifications may also contain transaction-related personal information supplied by Waffo.
We use these records to activate and verify Pro, avoid duplicate purchases, process cancellation requests, investigate billing issues, and support refunds and disputes. Waffo acts as Merchant of Record for its transactions and processes personal information for its payment, tax, security, and legal responsibilities under its Privacy Policy and the notices shown at checkout.
Automatically collected information
Hosting, security, analytics, and advertising providers may receive technical information such as browser type, operating system, approximate region, IP address, referring page, pages viewed, interactions, performance data, and errors.
Analytics
DrawGrid uses Google Analytics and Microsoft Clarity on selected website pages to understand visits and interactions, diagnose problems, and improve usability. Clarity may provide interaction recordings and heatmaps on pages where it runs. We do not intentionally send editor image contents or direct contact details to analytics or advertising providers. Learn more in Google's Privacy Policy and the Microsoft Privacy Statement.
Cookies and your privacy choices
Necessary sign-in cookies and local editor storage serve different purposes from analytics and advertising identifiers. Browser settings can block or delete cookies and site data, although doing so may sign you out or erase local drafts. Where a consent message is displayed, use its controls to manage the choices it offers. Provider controls linked above offer additional options. This policy itself does not constitute consent to optional tracking.
Contact messages
If you contact us, we may receive your email address, message contents, and technical details you choose to provide. This information is used to respond, investigate issues, and maintain appropriate records.
Purposes and legal grounds
Where applicable law requires a legal basis, the following describes the purpose and corresponding basis. Legitimate interests are subject to your rights; processing that requires consent cannot rely on this policy as consent.
| Purpose | Legal basis where applicable |
|---|---|
| Account access, requested features, subscriptions | Performance of the service agreement |
| Support and service notices | Performance of the agreement; legitimate interests in responding and maintaining the service |
| Security, fraud prevention, disputes | Legitimate interests in protecting users and the service; legal obligations where applicable |
| Accounting and lawful regulatory requests | Legal obligations |
| Optional analytics and advertising technologies | Consent where required; legitimate interests only where permitted by applicable law |
Recipients and international processing
Information may be processed by providers supporting hosting, databases, authentication, payments, email, analytics, and advertising for the purposes described above. Google Fonts also receives connection information when your browser requests our web fonts. We may disclose information when required by law or necessary to address fraud, security incidents, or legal claims.
Providers may process information outside your country, where privacy laws can differ. Any safeguards required for a transfer depend on the applicable law and provider arrangement. Contact us for information about the providers and transfer arrangements relevant to your data.
Data retention
Canceling a subscription does not close your account. Retention and deletion depend on the record type, legal obligations, and any unresolved dispute. The current handling is described below; a session expiration date is not an automatic database-deletion deadline.
| Information | Current handling |
|---|---|
| Local images and drafts | Stay in browser storage until removed by you or the browser. No server copy is created by the editor. |
| Login sessions | Configured to expire after 14 days, with renewal during use. Expiry ends session validity, not necessarily retention of every related record. |
| Account and authentication records | Kept to operate your account. Deletion requests are reviewed individually; there is no automatic deletion 90 days after canceling Pro. |
| Transactions, refunds, and verification records | Kept for access verification, accounting, fraud prevention, and disputes, subject to applicable retention obligations. Account closure may not permit immediate removal. |
| Support and technical records | Retention depends on resolving the request, security needs, and applicable obligations. Contact us for details relevant to your records. |
Third-party providers apply their own retention schedules to information they control. Requests for deletion or information about retention can be sent to our privacy contact below.
Security and incident response
We use protected session cookies and encryption for stored authentication tokens and payment notification payloads. Production sign-in requires HTTPS. No storage or transmission method is completely secure. Do not send passwords, full card details, or unnecessary sensitive information to support.
If a personal-data breach occurs, we will assess its impact and notify the appropriate authorities and affected people where required, within the deadlines applicable to that incident. Contact us promptly if you suspect an account or data-security issue.
Your rights and account deletion requests
Depending on your jurisdiction, you may request access, correction, deletion, restriction, objection, portability, withdrawal of consent, or an opt-out from certain personalized advertising. You may also have the right to complain to your local data protection authority.
Send requests to seven.qwq027@gmail.com, preferably from the email address associated with your account. We may need to verify your identity and will explain any applicable limits on your request. Account deletion is not currently a self-service feature. Financial or dispute records may need to be retained where legally required or otherwise lawfully necessary.
Request cancellation of active renewals through billing separately; a deletion request is not confirmation of subscription cancellation. Removing server account data does not clear drafts stored on your device. Requests about information Waffo holds for its own responsibilities can also be directed to Waffo through its privacy or buyer support channels.
Responses to privacy requests
We will respond within the period required by the law applicable to your request and explain any permitted extension, identity verification, or reason we cannot fulfill a request. If your request concerns advertising-related disclosure, say whether you want to opt out of sale, sharing, or targeted advertising under applicable law. Advertising disclosures described above may fall within those legal definitions even without a monetary payment; we do not characterize all advertising activity as exempt from those rules.
Communications
Support responses, security information, billing updates, and policy notices are service communications. If we introduce optional promotional messages, they will have a separate opt-in where required and an unsubscribe method. Unsubscribing from promotions does not cancel Pro or prevent necessary service notices.
Children and account eligibility
DrawGrid accounts and subscriptions are intended for adults aged 18 or older. Children using free educational tools should do so with a parent, guardian, or teacher and should not create an account or send personal information to support. If you believe a child has provided personal information, contact us so we can investigate and take appropriate deletion or protective steps.
Policy changes and contact
We will announce material changes at least 14 days before they take effect through a prominent website notice or email, except where law or urgent security needs require an earlier change. We will update the version and date above. Where a new use requires consent, a policy update does not replace obtaining that consent.
Privacy and support contact: seven, individual operator of DrawGrid, at seven.qwq027@gmail.com. You can also use our Contact page. See the Terms of Service for subscription and refund terms.