Privacy Policy

1. Who we are

Dadaki is a browser-based vector graphics editor operated by FireCMS S.L., Calle Prim 12, Madrid, Spain ("FireCMS", "we", "us"). This policy explains what personal data we collect when you use Dadaki, why, and the rights you have over it.

For any privacy question or to exercise your rights, contact us at hello@rebase.pro.

2. When this applies

You can use Dadaki anonymously in your browser without an account — designs then stay on your device and we do not receive them. This policy covers the optional cloud features: creating an account, signing in, and syncing or sharing designs.

3. Information we collect

Account information you provide: your email address, a password (which we store only as a salted hash, never in plain text), and an optional display name.

If you sign in with Google: your name, email address and profile picture, as returned by Google. We do not receive your Google password.

Content you create: the designs and documents you save to the cloud, their names, and — if you use teams — team names and membership.

Technical and security data: your IP address, browser user-agent and timestamps associated with sign-in sessions, used to keep your account secure.

Cookies: an essential, httpOnly authentication cookie keeps you signed in. If — and only if — you accept the analytics banner, Google Analytics also sets its own cookies (_ga and _ga_*) to recognise a returning browser. We use no advertising cookies and no cross-site tracking cookies.

Usage analytics: we use Google Analytics 4 to count page views and to see which editor features get used — that an export ran, that a shape was drawn — so we know what to improve. Until you accept the banner it runs in a mode that stores nothing on your device and sends no identifier, and Google's advertising features are disabled for every visitor, whether they accept or not. The contents of your designs are never included, and share and password-reset links are stripped out of what is recorded.

4. How and why we use your data

We use your data to:

• provide the service — authenticate you, and store, sync and display your designs;
• enable collaboration when you choose to work in a team;
• keep accounts and content secure and detect abuse;
• send transactional emails you request or that are necessary, such as password-reset and email-verification messages.

We do not use your designs to train models, and we do not sell your personal data.

5. Legal bases (GDPR)

We rely on: performance of our contract with you (to provide the service you sign up for); our legitimate interests (to secure the service and prevent abuse); your consent where required (for example, optional communications); and compliance with legal obligations.

Analytics cookies rest on your consent alone. Nothing is stored on your device until you accept, and you can withdraw at any time — see “Your rights” below.

6. Where your data is stored

The service runs on Google Cloud Platform in the European Union (europe-west1). Account data is held in a managed PostgreSQL database, and your saved designs are stored as files in Google Cloud Storage, both within the EU.

If you accept analytics cookies, the usage data that Google Analytics collects may be processed by Google outside the EU, under the safeguards in Google's data-processing terms. Your account data and your designs are not part of that and do not leave the EU.

7. Service providers (sub-processors)

We share data only with the providers that help us run the service, under contractual data-protection terms:

• Google Cloud Platform — hosting, database and file storage;
• Google — authentication, if you choose Google sign-in;
• Google Analytics — usage measurement, only if you accept analytics cookies;
• our email provider — to deliver transactional emails, when configured.

We may also disclose data if required by law or to protect our rights, users or the public.

8. Data retention

We keep your account data and designs for as long as your account is active. If you delete your account, we delete the associated personal data and designs, except where we must retain limited information to meet a legal obligation. Backups are cycled on a rolling basis and purged over time.

9. Your rights

Under the GDPR you have the right to access, correct, delete, restrict or object to the processing of your personal data, and to data portability. You can withdraw consent at any time where we rely on it. To exercise any of these, email us at hello@rebase.pro. You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD).

To change or withdraw your analytics-cookie choice, open https://dadaki.com/?cookie-settings=1 — the banner reopens and your new answer replaces the old one. Declining stops the cookies being set and removes nothing else; the editor works exactly the same either way.

10. Security

We protect your data with encryption in transit (HTTPS), hashed passwords, httpOnly session cookies, database-level access controls and tenant isolation. No system is perfectly secure, but we work to protect your information and to notify you of any breach as required by law.

11. Children

Dadaki is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. We will change the effective date below and, for material changes, take reasonable steps to notify you.

13. Contact

Questions or requests: hello@rebase.pro. Operator: FireCMS S.L., Calle Prim 12, Madrid, Spain.