Privacy

Data and purposes

For adult accounts we process an email address, verification and session information, and any family memberships. These identify the account and give the correct access. Children’s profiles can contain a nickname, chosen character and PIN verifier. Children do not need their own email.

Work can contain drawings, animations, titles, thumbnails, timestamps and uploaded pictures, audio or video. Material can be personal data if someone is identifiable. Avoid unnecessary personal information about yourself or others.

Device connections, security limits, access events and technical errors support operation and protection against misuse. Family time features process active use within GoCreate and chosen time rules. They do not measure all use of the device.

If you buy the Star brush we store your account id, amount, currency, transaction id, purchase status and time to give you access to the brush, handle refunds and meet bookkeeping requirements. Card details and billing address are collected by Paddle, not by us. If you choose to appear on the Wall of Stars we store the nickname you enter until you remove it.

Who can see the work?

Your personal studio is separate from the family’s child profiles. A family owner and authorised adults can see synced work from children they have access to, and summaries of their time in the studio. This version of GoCreate has no public user-gallery feature.

Limited technical and administrative access may be necessary for operation, security and rights requests. A verified email establishes control of an account; it does not by itself prove parental responsibility.

Legal bases and children’s data

Providing the requested account and storage of personal work is based on the service agreement with the adult. Security and misuse prevention may rely on legitimate interests following a documented assessment. Where consent is needed, it must be requested separately and be withdrawable.

Children’s interests require a separate assessment. An adult creating an account does not give blanket consent to all processing of a child’s information.

Storage, recovery and deletion

Account data and work are needed while the account and storage are in use, unless a particular legal obligation or justified security handling requires otherwise. Removed family projects can normally be recovered for 30 days. Removed personal-studio work remains available for restoration until account deletion or an additional retention function is introduced.

Deletion uses the service’s controls and cleanup queues. Stored revisions and uploaded parts are included when a project or account is permanently erased. A disconnected or offline device can retain a local copy until it reconnects or that copy is removed on the device. Personal downloads are not remotely wiped.

Exact periods for operational logs, backups and suppliers’ residual retention need to be confirmed and added before public launch. We therefore do not promise that every copy disappears immediately when deletion is selected.

Suppliers and transfers

We share data with these categories of recipients: service providers and subprocessors for hosting, storage and sign-in; Paddle.com Market Ltd (United Kingdom), the Merchant of Record, which processes data for the sale, payment, tax, receipts and invoicing; professional advisers such as auditors and lawyers; and authorities where required by law. We do not sell personal data.

The service is developed and operated using Lovable Cloud and its managed database, authentication and file-storage functions, built on Supabase. Suppliers may process data on our behalf. The final contracting supplier and subprocessor list, processing regions and any international-transfer safeguards must be confirmed before public launch.

Where data is transferred outside the EU/EEA, this relies on an adequacy decision (for example for the United Kingdom) or the European Commission’s standard contractual clauses.

Your rights

You can request information and access, correction, deletion, restriction and, where applicable, portability. You can object to processing based on legitimate interests and withdraw consent without affecting earlier lawful processing. Requests are assessed under the rules applicable to the particular case.

Use the account privacy tools or write to Hjaldahl Group AB. We may need to verify the requester and the scope of the request. Children have their own rights; a family role alone does not determine how a child’s data request should be handled. We normally respond within one month. You can complain to the Swedish Authority for Privacy Protection (IMY).

Security and contact

We use appropriate technical and organisational measures, including encrypted connections, access controls and hashed PINs. Purchase records are kept as long as Swedish bookkeeping law requires, normally seven years, then deleted or anonymised.

Send privacy questions and requests to contact@gocreate.se or to Hjaldahl Group AB, Olaigatan 8 c, 703 39 Örebro, Sweden.

Official guidance

IMY