Data controller

The entity responsible for processing personal data on this site is the provider listed in the imprint.

What data we process

Depending on how you use the service, we process the following data:

• Workshop access tokens — used to authenticate you and link uploads to a workshop. Tokens are stored as a hash in our database.
• Photos you upload — stored on our servers and forwarded to AI image services to generate transformations.
• Prompts and generated results — stored together with the chat session so you can review and continue your work.
• Authentication cookie — a JWT token kept in your browser to keep you signed in during a session.
• Server logs — including IP address, user agent and timestamps. Used for operations and security and rotated after a short period.

Third-party services

To deliver the AI-powered features, the application may forward your prompts and images to:

• Black Forest Labs (BFL Flux) — image generation API.
• Anthropic (Claude) — prompt enhancement and chat features.
• Mistral AI — optional alternative for prompt enhancement.

Each request is sent under the API key of the operating organization. Data shared with these providers is subject to their own privacy policies.

DIPAS imports

When a place is configured with a DIPAS subdomain, public contributions are fetched from the corresponding DIPAS instance. We do not transmit any of your personal data to DIPAS.

Storage and deletion

How long we keep something depends on what it is. The clock runs from the last time a chat was worked on, not from when it was created, and a job deletes what is due once a day.

• Generated images nobody picked — deleted after 30 days. Each step produces several variations and only the chosen one is kept.
• Chats that were never published, together with the images that were picked and any drawings — deleted after 90 days, so a workshop series can come back to its work in a later session.
• Photos you uploaded yourself — deleted after 30 days, unless the photo is the “before” of a gallery item that is published.
• Published gallery items and the images they show — kept for as long as they stay published. Publishing them is the point of the tool.
• If a gallery item is unpublished or removed, its link stops working immediately and the images behind it are deleted 30 days later.
• The workshop link itself and its settings are not touched by this: they are the organisers’ configuration, not your data.

Deleting means the image files are removed from our servers, not hidden. There is still no self-service delete button — the next section explains how to ask.

How to have something deleted

Workshop participants are anonymous to us: you sign in with a shared workshop link, not a personal account, so we cannot identify your data from a request alone and you cannot delete it yourself. Ask the person running your workshop, or write to the address in the imprint — include the link to the gallery item if there is one, because that is what lets us find it. We will delete it, including the original photo.

Photos of other people

Please photograph places, not people. Do not upload photos in which other people can be recognised, and do not upload photos of other people without their permission. If an image showing a recognisable person does reach the public gallery, tell us or the workshop organisers and we will remove it.

Workshops with children and young people

This tool is used in workshops with minors. The lawful basis for processing is the consent collected by the organisation running the workshop, usually from a parent or guardian on a paper form; that organisation, not this website, holds those forms. A parent or guardian can ask for a participant's data to be deleted using the route described above.

Your rights

Under the GDPR you have the right to:

• request information about the personal data we hold about you (Art. 15)
• have inaccurate data corrected (Art. 16)
• request deletion of your data (Art. 17)
• request restriction of processing (Art. 18)
• receive your data in a portable format (Art. 20)
• object to processing (Art. 21)
• lodge a complaint with a data protection supervisory authority

Contact

To exercise your rights or for any privacy-related question, contact us using the details in the imprint.