Privacy Policy
Last updated: 14 October 2026
This privacy policy explains what personal data drawing-reference.com collects, why, who else handles it, and what you can do about it. We keep it short and plain on purpose. If something is unclear, email info@drawing-reference.com.
Who we are and what this privacy policy covers
Drawing-reference.com is run by Nico Konings in the Netherlands. Nico is the person responsible for your personal data (the “controller” under the GDPR, in Dutch the AVG). You can reach us at info@drawing-reference.com. We do not have a data protection officer.
This policy covers this website, the Gesture Drawing tool, our free reference pack sign-ups, our newsletter and the Art School course pages. It does not cover other sites we link to.
What we collect and why
| Where | What we collect | Why, and our legal basis | How long |
|---|---|---|---|
| Newsletter and free pack forms | Your email address. We also save the IP address and browser details sent with the form. | To send you a confirmation email, the free reference packs and our newsletter. Basis: your consent. The IP address and browser details serve as proof that you signed up. | Until you unsubscribe. Addresses that never confirm are deleted after 30 days. After you unsubscribe we keep your address on a do-not-email list so you are not mailed again. |
| Art School purchase | Your email address and order details from Gumroad. We never see your card details. | To deliver the course and answer questions. Basis: the contract you made when you bought. Gumroad sells the course and handles payment, VAT and receipts under its own privacy policy. | As long as needed for support and our bookkeeping, normally no longer than seven years. |
| Emails you send us | Your name and email address (as shown in your email) and what you write. | To reply to you. Basis: our legitimate interest in answering questions. | Up to 24 months after the last message. |
| Visiting the website | Pages viewed, referrer, device and browser type, approximate location. Our visitor statistics hash and anonymise this data. Our hosting server also keeps technical logs that include your IP address. | To see which pages help people and to keep the site secure. Basis: our legitimate interest. | Statistics: in anonymised form. Server logs: a short period set by our host. |
| Link clicks | The page you were on and the link you clicked (affiliate links, our own packs and tools). We do not store your name or IP address with this. | To see which references and packs are useful. Basis: our legitimate interest. | Detailed records up to 24 months. We keep overall totals as anonymous counts. |
| Google Analytics | Page views and device information, linked to a random ID in a cookie, only if you agree. | To understand how visitors use the site. Basis: your consent (see the cookies section). | Google keeps analytics data for the period we set in Analytics. We use 14 months at most. |
We do not sell your data and we do not make automated decisions about you.
Comments. Comments on posts are closed. A few older comments may still be stored with the name and email address their author gave. If you want a comment of yours removed, email us.
Cookies and similar technologies
Cookies are small files that a website stores on your device. Some storage is needed for the site to work. Everything else needs your consent.
- Google Analytics sets cookies named _ga and _ga_ followed by an ID. For visitors in the EU, the UK and Switzerland, analytics is set to “denied” by default. In that state no analytics cookies are stored, but Google still receives a basic, cookieless ping (page address, approximate region). We are adding a cookie banner so you can choose. Until it is live, we do not ask for consent, and visitors outside those regions may receive analytics cookies by default.
- YouTube videos in our posts load from youtube.com. When the page loads, YouTube may set cookies and receives your IP address, even if you do not press play. We plan to switch to the privacy-enhanced embed or to load videos only when you click them.
- Google Fonts are loaded from Google, which receives your IP address. We plan to host the fonts ourselves.
- Cloudflare Turnstile checks that a form is filled in by a person and not a bot. It loads from Cloudflare on pages with a form.
- Pop-up counters. Our own pop-ups store small counters in your browser session so the same pop-up is not shown again and again. This stays in your browser and is not sent to us.
- Hotjar. We no longer use Hotjar. If your browser still has cookies starting with _hj from an earlier visit, you can delete them in your browser settings.
You can delete or block cookies in your browser settings at any time. Once the cookie banner is live, you will also be able to change your choice from a link in the site footer.
Who else handles your data
We use these services to run the site. Each one handles data only for the purpose described and under its own privacy policy or a data processing agreement.
| Service | What it does for us | Where it is based |
|---|---|---|
| TransIP | Hosting for the website and the info@drawing-reference.com mailbox | The Netherlands |
| Brevo | Sends our emails (confirmation, free packs, newsletter) | France (EU) |
| Analytics, fonts, YouTube videos | USA | |
| Cloudflare | Spam protection on forms (Turnstile) | USA |
| Gumroad | Sells and delivers the Art School course, handles payment and VAT | USA |
Our email lists live in a mailing tool on our own website (FluentCRM) and are sent through Brevo. If you click an affiliate link (for example to Cubebrush, Amazon, Wingfox or Gumroad), the other site may set its own cookies and tell us that a purchase came from our link. That partner is responsible for its own data. We may also share data if the law requires it.
Data sent outside the EU
Google, Cloudflare and Gumroad are based in the United States. Where they handle your data, they rely on safeguards the GDPR allows, such as the EU–US Data Privacy Framework or standard contractual clauses. Check each provider’s own privacy policy for the details.
Your rights under this privacy policy
You can ask us to show you the data we hold about you, correct it, delete it, limit how we use it, or give you a copy you can take elsewhere. You can object to processing that rests on our legitimate interest. Where we use your consent, you can withdraw it at any time, and it does not affect what we did before. Every email we send has an unsubscribe link. To use any of these rights, email info@drawing-reference.com. We reply within one month.
If you think we handle your data wrongly, please tell us first so we can fix it. You also have the right to complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.
Children
The site is meant for people who want to learn to draw. It is not aimed at children under 16, and we do not knowingly collect their data. If you think a child has signed up, email us and we will delete it.
Security
We use reasonable measures to protect your data, such as secure connections, spam protection on forms and limited access to our email list. No website can promise perfect security.
Links to other sites
Our posts link to other websites, including shops and artists’ pages. We do not control those sites and are not responsible for their privacy practices.
Changes to this policy
We update this page when something changes, and the date at the top shows when. If a change affects how we use your email address, we will tell newsletter subscribers by email.