Privacy policy
This privacy policy (the “Policy”) explains what data we collect through www.gooblen.ro and its embroidery chart generator, why we collect it, how long we keep it, and what rights you have in relation to it. By using the site, you acknowledge the terms of this Policy.
The Policy is supplemented, where applicable, by Regulation (EU) 2016/679 (“GDPR”) and by Romanian data protection legislation.
1. Scope
This Policy covers the public site, the sample gallery and the chart generator available at /creeaza. It does not cover third-party sites we link to, which have their own policies.
2. What we collect
The service has no user accounts: we do not ask you to register, we do not ask for your name, and we do not ask for your email address in order to generate a chart. The categories of data we process are as follows.
Data you submit through the generator: the image you upload, the title you give the piece, and the parameters you choose (thread brand, stitch count, colour count), together with the files generated from them. If the image you upload contains personal data, for example a photograph of a person, that data is processed as part of the image.
Technical data, recorded automatically: for each significant operation (uploading an image, creating a chart, its completion or failure, downloading the result) the system writes an entry to a technical log containing the time of the action, the type of action, internal job identifiers, the title of the piece, the IP address the request came from, and the browser identifier (“user agent”). We use these records to diagnose problems, for security, and to detect abusive use.
Strictly necessary cookies: the site sets a technical cookie named gooblen_session. It is created after you pass the anti-bot check, lives for roughly 20
minutes, and exists solely so that you are not made to pass that check again at every step of
generation. It contains no information about you and cannot be used to track you across sites.
Analytics cookies: we use Google Analytics 4, a service provided by
Google Ireland Limited, to understand how many visitors the site has, which pages are read and where
people come from. For that purpose Google sets its own cookies in your browser, typically _ga and _ga_<identifier>, lasting up to two years. They assign you a random identifier,
which lets us tell a new visitor from a returning one.
Through this tool, Google receives information about the pages you visit, the time and length of your visit, the address you arrived from, your device and browser type, your language and an approximate location at city or region level. Google Analytics 4 does not record your full IP address: it is used transiently to derive that approximate location, then discarded. We do not send Google your name, your email address, the images you upload or the content of the charts generated.
Alongside the pages you read, we also record a few actions inside the generator: how far through the wizard you got, whether a chart was requested, whether generating it succeeded and whether the archive was downloaded, together with the settings chosen - the number of colours, the size in stitches, the yarn brand and the paper format. Without them we would know nothing about how the site is actually used, because the whole wizard happens at a single address. We do not attach the name you give your piece, the file you uploaded, or any other content of yours to these actions.
We use no advertising cookies, we do not sell data to advertisers, and we have not enabled Google Analytics' marketing or audience-building features. We do not build individual visitor profiles.
How to refuse analytics: you can block these cookies in your browser settings, use a browser or extension that blocks analytics scripts, or install Google's official Analytics opt-out add-on. The site works identically if you do: generating charts does not depend on analytics in any way.
3. Why we process this data
Your image and parameters are processed for a single purpose: generating the chart you asked for and making the result available for you to download. The technical log is processed for the correct operation, security and protection of the service against abuse. Analytics data is processed so that we know whether the site is used at all, which pages are useful and where people get stuck, which is how we decide what is worth improving. We do not use your data for marketing, we do not use it for profiling, and we do not make automated decisions with legal effects on you based on it.
4. Legal bases
For the image and parameters you submit, we rely on your express request to generate a chart, and on the steps necessary to provide the service you asked for. For the technical log and anti-abuse measures we rely on our legitimate interest in keeping the service working and secure. For analytics we rely on our legitimate interest in understanding how a service we give away for free is actually used, in the least intrusive form the tool allows: no advertising, no audience building and no individual profiling. You may object to this processing at any time, by the means described in section 2. Where the law requires records to be kept, we rely on the applicable legal obligations.
5. How long we keep data
The archive of charts is kept for 14 days, after which the system deletes it automatically. This is also why the download link you receive stays valid for 14 days. Download the files and keep them locally; we hold no copies after expiry.
The uploaded image and the simulation of the piece are kept for 6 months, so that the technical record of the generation stays complete for as long as we can usefully consult it if something goes wrong. These too are deleted automatically at the end of that period.
The technical log described in section 2 is kept for 365 days, after which it is deleted automatically. In both cases deletion happens through the database's automatic expiry mechanism, not through manual intervention.
Analytics data is kept for 2 months in the Google Analytics account, the shortest period that service allows for detailed data, after which Google deletes it. Aggregate statistics, which no longer allow any single visit to be identified, remain available beyond that point.
6. Abuse protection
Generating a chart consumes real computing resources, so we use Cloudflare Turnstile to distinguish real people from bots at the moment an image is uploaded. It is a check that usually runs in the background, with no action needed from you, and it may evaluate technical signals from your browser, including your IP address. It is provided by Cloudflare, under Cloudflare's privacy policy.
7. Who we share data with
We do not sell or rent your data and we do not pass it to third parties for marketing purposes. The infrastructure the service runs on involves three providers: Cloudflare, for site delivery, abuse protection and storage of the gallery archives, our own server, hosted in the European Union, which runs the generator itself and temporarily stores your image and the generated files, and Google Ireland Limited, for the traffic statistics described in section 2, under Google's privacy policy. These providers process the data only as far as necessary to operate the technical services they supply. Google receives browsing data only; the images you upload and the charts generated from them never leave the infrastructure described above.
8. International transfers
Chart generation and the temporary storage of files take place on a server located in the European Union. To the extent that Cloudflare, as an infrastructure provider, processes or routes data outside the European Economic Area, we expect such transfers to rely on the recognized protection mechanisms that this provider states it applies to its international transfers.
Analytics data is collected by Google Ireland Limited and may be transferred to the United States, where its parent company is based. Google states that such transfers rely on the standard contractual clauses adopted by the European Commission and on the EU-US Data Privacy Framework. If you would rather your browsing data did not leave the European Economic Area, block the analytics cookies by any of the means described in section 2.
9. Security
Traffic to the site and to the generation interface is encrypted in transit. The generation interface is not publicly exposed: requests pass through an intermediate layer that adds the access key server-side, so that key never reaches your browser. We take reasonable technical and organizational measures, appropriate to the current stage of the project, to protect data against unauthorized access, loss or accidental disclosure. No method of electronic transmission or storage is completely secure, however, and we cannot guarantee absolute security.
10. The download link
The result of a generation is available at an address containing a hard-to-guess identifier. Anyone who obtains that address can download the files while they have not yet expired. Treat the link as private, and do not publish it if the image you started from contains anything you would not want others to see.
11. Children
The service is not directed at children under 16 and we do not knowingly collect data from them. If you are a parent or guardian and believe a child has sent us personal data, write to the address in section 13 and we will take the necessary steps.
12. Your rights
In relation to data processed through the site you may have, under applicable law, rights such as: the right of access, rectification, erasure, restriction of processing, objection and data portability. Note that the image and generated files are in any case deleted automatically within six months at the latest. For any request relating to these rights, including earlier deletion, write to us at the address below; including the download link you received helps us identify the job. You also have the right to lodge a complaint with the Romanian supervisory authority for data protection (ANSPDCP), or with the supervisory authority in your country of residence.
13. Contact and changes
For any question about this Policy or your data, write to us at contact@gooblen.ro. We may update this Policy from time to time, to reflect changes in our practices or in applicable legal requirements. The version published on this page, together with the last-updated date shown above, is the one in force at the time you read it.