Privacy Policy

AILAR Limited ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Cocodraw platform.

Please read this Privacy Policy carefully. By using Cocodraw, you consent to the practices described in this policy.

Information You Provide

• Account Information: Name, email address, password, and profile details when you register.
• Organization Information: School or business name, address, and contact details for organization accounts.
• Content: Whiteboards, files, and other content you create or upload to the Service.
• Communications: Messages you send to us through support channels or contact forms.
• Payment Information: Billing details processed through our secure payment providers.

Information Collected Automatically

• Usage Data: Features used, time spent, and interactions with the Service.
• Device Information: Browser type, operating system, device type, and screen resolution.
• Log Data: IP addresses, access times, and pages visited.
• Cookies: Small data files stored on your device (see Cookie section below).

We use your information for the following purposes:

Purpose	Legal Basis (GDPR)
Provide and maintain the Service	Performance of contract
Process payments and subscriptions	Performance of contract
Send important service notifications	Performance of contract
Improve and personalize the Service	Legitimate interests
Respond to support requests	Performance of contract
Send marketing communications (with consent)	Consent
Comply with legal obligations	Legal obligation
Prevent fraud and abuse	Legitimate interests

We may share your information in the following circumstances:

Service Providers

We work with trusted third-party companies to provide essential services such as hosting, payment processing, analytics, and customer support. These providers only access your data as necessary to perform their functions.

Organization Administrators

If you use Cocodraw through an organization, your administrator may have access to your account information and usage data within the organization.

Legal Requirements

We may disclose your information if required by law, court order, or government request, or if we believe disclosure is necessary to protect our rights, safety, or the safety of others.

Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

We do not sell your personal information to third parties.

Cocodraw's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google OAuth Scopes We Request

When you connect your Google account to Cocodraw, we request the following permissions:

Scope	Purpose
openid, email, profile	Identify your account and display your name/email in the app
drive.file	Access files you select through Google Picker, and save Cocodraw whiteboards to your Drive

How File Selection Works

Cocodraw uses Google Picker, Google's official file selection interface, to let you choose files from your Google Drive. This privacy-preserving approach means:

• You browse your Drive through Google's interface — Cocodraw never sees your full Drive contents or folder structure
• We only access files you explicitly select — When you choose a file in Google Picker, Google grants us temporary access to that specific file only
• Minimal permissions required — We use the drive.file scope, which is classified as non-sensitive by Google

What Google Data We Access

When you connect your Google account to Cocodraw, we may access:

• Basic Profile Information: Your name, email address, and profile picture for account identification and display purposes.
• Files You Select for Import: Using Google Picker and the drive.file scope, we can download files you explicitly choose to import into your whiteboards. Supported file types include:
  • PDF documents
  • Microsoft Office files (PowerPoint, Word, Excel)
  • Google Workspace files (Docs, Slides, Sheets) — exported via Google's API
  • Images (PNG, JPG, SVG, etc.)
  • Educational whiteboard formats (Smart Notebook, Promethean Flipchart)
  • Previously saved Cocodraw whiteboards (.coco files)
• Files Cocodraw Creates: Using the drive.file scope, we can create and update files that Cocodraw creates. This allows you to:
  • Save your Cocodraw whiteboards as .coco files directly to your Google Drive
  • Update previously saved whiteboards using "Quick Save"
  • Export whiteboards as PDF or PNG files to your Drive

What We Cannot Access

The drive.file scope is specifically designed to limit access. Cocodraw cannot:

• Browse or list your Google Drive folders or files
• Access any file you haven't explicitly selected through Google Picker
• Modify or delete files that Cocodraw didn't create
• See your Drive's folder structure or file metadata

This scope provides strong privacy protection while enabling the import and save functionality you need.

How We Use Google Data

We use data obtained through Google APIs exclusively to:

• Authenticate your identity and maintain your Cocodraw account
• Display your name and profile picture within the application
• Import files you explicitly select through Google Picker into your Cocodraw whiteboards
• Save your Cocodraw whiteboards to your Google Drive (when you choose to do so)
• Provide user-facing features that you have explicitly requested

Limited Use Compliance

Our use of Google user data complies with Google's Limited Use requirements:

• We only use data for user-facing features: Google data is used solely to provide or improve features visible in the Cocodraw interface.
• We do not transfer data to third parties except as necessary to provide user-requested features, for security purposes, or to comply with applicable laws.
• We do not use data for advertising: Google user data is never used for serving ads, retargeting, or interest-based advertising.
• We do not allow humans to read your data unless you provide explicit consent, it is necessary for security purposes, or required by law.

Data Storage and Security

Google OAuth tokens are encrypted at rest using industry-standard encryption (AES-256). We do not store copies of your Google Drive files on our servers beyond temporary caching necessary for import functionality. Imported content becomes part of your Cocodraw whiteboard and is stored according to our standard data retention policies.

You can disconnect your Google account at any time from your Cocodraw integrations settings, which will revoke our access to your Google data.

Revoking Access

You can revoke Cocodraw's access to your Google account at any time by:

• Visiting your Google Account permissions page
• Disconnecting Google Drive from your Cocodraw integrations settings at /integrations

Cocodraw integrates with Dropbox to allow you to import files and save your whiteboards to your Dropbox account.

Dropbox Permissions We Request

When you connect your Dropbox account to Cocodraw, we request the following permissions:

Permission	Purpose
account_info.read	Display your account name and email in the app
files.metadata.read	Browse your Dropbox folders and view file information
files.content.read	Download files you select for import into Cocodraw
files.content.write	Save Cocodraw whiteboards (.coco files) to your Dropbox

What Dropbox Data We Access

When you connect your Dropbox account to Cocodraw, we may access:

• Account Information: Your name and email address for display purposes.
• Files You Select: We can browse your Dropbox folders and download files you explicitly choose to import into your whiteboards.
• Files Cocodraw Creates: We can save and update Cocodraw whiteboard files (.coco) in your Dropbox.

How We Use Dropbox Data

We use data obtained through Dropbox exclusively to:

• Display your account information within the application
• Allow you to browse and import files from your Dropbox
• Save your Cocodraw whiteboards to your Dropbox

Data Storage and Security

Dropbox OAuth tokens are encrypted at rest using industry-standard encryption (AES-256). We do not store copies of your Dropbox files on our servers beyond temporary caching necessary for import functionality.

Revoking Access

You can revoke Cocodraw's access to your Dropbox account at any time by:

• Visiting your Dropbox Connected Apps page
• Disconnecting Dropbox from your Cocodraw integrations settings at /integrations

Cocodraw uses Stripe to process all payments and manage subscriptions. Stripe is a leading payment processor trusted by millions of businesses worldwide.

What Data is Shared with Stripe

When you subscribe to a paid plan or make a payment, we share the following information with Stripe:

• Contact Information: Your name and email address for receipts and billing communications.
• Payment Details: Credit/debit card information or other payment method details. This information is sent directly to Stripe and is never stored on our servers.
• Billing Address: If required for payment verification or tax purposes.
• Transaction Information: Subscription plan, amount, and payment history.

How Stripe Uses Your Data

Stripe processes your payment information in accordance with their privacy policy. Stripe may use your data to:

• Process and complete your payment transactions
• Prevent fraud and ensure payment security
• Comply with legal and regulatory requirements
• Send transaction receipts and billing notifications

Data Security

Stripe is PCI-DSS Level 1 certified, the highest level of certification in the payments industry. Your payment card details are encrypted and processed securely by Stripe. Cocodraw does not store your full card number, CVV, or other sensitive payment details on our servers.

Stripe Customer Portal

You can manage your payment methods, view invoices, and download receipts through the Stripe Customer Portal, accessible from your Cocodraw billing settings. This portal is hosted and secured by Stripe.

Stripe's Privacy Policy

For complete details on how Stripe handles your data, please review:

• Stripe Privacy Policy
• Stripe Consumer Terms

Cocodraw integrates with Microsoft OneDrive to allow you to import files and save your whiteboards to your OneDrive account.

Microsoft Permissions We Request

When you connect your Microsoft account to Cocodraw, we request the following permissions:

Permission	Purpose
User.Read	Display your account name and email in the app
Files.Read	Browse your OneDrive folders and download files you select for import
Files.ReadWrite	Save Cocodraw whiteboards (.coco files) to your OneDrive

What OneDrive Data We Access

When you connect your Microsoft account to Cocodraw, we may access:

• Account Information: Your name and email address for display purposes.
• Files You Select: We can browse your OneDrive folders and download files you explicitly choose to import into your whiteboards.
• Files Cocodraw Creates: We can save and update Cocodraw whiteboard files (.coco) in your OneDrive.

How We Use OneDrive Data

We use data obtained through Microsoft OneDrive exclusively to:

• Display your account information within the application
• Allow you to browse and import files from your OneDrive
• Save your Cocodraw whiteboards to your OneDrive

Data Storage and Security

Microsoft OAuth tokens are encrypted at rest using industry-standard encryption (AES-256). We do not store copies of your OneDrive files on our servers beyond temporary caching necessary for import functionality.

Revoking Access

You can revoke Cocodraw's access to your Microsoft account at any time by:

• Visiting your Microsoft Account App Permissions page
• Disconnecting OneDrive from your Cocodraw integrations settings at /integrations

We retain your personal information for as long as necessary to:

• Provide the Service and maintain your account
• Comply with legal obligations
• Resolve disputes and enforce our agreements

When you delete your account, we will delete or anonymize your personal information within 90 days, except where retention is required by law.

Your content (whiteboards and files) will be deleted upon account termination unless you have requested an export.

We implement appropriate technical and organizational measures to protect your information, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Regular security assessments and audits
• Access controls and authentication measures
• Employee training on data protection
• Secure cloud infrastructure with reputable providers

While we strive to protect your information, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

Under applicable data protection laws (including GDPR and UK GDPR), you have the following rights:

• Access: Request a copy of your personal data.
• Rectification: Request correction of inaccurate data.
• Erasure: Request deletion of your personal data.
• Portability: Request your data in a portable format.
• Restriction: Request restriction of processing in certain circumstances.
• Objection: Object to processing based on legitimate interests.
• Withdraw Consent: Withdraw consent at any time for processing based on consent.

To exercise these rights, please contact us at [email protected]. We will respond within one month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

We use cookies and similar technologies to enhance your experience. Types of cookies we use:

Type	Purpose
Essential	Required for the Service to function (authentication, security)
Preferences	Remember your settings (theme, language)
Analytics	Understand how you use the Service to improve it

You can manage cookie preferences through your browser settings. Note that disabling certain cookies may affect functionality.

Cocodraw is designed for educational use and may be used by children under the supervision of educators and parents. We are committed to protecting children's privacy:

• We do not knowingly collect personal information from children under 13 without parental or school consent.
• Educational organizations using Cocodraw are responsible for obtaining appropriate consent for student use.
• We comply with the Children's Online Privacy Protection Act (COPPA) and equivalent UK regulations.

If you believe we have collected information from a child without proper consent, please contact us immediately.

Your information may be transferred to and processed in countries outside the UK and European Economic Area. When we transfer data internationally, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions for countries with adequate protection
• Other legally recognized transfer mechanisms

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• Posting the updated policy on our website
• Updating the "Last updated" date
• Sending an email notification for material changes

We encourage you to review this policy periodically.

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us: