Privacy Policy
Step into your drawing turns a child's drawing on paper into a VR world on Meta Quest. Children do the most important part: they draw. A parent or another person aged 13 or older turns the finished drawing into a world and uses the app. We handle as little data as possible, and we never build a profile of your child.
1. Who we are
Step into your drawing is made by NIMCO (sole proprietorship of Roel Nentjes, trading as
NIMCO Studios / Kindertekening), Julianalaan 273, 3722 GN Bilthoven, the Netherlands, Chamber of Commerce no. 88026175.
NIMCO is the controller for the personal data described here.
Contact: [email protected]
2. Children and age
- The Meta Quest app Step into your drawing is for users aged 13 and up. A parent or guardian sets up the app, gives the consents and manages purchases.
- Younger children can draw on paper and watch on a phone, tablet or TV; they do not use this app in the headset.
- Children do not get an account, profile, e-mail address or login. We do not ask for or store anyone's age or date of birth.
3. What we collect and why
| Data | Why | How long |
|---|---|---|
| The parent's e-mail address | To tell you when a world is ready, to show the worlds ordered with this address in your family gallery, and to answer support questions | Until you delete your account |
| Preferred language | Language of the app and the story | Until you delete your account |
| Your app-specific Meta user ID | To connect your headset to your family and check purchases | Until you unlink or delete your account |
| Purchase records (Meta purchase ID, product, time, status) and your world credit | To give you the worlds you bought and handle refunds | While your account exists; afterwards kept without your name or e-mail for 7 years, as tax law requires |
| The photo of the drawing | To make the world | Deleted automatically 30 days after the latest delivery or update of your world (orders from 29 October 2026), also from our processing computer |
| The world, the short story and its audio | This is what you bought | Until you delete it, or ask us to |
| That you gave permission, and when | Proof of consent | While your account exists; then 2 years without your details |
| Support messages and reports | To help you and to handle reports | 12 months after they are handled |
| Technical logs without personal data | Fixing errors and keeping the service safe | 30 days |
We do not collect: age or date of birth, a child account or profile, surnames of children, photos, voices or faces of children, location, contacts, advertising IDs, or analytics about individual people. The app does not use the microphone. Text written on a drawing (such as a name or school) is painted out of the world while it is made. It can still be visible on the original photo, which is deleted 30 days after the latest delivery or update of your world.
We process your data to provide the service you asked for (our agreement with you) and, where we ask for it, on the basis of your consent, which you can withdraw at any time.
4. How we use AI
The world and the short story are made with AI, based on the drawing. Every world shows a small "made with AI" mark. In the standard flow, all AI that looks at the drawing runs on our own computer in the Netherlands: the photo is not sent to an outside AI service. The one optional cloud feature (Muse, see below) runs only with your explicit permission. The story is also written (and, for English, translated) by an AI model on that same computer, from a short text description of what is in the drawing (for example objects and colors) — not the image and not a name. We do not use your drawings to train AI.
Optional extra, off by default: we may offer extra figures made in the style of your child's drawing (for example butterflies or flowers that look hand-drawn). To make those, the drawing is sent to Muse, an image AI from Meta, in the cloud. We only do this when a parent or guardian explicitly asks for it, and we will tell you clearly before it happens. Without that request, your drawing never leaves our own computer for AI.
5. Who we share data with
We never sell your data and never use it for advertising. We only use service providers that process data on our behalf under a data processing agreement:
- Cloudflare — hosting and storage of accounts, drawings and worlds (stored in Cloudflare's Western Europe region).
- Our own computer in the Netherlands (run by NIMCO, the maker of this app) — makes the world and the story from the drawing. The photo is deleted there too, 30 days after the latest delivery or update of your world.
- ElevenLabs (voice service, USA; Microsoft as a backup voice) — reads the story aloud. It only receives the text of the story — no names — not the drawing.
- An e-mail service — sends the "your world is ready" message.
- Meta — runs the Store, accounts and payments under its own privacy policy.
Where data goes outside the EU, we rely on appropriate safeguards such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
6. Your rights and how to delete everything
- Delete everything with one button: in the app on Meta Quest, open the parent menu (🔒 Parents, behind your parent code) and choose Delete everything. Your family's worlds, photos and e-mail address are deleted from the cloud right away; the copies on our processing computer are queued for deletion and removed as soon as that computer processes the request (usually within minutes while it is switched on). Every headset linked to your family is unlinked. Contact us if you want confirmation. Only your world credit and the purchase record stay, linked to your Meta account through a pseudonymous code (never your name or e-mail), so you don't lose what you bought and we meet tax law. You can also e-mail us and we delete everything within 30 days, with the same exception for that pseudonymous purchase record.
- You can also unlink a headset (parent menu → Unlink Quest), and ask us by e-mail to delete a single world, send you your data, or withdraw a consent.
- You have the right to access, correct, delete, restrict and port your data, and to object. Contact us at [email protected]; we answer within one month.
- You can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your country.
7. Security
Data is sent encrypted and stored on encrypted disks. Each family only sees its own worlds, through private links with a long, hard-to-guess code. Only Roel can review worlds when something needs checking, via a protected web page. When something goes wrong, Roel may use an AI coding assistant on his own computer to find the cause; family data is never used to train AI.
8. Changes
If we change this policy, we will show the new version here with a new date. For important changes we will tell you by e-mail first.