Privacy Policy

Ilyzlist (“we”, “our”, “us”) is a fundraising platform that turns children’s drawings into campaign art and donor rewards. Parents, teachers, or another responsible adult (“Organizers”) create and manage campaigns; donors support them. This policy explains what data we collect, how we use it, and responsibilities when children’s artwork is involved.

This policy applies to ilyzlist.io and related services. If you use other Ilyzlist apps or environments, their specific notices may also apply.

Last updated: 10/24/2026

• Organizers (parents/legal guardians, teachers, school representatives) must be adults legally able to consent on behalf of participating children.
• Children do not create accounts. Their drawings are submitted and managed by an adult Organizer.

• Account data: email address, display name, and authentication information (via Supabase auth).
• Profile / project content: campaign titles/text, budgets, reward descriptions, and images of drawings you upload. Please do not upload photos that identify a child.
• Payments: processed securely by Stripe. We never receive or store full card numbers. We receive payment status, amounts, and metadata needed to confirm donations.
• Logs: basic technical logs (IP address, device/browser info, timestamps, error logs) from hosting/security providers to keep the service reliable and prevent abuse.

• Create and operate user accounts and campaigns.
• Display campaign pages publicly when published.
• Fulfill transactions and donor receipts via Stripe.
• Generate thumbnails/prints of drawings and deliver donor rewards.
• Send essential service emails (e.g., confirmations, important notices).
• Maintain security, debug problems, and improve our service.

Legal bases (GDPR/EU): performance of a contract; your consent (where required); our legitimate interests in operating a safe, effective service; and legal obligations (e.g., accounting).

• Consent: By uploading a child’s drawing, the Organizer confirms they have the necessary parental/guardian consent and school permissions (where applicable) to use and publish the artwork for the stated campaign purpose.
• No identifying content: Upload drawings only. Do not upload photos of children, personal information, names, addresses, school IDs, class lists, or any content that could identify a child.
• Moderation: We may remove content that appears to include personal data of a child, unsafe material, or rights-infringing content, and may suspend a campaign to protect participants.
• License to display: You retain ownership of submitted content. You grant us a limited, worldwide, royalty-free license to host, display, reproduce, and adapt submitted content for the operation and promotion of the campaign, including donor rewards and platform marketing in connection with that campaign.

We may process drawings to create thumbnails, stickers, postcards, or prints. We do not intentionally use children’s drawings to train generalized AI models. If we test automated tools (e.g., sizing, background removal, light quality checks), we limit processing to what’s necessary and do not permit downstream training where we can control it.

• Processor: Payments are handled by Stripe. Card data never reaches our servers.
• Receipts: Stripe may send receipts and share non-sensitive payment metadata with us for reconciliation.
• Refunds: Any refunds are handled according to campaign rules, local law, and Stripe’s policies.

We share data only with providers that help us run Ilyzlist:

• Supabase (database, authentication, file storage)
• Vercel (hosting, logs)
• Stripe (payments)
• Email service providers for essential service emails

These providers act under contract and process data on our instructions. We do not sell personal data.

Our providers may process data in the EU/EEA, the UK, the US, or other countries. Where required, we rely on appropriate safeguards (e.g., Standard Contractual Clauses) to protect your data during cross-border transfers.

• Account and campaign data are kept while your account is active or a campaign remains published, and for a reasonable period thereafter for audit, tax, fraud prevention, or legal compliance.
• Payment records are retained as required by law and accounting rules.
• Technical logs are kept for short periods by hosting/security providers to ensure reliability and investigate incidents.
• You may request deletion of your account and content (see “Your rights”). Some data (e.g., financial records or backups) may be retained where legally allowed/required.

We use industry-standard security practices, including encryption in transit, access controls, and least-privilege administration. No system can be 100% secure; please report suspected issues to support@ilyzlist.io.

• We use essential cookies/local storage for auth sessions and basic functionality. We do not use advertising cookies.
• If we add optional analytics, we’ll update this policy and provide controls where required.

Depending on your location, you may have rights to access, correct, delete, or export your personal data; to object to or restrict certain processing; and to withdraw consent where processing is based on consent. To exercise these rights, contact privacy@ilyzlist.io. We may need to verify your identity before fulfilling a request.

If you believe your privacy rights have been violated, you may have the right to complain to your local supervisory authority.

If a drawing or campaign page includes information that could identify a child, or if content was uploaded without proper consent, contact safety@ilyzlist.io with the campaign link and a description. We prioritize safety reviews and may remove or limit content while we investigate.

• By submitting content, Organizers represent they have all rights and permissions (including parental/school consent) needed to use and publish the content.
• Organizers agree not to submit unlawful, harmful, or infringing content, and to comply with applicable laws, school policies, and this policy.
• Organizers are responsible for the accuracy of campaign information (budgets, goals, updates) and for complying with local rules governing fundraising.

We may update this policy to reflect changes in our service or applicable law. If changes are material, we’ll provide reasonable notice (e.g., on the site or by email).

Privacy: privacy@ilyzlist.io
Safety/takedown: safety@ilyzlist.io
General support: support@ilyzlist.io