Dashtoon Studio

GDPR overview

The site never mentions the GDPR. A search across every page collected returns no occurrence of "GDPR" or "General Data Protection Regulation", and no compliance is claimed anywhere. The privacy policy nevertheless grants GDPR-shaped rights: access, rectification, erasure, objection to processing, withdrawal of consent, portability to another controller, and the right to lodge a complaint with a supervisory authority. Requests are acknowledged within 72 working hours, and a breach is reported to the supervisory authority within 72 hours. No Article 27 EU representative is designated and no data protection officer exists; a Grievance Officer, Sanidhya Narain, is named with an address in Harrow, Greater London. The governing framework is American: Delaware law and exclusive Delaware jurisdiction, with dedicated addenda for California, Virginia and Colorado.

Who owns the data?

Under the terms of use you keep ownership of what you submit, but you grant Dashverse Corp a worldwide, non-exclusive, royalty-free, fully paid, sub-licensable and transferable licence over it. That licence lets the publisher use, copy, edit, modify, reproduce, distribute, adapt, translate, prepare derivative works from, display and fully exploit your submissions, including inside marketing and advertising material and on third-party media. Every other user of the service also receives a licence to access and reuse your submissions. On personal data, the privacy policy is explicit that Dashtoon acts as both the data controller and the data processor for everything collected through the site.

Reuse rights

Content published on the platform may only be accessed and viewed under a worldwide, non-exclusive, non-sub-licensable and non-transferable licence granted for personal, non-commercial use; reproducing, modifying, distributing or storing it for any other purpose requires prior written permission from the publisher or the copyright holder. Your own submissions remain yours to license elsewhere. For personal data, the privacy policy lists the permitted uses: operating and improving the site and its tools, building aggregated and anonymised statistics, investigating fraud and breaches of the terms, personalising content, confirming identity and eligibility, diagnosing technical problems, market research and meeting legal obligations. The publisher states that it does not sell, rent or trade personal data, shares only anonymised aggregates with business partners, and offers no third-party products or services on the site. Nothing anywhere addresses whether user content is used to train AI models.

Data retention & training

Hosting summary

The privacy policy's data transfer section states that information may be stored and processed in the United States of America, or in any other country where the publisher, its subsidiaries, affiliates or service providers maintain facilities. That wording is deliberately open: no data centre, hosting region or provider is ever named, and cross-border transfers away from the user's own jurisdiction are explicitly contemplated. The policy acknowledges that destination countries may have data protection laws that differ from the user's own and, in some cases, may not be as protective, and says only that appropriate safeguards have been taken, without identifying any of them. No subprocessor list is published. The public site is served behind Cloudflare and the resolved address is an anycast node on that network, which says nothing about where the data itself actually sits. In practice a user should assume United States hosting under Delaware law, with no contractual guarantee beyond that.