Privacy Policy

Last updated: 11 August 2026

This policy explains what happens to personal data in connection with the website nelldraper.com and the social media accounts published under the name “Nell Draper”. We process as little data as possible. This site has no user accounts, no comment function, no contact form, no advertising and no analytics.

1. Who is responsible

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Full company details are listed in our Legal Notice. We have not appointed a data protection officer, as we are not required to do so.

2. What “Nell Draper” is

“Nell Draper” is a fictional character generated with artificial intelligence. She is not a real person and does not depict, impersonate or portray any real individual. Her image, voice and spoken text are produced synthetically. All content published under this name is labelled as AI generated.

3. Visiting this website

When you open a page on this site, your browser automatically transmits technical information to our hosting provider. This is unavoidable and necessary to deliver the page. The following is recorded in server log files:

We do not merge this data with other sources and we do not use it to identify individual visitors.

4. No cookies, no tracking

This site sets no cookies. It uses no analytics, no tracking pixels, no advertising networks, no social media plugins and no external fonts, scripts or content delivery networks. Nothing on these pages is loaded from a third party server. Because of this, no consent banner is required and none is shown.

5. Hosting and transfer outside the EU

This website and the associated mailbox are hosted by netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany, acting as our processor under a data processing agreement pursuant to Art. 28 GDPR.

Please note: the server used for this domain is located in Manassas, Virginia, United States. Data described in section 3 and email described in section 6 is therefore processed on servers outside the European Union. The contracting party remains a German company subject to EU law, and the transfer is safeguarded by standard contractual clauses pursuant to Art. 46(2)(c) GDPR. You should nevertheless be aware that United States authorities may have access rights that do not correspond to the European level of protection.

6. Contacting us by email

Email is not encrypted end to end in transit unless both sides support it. Please do not send us sensitive information by email.

7. Our social media accounts

We publish content on Instagram and TikTok. When you visit or interact with those profiles, the respective platform processes your personal data on its own responsibility and under its own privacy policy. We have no influence on that processing and no access to the underlying data.

What we do receive is aggregated, non personal statistics provided by the platforms, such as view counts, watch time and coarse audience demographics. These figures do not allow us to identify individual people. Where a platform and we are considered joint controllers for such insights, this is based on Art. 6(1)(f) GDPR and our interest in understanding how our content performs.

• Instagram is operated by Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland. Privacy policy: privacycenter.instagram.com/policy
• TikTok is operated for the European region by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, Ireland. Privacy policy: tiktok.com/legal/privacy-policy-eea

8. Our publishing software

We operate our own software that prepares and publishes posts to the social media accounts we own. This software connects only to accounts that belong to us and that we have authorised ourselves. It does not connect to accounts belonging to other people, it does not read your profile, your contacts, your messages or your viewing history, and it collects no personal data from viewers of our content. The access tokens it uses are stored on our own systems and are not passed to third parties.

9. Recipients of data

We do not sell personal data and we do not pass it on for advertising purposes. Data is disclosed only to processors acting on our instructions, currently our hosting and email provider named in section 5, and to public authorities where we are legally obliged to do so.

10. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15)
• have inaccurate data corrected (Art. 16)
• have your data erased (Art. 17)
• have processing restricted (Art. 18)
• receive your data in a portable format (Art. 20)
• object to processing based on legitimate interests (Art. 21)
• withdraw consent at any time with effect for the future, where processing is based on consent (Art. 7(3))

To exercise any of these rights, write to hi@nelldraper.com.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz, Germany.

11. Changes to this policy

We update this policy when our processing changes or when the law requires it. The date at the top shows the current version.