Privacy & Cookie Policy

Last updated: 23 June 2026

This Privacy & Cookie Policy (“Policy”) explains how PaintingTube (“we”, “us”, “our”) collects, uses, shares and protects personal data when you visit and use the website https://painting.tube (the “Website”). It also explains your rights under the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), the ePrivacy Directive 2002/58/EC as implemented in Italy (Italian Personal Data Protection Code, Legislative Decree 196/2003 as amended by Legislative Decree 101/2018, and the Garante’s “Guidelines on cookies and other tracking tools” of 10 June 2021), and applicable UK and US privacy laws.

PaintingTube is a human-curated aggregator of art, painting and drawing videos. The videos themselves are embedded from YouTube according to YouTube’s terms. Please read this Policy carefully. By using the Website you acknowledge that you have read and understood it. Where we rely on your consent (for example, for non-essential cookies), we only process the relevant data after you have given that consent through our cookie banner.

1. Who is responsible for your data (Data Controller)

The data controller responsible for your personal data is:

PaintingTube — Giovanni Lucifero Strada Baganzola 84, Parma, Italy Email: [email protected]

The controller is established in Italy. As a result, the GDPR and Italian data-protection law apply to this processing, regardless of where the servers are physically located (see Section 9).

We have not appointed a Data Protection Officer (DPO), because our processing does not meet the thresholds of Art. 37 GDPR. You can contact us about any privacy matter using the details above.

2. What personal data we collect, why, and on what legal basis

Access to PaintingTube does not require registration or a user account, and you can browse the video collection without submitting personal data. We do, however, process some personal data as set out below. Under Art. 13 GDPR we must tell you, for each purpose, what we collect, why, the legal basis, and how long we keep it.

We collect personal data directly from you (newsletter, contact form, comments) and automatically (server logs and cookies) when you browse. We do process personal data such as your IP address and online identifiers — please note that, unlike earlier versions of this Policy, we do not claim to collect “no personal information”, because cookies, analytics and advertising necessarily involve some personal data.

Interest-based advertising (Section 7) involves profiling for ad selection, but only with your consent and without legal or similarly significant effects on you. We do not otherwise carry out automated decision-making that produces such effects.

3. Embedded YouTube videos and YouTube API Services

PaintingTube embeds videos from YouTube and uses YouTube API Services to display and organise them. When a page with an embedded video loads, or when you interact with a video, Google/YouTube may set cookies and receive data (such as your IP address and device information), as if you had visited YouTube directly.

By using PaintingTube you also agree to the YouTube Terms of Service (https://www.youtube.com/t/terms). Your use of data by Google is governed by the Google Privacy Policy (https://policies.google.com/privacy). You can manage or revoke Google’s access via Google’s security settings: https://myaccount.google.com/permissions.

Where required, YouTube/Google cookies set through embedded videos are treated as non-essential and are subject to your consent via our cookie banner (we use a privacy-enhanced / consent-aware embedding where available).

4. Children and adult-oriented reference content

The Website is intended for a general adult audience of artists and art enthusiasts and is not directed to users under 18. Some categories (for example figure drawing and life-model reference material) contain artistic depictions of the nude human figure intended as drawing reference. If you are under 18, please do not use those sections, subscribe to the newsletter, or submit personal data.

Where we rely on consent for an information-society service, the minimum age under Italian law (Art. 8 GDPR) is 16; combined with the adult-oriented nature of some content, the Website is not intended for minors. If you believe a child has provided us with personal data, contact us and we will delete it.

5. Who we share your data with (recipients)

We do not sell your personal data. We share it only with the categories of recipients needed to run the Website:

• Hosting provider — InterServer, Inc. (servers located in the United States) hosts and serves the Website (see Section 9).
• Newsletter provider — MailerLite processes your email address to deliver our newsletter on our behalf. See MailerLite’s privacy policy: https://www.mailerlite.com/legal/privacy-policy
• YouTube / Google — embedded video delivery and YouTube API Services (Section 3).
• Google Analytics & Google Tag Manager — traffic measurement and tag management (Section 6), only after you consent.
• Advertising partners — Ezoic, Google AdSense/Ad Manager and their downstream partners (Section 7).
• Email delivery — Google (Gmail / Google Workspace API) sends the Website’s outgoing email (such as contact-form notifications) on our behalf via the WP Mail SMTP plugin. A copy of these messages is delivered to and stored in our administrator email inbox. Google is based in the USA (see Section 9).
• Affiliate networks — when you click an affiliate link, the merchant/affiliate network may set its own cookies (see our separate Affiliate Disclosure and Section 8).
• Spam-detection service — comments may be checked automatically for spam.
• Authorities or legal advisers — only where legally required, or to establish, exercise or defend legal claims.

These third parties act either as our processors (on our instructions) or as independent controllers for their own purposes (notably advertising partners, YouTube/Google and affiliate networks). Please review their own privacy policies for details.

6. Cookies and similar technologies

6.1 What cookies are

Cookies are small text files placed on your device when you visit a website. We also use “similar technologies” such as pixels, local storage and device identifiers — under EU law these are treated the same way as cookies. We use both session and persistent cookies, and both first-party and third-party cookies.

6.2 Consent — how we handle it

In line with the ePrivacy Directive (Art. 5(3)) and the Italian Garante’s guidelines, non-essential cookies (analytics, advertising, functional/preference, social media and embedded-video cookies) are blocked until you give consent through our Consent Management Platform (CMP). When you first arrive you will see a banner that lets you Accept all, Reject all, or manage your choices by category, with reject being as easy as accept.

You can change or withdraw your consent at any time, as easily as you gave it, by reopening the cookie settings from the link/icon provided on the Website. Withdrawing consent does not affect processing carried out before withdrawal.

We use the Ezoic Consent Management App as our CMP.

6.3 Categories of cookies we use

• Strictly necessary / essential cookies — required for the site to work (security, load balancing, remembering your cookie choices). No consent required.
• Functionality / preference cookies — remember choices such as language so you do not have to re-enter them. Consent required.
• Analytics & performance cookies — Google Analytics and Google Tag Manager, to understand aggregate traffic and improve the site. More info: https://policies.google.com/privacy and opt-out: https://tools.google.com/dlpage/gaoptout. Consent required.
• Advertising / targeting cookies — set by Ezoic, Google and partners (Section 7) to show and measure ads, including interest-based ads. Consent required.
• Embedded video cookies — set by YouTube/Google when video content loads or is played (Section 3). Consent required.
• Social media cookies — set when you use share/”like” buttons or interact with embedded social content (e.g. Facebook). Consent required.

A live, itemised list of the specific cookies, their providers, purpose and duration is available in the cookie settings panel of our CMP, kept up to date automatically.

6.4 Managing cookies in your browser

You can also block or delete cookies through your browser settings. If you block essential cookies, parts of the Website may not work properly.

7. Advertising (Ezoic, Google and partners)

This Website is ad-supported. We work with third-party advertising partners — currently Ezoic and Google (AdSense / Ad Manager), together with their downstream demand partners — to display advertising. These partners may use cookies and similar technologies to collect data such as your IP address, device/browser data and browsing activity, in order to serve and measure advertising, including personalised (interest-based) advertising.

For visitors in the EEA, UK and Switzerland, personalised advertising and the associated tracking only occur after you consent via our cookie banner. We use Google Consent Mode (v2) so Google and its partners adjust their behaviour to your consent choices. If you reject advertising cookies, you may still see ads, but they will be contextual rather than based on your browsing profile.

Ezoic-specific disclosures. Ezoic and its advertising partners process data as described on Ezoic’s privacy and ad-partner pages. Where required, identity partners such as ID5 and LiveRamp may assign or process a pseudonymous (hashed) identifier; you have the right to opt out of such sharing.

• Ezoic Privacy Policy: https://www.ezoic.com/privacy-policy/
• Ezoic Advertising Partners: https://www.ezoic.com/ad-partners/
• Google advertising / how Google uses data: https://policies.google.com/technologies/partner-sites

8. Affiliate links

PaintingTube participates in various affiliate programs. Some links on the Website are affiliate links: at no extra cost to you, we may earn a commission if you click them and make a qualifying purchase. When you click an affiliate link, the merchant or affiliate network may set its own cookies and process your data under its own privacy policy. For details of which programs we use and how disclosure works, see our separate Affiliate Disclosure page.

9. International data transfers (server located in the USA)

The server that hosts this Website is located in the United States and is provided by InterServer, Inc. (PO BOX 1707, Englewood Cliffs, NJ 07632, USA). When you use the Website, your personal data (for example the IP address in our server logs, or any data you submit) is therefore transferred to and stored in the United States, outside the European Economic Area (“EEA”). Several of our providers and partners (Google/YouTube, Ezoic, MailerLite where applicable) are also based outside the EEA.

Under Chapter V of the GDPR, such transfers are only lawful if an appropriate safeguard is in place. For the transfer of data to our hosting provider, that safeguard is an adequacy decision (Art. 45 GDPR):

InterServer, Inc. is an active participant in the EU–U.S. Data Privacy Framework and the UK Extension to the EU–U.S. DPF, self-certified with the U.S. Department of Commerce (original certification 13 January 2026; data category: non-HR data). This transfer is therefore covered by the European Commission adequacy decision of 10 July 2023 (Art. 45 GDPR), whose validity was confirmed by the General Court of the European Union on 3 September 2025. You can verify the certification at https://www.dataprivacyframework.gov/list (search “InterServer”). As a result, your data receives a level of protection essentially equivalent to that within the EU, and no supplementary measures are required.

InterServer’s privacy policy and DPF commitments are at https://www.interserver.net/privacy-policy.html (recourse: JAMS, https://www.jamsadr.com/DPF-Dispute-Resolution; statutory body: U.S. Federal Trade Commission). Our other US-based providers and advertising partners (Google, Ezoic, and others) likewise self-certify under the Data Privacy Framework or rely on the Standard Contractual Clauses for the transfers they carry out; details are in their respective privacy policies.

You have the right to ask us, at any time, which transfer mechanism applies and to obtain information about the safeguards in place, by writing to the contact in Section 1.

10. How we keep your data secure

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, misuse or alteration, including HTTPS encryption in transit. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

11. Your rights under the GDPR

If you are in the EEA or UK, you have the right to: access; rectification; erasure (“right to be forgotten”); restriction; portability; objection to processing based on legitimate interests and at any time to direct marketing; withdrawal of consent at any time (without affecting prior processing); and to lodge a complaint with a supervisory authority (Section 12). We do not carry out solely automated decisions with legal or similarly significant effects.

To exercise any of these rights, contact us using the details in Section 1. We will respond within the time limits required by law (normally one month).

US visitors (e.g. California): depending on your state, you may have rights to know, delete, correct, and opt out of the “sale”/”sharing” of personal information or targeted advertising. You can exercise advertising opt-outs through our cookie banner, recognised opt-out signals (e.g. Global Privacy Control) where supported, and the industry tools in Section 7.

12. How to complain

If you believe we have not handled your personal data lawfully, you can lodge a complaint with your local data protection authority. In Italy this is the:

Garante per la protezione dei dati personali Piazza Venezia 11, 00187 Roma, Italy Web: https://www.garante.it — Email: [email protected]

You also have the right to complain to the supervisory authority in your own EU/EEA country of residence.

13. Links to other websites

The Website contains links to third-party sites and resources (including video sources and affiliate links). This Policy does not cover those third parties. Please read their privacy policies before submitting data to them. See also our DMCA Policy and Disclaimer pages.

14. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices, providers or the law. The “Last updated” date at the top shows the latest revision. Where a change materially affects how we use your data, we will take reasonable steps to inform you. Please review this page periodically.

15. Contact

For any question about this Policy or your personal data, contact us at:

[email protected] — or via our contact page: https://painting.tube/contact-us/