Privacy Policy
Last updated: April 12, 2026
This Privacy Policy explains how Coloring Books Maker ("we", "us", "our") collects and uses your personal data when you use coloringbooksmaker.com (the "Service"). We are committed to protecting your privacy and complying with the EU General Data Protection Regulation (GDPR) and Portuguese data protection law.
Data controller: Coloring Books Maker, operated as a sole trader (trabalhador independente) registered in Portugal.
Contact: support@coloringbooksmaker.com
We have not appointed a Data Protection Officer as we are a small business and are not required to do so under Article 37 GDPR. For any data-related request, please contact us at the email above.
1. Data We Collect
| Category | Examples | Source |
|---|---|---|
| Account data | Email, name (if provided), password (hashed) | Provided by you at signup |
| Payment data | Billing name, country, last 4 digits of card, subscription status | Provided to Stripe — we do not store full card numbers |
| Usage data | Prompts submitted, images generated, credits used, account activity | Collected automatically |
| Technical data | IP address, browser type, device, language, referrer | Collected automatically |
| Cookies & analytics | See section 6 and our Cookie Policy | Collected automatically, with consent where required |
| Support data | Emails you send us | Provided by you |
2. Why We Process Your Data (Legal Bases)
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Provide the Service, manage your account, generate images | Performance of a contract (Art. 6(1)(b)) |
| Process payments, issue invoices, comply with tax law | Contract and legal obligation (Art. 6(1)(b), (c)) |
| Security, fraud prevention, abuse detection | Legitimate interests (Art. 6(1)(f)) |
| Analytics (Google Analytics, Yandex Metrica) | Consent (Art. 6(1)(a)) |
| Service announcements and transactional emails | Legitimate interests / contract |
| Marketing emails (if any) | Consent (Art. 6(1)(a)) |
3. Third-Party Processors
We share data only with service providers necessary to operate the Service. Each provider processes data under a data processing agreement (DPA).
3.1 Stripe (payments)
Handles all payment processing. Stripe is PCI DSS certified; we never see or store your full card number. Stripe may transfer data outside the EU under Standard Contractual Clauses. Privacy: stripe.com/privacy.
3.2 Supabase (hosting & database)
Stores account data, prompts, generated image metadata, and application data. We use EU-based servers. Privacy: supabase.com/privacy.
3.3 Google Gemini API (AI image generation)
When you generate an image, your prompt is sent to Google's Gemini API to produce the output. Per Google's API terms for paid services, prompts and outputs are not used to train Google's models and are not retained for training purposes. Privacy: policies.google.com/privacy.
3.4 Google Analytics 4 (analytics)
Collects anonymized usage statistics — pages viewed, session duration, approximate location (country/city level), device and browser. IP addresses are anonymized. Only loaded after you consent. Privacy: policies.google.com/privacy.
3.5 Yandex Metrica (analytics)
Collects similar usage statistics to understand how users interact with the Service. May include heatmaps and session data in aggregated form. Only loaded after you consent. Yandex may transfer data outside the EU. Privacy: yandex.com/legal/confidential.
4. International Transfers
Where data is transferred outside the European Economic Area (e.g., to Stripe, Google, or Yandex), we rely on Standard Contractual Clauses approved by the European Commission, and/or other safeguards permitted under Chapter V of the GDPR.
5. Data Retention
- Account data: while your account is active.
- After deletion: most personal data is deleted within 30 days of account deletion.
- Billing records: retained for up to 10 years to comply with Portuguese tax and accounting law.
- Support emails: up to 2 years.
- Backups: may persist up to 30 days before being overwritten.
6. Cookies
We use essential, analytics, and functional cookies. Analytics cookies are loaded only after you give consent via our cookie banner. You can withdraw consent at any time through the "Cookie Settings" link in the footer.
Cookies We Use
| Cookie | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
| sb-*-auth-token | Supabase | Authentication — keeps you logged in | Session | Essential |
| __stripe_mid | Stripe | Payment fraud prevention | 1 year | Essential |
| __stripe_sid | Stripe | Payment fraud prevention | 30 minutes | Essential |
| cookie_consent | Coloring Books Maker | Stores your cookie consent choice | 12 months | Essential |
| _ga | Google Analytics | Distinguishes unique users | 2 years | Analytics |
| _ga_* | Google Analytics | Maintains session state (GA4) | 2 years | Analytics |
| _ym_uid | Yandex Metrica | Identifies unique visitors | 1 year | Analytics |
| _ym_d | Yandex Metrica | Stores first-visit date | 1 year | Analytics |
| _ym_isad | Yandex Metrica | Determines ad-blocker presence | 1 day | Analytics |
| theme | Coloring Books Maker | Remembers light/dark theme preference | 1 year | Functional |
7. Your GDPR Rights
As a data subject, you have the right to:
- Access — get a copy of the personal data we hold about you.
- Rectification — correct inaccurate data.
- Erasure ("right to be forgotten") — request deletion of your data.
- Restriction — limit how we process your data.
- Portability — receive your data in a machine-readable format.
- Object — object to processing based on legitimate interests or for marketing.
- Withdraw consent — at any time, without affecting the lawfulness of prior processing.
- Lodge a complaint with a supervisory authority. In Portugal this is the CNPD (Comissão Nacional de Proteção de Dados — cnpd.pt).
To exercise these rights, email support@coloringbooksmaker.com. We respond within one month.
8. Security
We use industry-standard measures: TLS/HTTPS encryption, hashed passwords, role-based access, EU-hosted infrastructure, server-side validation of sensitive operations, and secure webhook-based billing. No system is 100% secure; we encourage you to use a strong, unique password.
9. Children
The Service is not intended for children under 13, and we do not knowingly collect data from them. If you believe a child has provided us data, contact us and we will delete it.
10. Changes to This Policy
We may update this Policy. Material changes will be announced by email or in-app notice at least 30 days in advance. The "Last updated" date at the top always reflects the latest version.
11. Contact
support@coloringbooksmaker.com