1. Who We Are
The website coloro.io is operated by Coloro. Coloro is the "data controller" (under EU/UK GDPR), the "business" (under CCPA/CPRA) and the "operador/responsable" of your personal data.
You can reach us via the Contact page. If you are in the EU or the UK and your enquiry concerns personal data, please mention "Data Protection" in the subject line so we can route it correctly.
2. What We Collect
We try to collect as little as possible. The categories below cover everything we may process:
Information you provide
- Account data — when you sign in with Google, we receive your email address, display name and profile-image URL.
- AI prompts and generations — the text you type into the AI generator and the images we produce in response. We keep a history so you can view past generations.
- Gallery uploads — colored artwork you upload, plus the caption and author name you choose to publish.
- Editor sessions — auto-saved canvas state for each coloring page, stored locally and (for signed-in users) on our servers so you can resume across devices.
- Communications — messages you send us via the Contact page or by email.
Information collected automatically
- Server logs — IP address, user agent, referrer and request path. We use these to operate the service and detect abuse. Logs are retained for 30 days.
- Cookies & local storage — strictly-necessary cookies for the session and CSRF protection, plus local-storage entries for your editor session and language preference. We do not use third-party advertising cookies.
- Analytics — if enabled, we may use a privacy-respecting analytics provider that does not set tracking cookies and that aggregates data on a per-page basis. Analytics is disabled in the EU/UK if you decline non-essential cookies.
What we do not collect
We do not collect special-category data (health, biometrics, race, political opinions, etc.), payment data (we have no paid plans yet), or precise geolocation. We do not buy or rent personal data from third parties.
3. Purposes & Legal Bases (GDPR)
We process your personal data for the following purposes:
- To provide the service — account, AI generations, editor sync, gallery hosting. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
- To keep the service safe — abuse detection, rate limiting, content moderation. Legal basis: legitimate interest (Art. 6(1)(f)) in protecting users and our infrastructure.
- To improve the service — aggregated analytics on usage. Legal basis: legitimate interest, or consent in jurisdictions that require it.
- To communicate with you — answering support requests, sending material updates to these policies. Legal basis: legitimate interest / contract.
- To comply with the law — responding to lawful requests from authorities, complying with takedown obligations. Legal basis: legal obligation (Art. 6(1)(c)).
Where we rely on legitimate interest we have carried out a balancing test; you have the right to object — see Section 7.
4. Sharing & Sub-processors
We share personal data only with the providers we need to operate the service. Each one is bound by a written data-processing agreement.
- Google (OAuth) — for sign-in. Receives your sign-in attempt; we receive the basic profile fields listed above.
- AI image generation provider — receives your prompt to generate the coloring page. Depending on our configuration, this is either our own image-generation server or OpenRouter and the underlying AI model providers. Before generation, your prompt is also sent through OpenRouter to an AI model provider for automated content-safety screening. Prompts are not used by us to train models; where a third-party model provider is used, please refer to its policy for its own retention.
- Hosting and CDN provider — runs the website and serves images. Located in the EU and the United States with Standard Contractual Clauses for transfers.
- Email provider — for support correspondence.
We do not sell or "share" personal data for cross-context behavioural advertising as those terms are defined in CCPA/CPRA. We have not done so in the past 12 months.
5. International Transfers
Some of our providers process data outside your country of residence. For transfers from the EEA, the UK or Switzerland to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (2021/914) supplemented by appropriate technical and organisational measures (encryption in transit and at rest, access logging, least privilege). For transfers from Canada we rely on PIPEDA's accountability principle and provider-side contractual safeguards. From Brazil we rely on the LGPD international-transfer rules and the consent / contractual-necessity bases as applicable.
6. Retention
- Account data — while your account is active. Deleted within 30 days of an account-deletion request.
- AI generations — kept while your account is active so you can revisit them. Deleted with the account.
- Gallery uploads — kept until you or we remove them.
- Server logs — 30 days, then deleted or anonymised.
- Backups — overwritten on a 35-day rolling basis.
- Support emails — up to 24 months for service-improvement purposes.
7. Your Rights
You have the rights set out below. To exercise them, contact us via the Contact page; we will respond within one month (EU/UK), 45 days (CCPA/CPRA, extendable once) or 15 days (LGPD), as required.
EU / UK GDPR
Access (Art. 15), rectification (Art. 16), erasure / "right to be forgotten" (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21), and the right not to be subject to solely automated decisions with legal effect (Art. 22). You may also lodge a complaint with your supervisory authority — the Information Commissioner's Office in the UK, the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit in Germany, or the Agencia Española de Protección de Datos in Spain.
California (CCPA / CPRA)
Right to know what categories of personal information we collect, sell or share; right to access specific pieces; right to deletion; right to correct; right to opt out of "sale" or "sharing" (we do not sell or share); right to limit the use of sensitive personal information (we do not collect any); and the right not to receive discriminatory treatment for exercising these rights. We honour Global Privacy Control signals.
Canada (PIPEDA / Quebec Law 25)
Right to access, correction, withdrawal of consent, and complaint to the Office of the Privacy Commissioner of Canada (or the CAI for Quebec residents).
Brazil (LGPD)
Confirmation of processing, access, correction, anonymisation/blocking/deletion, portability, information about third parties to whom data was shared, and the right to revoke consent. You may complain to the Autoridade Nacional de Proteção de Dados (ANPD).
8. Children
Coloro is suitable for family use, but the service is not directed at children under the age of digital consent in their country (16 in most of the EU; 13 in the US, UK, Spain and most of LATAM; 14 in Germany). We do not knowingly collect personal data from children under that age without verifiable parental consent (COPPA in the US; "verifiable consent" under EU/UK GDPR Art. 8). If you believe we have collected such data, please contact us and we will delete it.
9. Security
We use TLS for transport, encrypted storage at rest, hashed sessions, signed authentication tokens, and least-privilege access for staff. We monitor for suspicious activity and patch dependencies regularly. No system is perfectly secure; if we detect a breach affecting personal data we will notify supervisory authorities and (where required) affected users within 72 hours, in accordance with Art. 33–34 GDPR and equivalent laws.
11. Changes
If we change this policy in a material way we will post the new version here and update the "Last updated" date. Where required by law we will give advance notice and, for material changes affecting EU/UK users, request fresh consent if the legal basis was consent.
12. Contact
Questions, access requests, or complaints? Write to us via the Contact page and add "Data Protection" in the subject line. We aim to reply within five business days for routine requests and within the statutory deadline for formal rights requests.