Color the Picture - Boyama Ekranı

Last updated: July 4, 2026
Effective date: July 4, 2026

This Explicit Consent Notice explains the scope, legal basis, and consequences of the explicit consent you give when creating a parent/legal guardian account on Color the Picture (“Platform,” “App,” “we”) and when using the Platform.

This notice has been prepared in accordance with the EU General Data Protection Regulation (“GDPR”), Article 6(1)(a) and Article 7. Where processing relates to children’s data, the principles of the U.S. COPPA (Children’s Online Privacy Protection Act) are also taken into account. If you are located in Türkiye, your personal data is additionally protected under Law No. 6698 on the Protection of Personal Data (“KVKK”), and you enjoy the same rights described in this notice under that law as well.

This notice is written for parents; we’ve done our best to keep the technical and legal content as plain and clear as possible. For more detail, see our Privacy Policy.

Note: This document includes a separate, optional (opt-in) consent clause for email newsletters/marketing communications (see Section 8). This separate consent is not a condition of using the Platform and is off by default.

1. Who Is the Data Controller?

The data controller responsible for processing your personal data is:

Legal name: Color the Picture
Address: ———
MERSİS No.: ———
Trade Registry No.: ———
Registered e-mail (KEP) address: ———
Data protection requests: kvkk@colorthepicture.com
General contact: iletisim@colorthepicture.com

The business is headquartered in Türkiye. This notice will be updated with the company’s finalized legal name, address, and registry details once available, and the bracketed fields above will be completed accordingly.

2. What Does This Consent Cover? (Personal Data Processed)

By accepting this notice, you give your explicit consent to the processing of the personal data listed below, for the purposes described in Section 3.

2.1. About the Parent/Guardian Account Holder (You)

Email address — account creation, login, and communication
First and last name — may be collected automatically via Sign in with Google; otherwise optional
Password — stored only as an irreversible bcrypt hash; never stored in plain text
IP address — session and account security
Device, browser, and operating system information — compatibility and security
Subscription and payment status — Premium/Family/Teacher plans; payments are processed by Lemon Squeezy (see Section 4)
In-app activity — login dates, features used, credit balance activity

2.2. About Child Profiles (profiles under your account)

Important: Child profiles are created under your parent/guardian account, at your direction, and with your explicit consent. No data is collected directly or independently from the child. The account’s sole authorized user is a parent/guardian who is at least 18 years old.

Nickname — using the child’s real name is not recommended
Avatar — an emoji or small image
Colored artwork and drafts
Game scores, levels, and badges (gamification)
AI coloring-page generation preferences and results

2.3. Photos Uploaded for AI Processing (temporary processing only)

If you upload a photo to generate an AI coloring page, that image is processed only temporarily (in base64 format, for the duration of the generation process) and is not stored permanently. Once generation is complete, the raw photo is not retained on our servers. Uploaded content may pass through automated moderation (e.g., safe-search/inappropriate-content screening) for child-safety purposes.

Warning: Please do not upload images containing sensitive data such as identity documents or health information, or recognizable photos of third parties. You are responsible for the lawfulness of any content you upload (see Section 12).

3. For What Purposes Is This Data Processed?

Providing the service: account creation, login, and profile management; credit-based AI coloring-page generation; the ready-made coloring library and canvas; saving artwork/drafts; gamification; the admin-moderated, child-friendly gallery (sharing only with your approval).
Subscription and payment management: Premium/Family/Teacher plans, the 7-day free trial, and credit balance tracking.
Security: detecting suspicious activity, rate limiting, protection against brute-force attacks, and audit logging.
Child safety and content moderation: automated and/or manual moderation of uploaded images and gallery submissions.
Compliance with legal obligations: security and audit records (including, for Türkiye-based users, those required under KVKK Article 12); payment records required under tax/financial regulations.
Service improvement: aggregated and anonymized usage statistics and AI generation quality analysis (in a form that does not identify any individual).

4. Sharing with Third Parties and International Data Transfers

To provide the service, some data is shared with the service providers listed below. These providers act as data processors and operate only for the specified purposes, under contractual confidentiality and security obligations.

Provider	Purpose	Location
Google Cloud (Gemini)	AI image generation and content moderation (photos are processed temporarily and not stored)	EU/US
Google OAuth	Account verification via “Sign in with Google”	EU/US
Google Analytics 4	Anonymous traffic/analytics (only subject to your cookie consent)	EU/US
Lemon Squeezy	Payment and subscription management (Merchant of Record)	US
Hetzner	Server/hosting infrastructure	Germany/EU

Any providers added in the future (e.g., Sign in with Apple, or Resend/SendGrid for email delivery) will be added to this notice through an update.

International transfer safeguards: Some of your data may be processed outside your country of residence, including in the EU and/or the US. Such transfers are carried out on the basis of your explicit consent and/or appropriate safeguards such as the European Commission’s Standard Contractual Clauses (SCCs), in accordance with GDPR Chapter V (and, for users in Türkiye, KVKK Article 9). Our primary hosting infrastructure (Hetzner) is located within the EU (Germany).

5. Legal Basis for Explicit Consent and Other Grounds for Processing

Processing activities on the Platform do not rely on a single legal basis. The most appropriate basis is applied to each activity:

Explicit consent (GDPR Art. 6(1)(a)): in particular, processing of child profile data, image processing for AI generation, cookie-consent-based analytics, and (separately) marketing communications.
Performance of a contract (GDPR Art. 6(1)(b)): providing the account, subscription, and coloring service.
Legitimate interests (GDPR Art. 6(1)(f)): Platform and user security, fraud and abuse prevention, and service improvement.
Legal obligation (GDPR Art. 6(1)©): tax/financial records and, for Türkiye-based users, audit records required under KVKK Article 12.

For processing based on explicit consent, your consent has the following characteristics:

Specific: the data processed and the purpose of each processing activity are individually described in Sections 2 and 3.
Informed: this notice describes our processing activities transparently.
Freely given: you may decline or withdraw consent at any time (see Section 9).
Explicit and affirmative: given through an active, unticked checkbox at sign-up — it is never pre-checked by default.

6. Consent Is Voluntary (but Some Processing Is Foundational to the Service)

Giving this consent is your choice. That said, please note the following:

If you do not consent to the processing of the core data required to create an account and provide the coloring service (Sections 2.1–2.2), an account cannot be created — this processing is foundational to the service.
If you do not want to use a particular feature (e.g., AI generation), you are free not to use it; this does not prevent you from using the rest of the service.
Consent for marketing communications (Section 8) and for cookie-consent-based analytics is not a condition of using the service; you can use the Platform without giving either.

7. Age and Parent/Guardian Commitment (COPPA + GDPR Article 8)

By creating an account, you represent and warrant that:

you are a parent or legal guardian who is at least 18 years old;
you hold parental responsibility/legal guardianship over the child associated with any child profile created under your account (approximately ages 3–13) and are authorized to consent to the processing of that child’s data on their behalf;
your consent to the processing of the child’s data constitutes verifiable parental consent for purposes of COPPA.

Even after a child turns 13, control of the account does not automatically transfer to the child; control remains with you as the parent/guardian. To protect your child’s privacy, we strongly recommend using a nickname and avoiding entering the child’s real name, address, school, or other identifying information.

8. Email Newsletter and Marketing Communications — Separate, Optional Opt-In Consent

This consent is entirely separate, optional, and OFF by default. Unless you check this box, we will not send you marketing emails.

Under GDPR Article 6(1)(a) and Article 7 (and, for users in Türkiye, KVKK Article 5/1), only if you separately and expressly opt in, you give your explicit consent for Color the Picture to send you commercial email communications about:

new features, content updates, and announcements;
promotions, discounts, and offers.

We want to be explicit about this consent:

It is not a condition of using the Platform; you can use all services without giving it.
You can withdraw it at any time, free of charge, and easily: by clicking the “unsubscribe” link in any email, via /profile → Settings, or by emailing iletisim@colorthepicture.com.
Withdrawing this consent does not affect the lawfulness of processing carried out before withdrawal; it only has effect going forward.
Withdrawing this consent does not affect your account or any other services you use.

9. Your Right to Withdraw Explicit Consent at Any Time (GDPR Art. 7(3))

You may withdraw your explicit consent at any time. Withdrawal does not affect the lawfulness of processing carried out up to that point; it only has effect going forward.

9.1. How Do I Withdraw My Consent?

Go to the /profile page.
Click the “Settings” tab.
Select “Withdraw My Consent.”
Confirm by entering your password for identity verification.

Alternatively, you may submit your request by emailing kvkk@colorthepicture.com.

9.2. Consequences of Withdrawing Core Account Consent

When you withdraw consent for the processing that is foundational to the service (Sections 2.1–2.2):

Your account and all associated data are permanently deleted (parent data + all child profiles + artwork + drafts + badges + credit balance).
Any active subscription is cancelled (via Lemon Squeezy).
The deletion is recorded in an audit log as consent_revoked (for Türkiye-based users, pursuant to KVKK Article 12) (see Section 10).
This action cannot be undone — deleted data cannot be recovered.
You may open a new account with the same email address, but your prior data will not be restored.

9.3. Before You Withdraw — Recommendations

Download your data (JSON): back up your artwork and data via /profile → Settings → “Download My Data.” This backup remains yours even after your account is deleted.
Check your subscription: if you have an active subscription, it will be automatically cancelled at the end of the process.

9.4. A More Limited Alternative: Deleting Just One Child Profile

If you don’t want to delete your entire account, you can delete a single child profile instead: /profile → Settings → “Child Profiles” → “Delete” on the relevant profile. This only deletes that child’s artwork, drafts, and badges; your account and other profiles remain intact.

10. Retention Periods and Limited Data Kept After Withdrawal

Account data: processed for as long as your account remains active.
Deletion/audit records: retained for 5 years to comply with legal obligations.
System/security logs: deleted after 90 days.

After your account is deleted, the audit record retains only the following limited information (for Türkiye-based users, pursuant to KVKK Article 12, and applicable statutory retention rules generally):

A point-in-time copy of your email address (to track who deleted the account and when; the link to the account identifier is removed)
The date and timestamp of deletion
The reason for deletion (consent_revoked)
The IP address and browser information at the time of the request
The number of affected records (how many artworks, how many profiles were deleted)

This audit record is automatically deleted after 5 years. No other data (artwork, drafts, badges, profile information, credit balance, payment information) is retained — all of it is deleted immediately and permanently.

11. Your Rights as a Data Subject

Under GDPR Chapter III (and, for users in Türkiye, KVKK Article 11), you have the following rights:

Information and access: to learn what data is processed about you and obtain a copy of it (JSON).
Rectification: to request correction of incomplete or inaccurate data.
Erasure (“right to be forgotten”): to request deletion of your data.
Objection and withdrawal of consent: to object to processing and to withdraw your explicit consent (Sections 8–9).
Rights related to automated decisions: to object to outcomes based solely on automated processing.

Most of these rights can be exercised on a self-service basis via /profile. You may also submit a request by emailing kvkk@colorthepicture.com. Requests are answered within the applicable statutory time limits. For more detail, see our Privacy Policy.

12. User Representations and Indemnification

With respect to any content you upload or create, you represent and warrant that:

you own the rights to the images and content you upload, or have obtained all necessary permissions to use them;
your content does not infringe any third party’s intellectual property, privacy, or personality rights;
you will not upload content that is unlawful, harmful, or unsafe for children.

You agree to indemnify Color the Picture for any damages, claims, and expenses arising from a breach of these representations, to the extent permitted by applicable law.

13. “As Is” Service and Limitation of Liability

“As is / as available”: the Platform is provided on an “as is” and “as available” basis. To the maximum extent permitted by applicable law, no warranties, express or implied, are given; we do not guarantee the accuracy, suitability, or fitness for a particular purpose of AI-generated output, nor the uninterrupted availability of the service.
Indirect damages: to the maximum extent permitted by applicable law, we are not liable for indirect, incidental, special, or consequential damages.
Liability cap: to the maximum extent permitted by applicable law, our total liability is limited to the amount you paid us in the 12 months preceding the event giving rise to the claim.

Mandatory rights are unaffected: the limitations above do not eliminate any non-waivable statutory rights you have under applicable consumer-protection or data-protection law in your country of residence. Liabilities that cannot be limited by law (e.g., for intent, gross negligence, or death or personal injury) remain unaffected.

14. Changes, Suspension, and Termination

We reserve the right to update, improve, or modify the service and this notice for reasonable cause. For material changes, we will notify you through an appropriate channel (e.g., email or an in-app notice).
We may temporarily suspend the service for security, legal-compliance, or maintenance reasons, and may terminate an account in the event of abuse or breach of these terms.
You may also close your account and withdraw your consent at any time (Section 9).

15. Force Majeure

We are not liable for any delay or failure to perform resulting from events beyond our reasonable control — such as natural disasters, fire, epidemic, war, cyberattacks, infrastructure or communications outages, or governmental action — for as long as such events continue.

16. Governing Law, Jurisdiction, and Mandatory Consumer Rights

This notice is governed by the laws of the Republic of Türkiye. Disputes fall within the jurisdiction of the Turkish Consumer Arbitration Committees (within applicable monetary limits) and the courts and enforcement offices of Istanbul, Türkiye.
Mandatory rights are unaffected: for users who are consumers habitually resident in the EU/EEA or another country, any non-waivable mandatory rights available under the consumer-protection and data-protection laws of your country of residence, and your right to bring proceedings before the courts of that country, remain unaffected. Nothing in this notice shall be construed to limit or eliminate such mandatory rights.

17. Severability and Entire Agreement

Severability: if any provision of this notice is held invalid or unenforceable, the remaining provisions remain in full force and effect. The invalid provision is deemed replaced by a valid provision that most closely reflects its intent.
Entire agreement: this notice, together with our Privacy Policy, Terms of Use, and Cookie Policy, forms a single, integrated agreement.

18. Security

We take industry-standard measures to protect your data: bcrypt hashing of passwords, HTTPS/TLS encryption across all traffic, audit logging, and role-based access controls. No system can guarantee absolute security, but we work continuously to reduce risk to a reasonable minimum.

19. Contact

For questions, requests, or complaints:

General contact: iletisim@colorthepicture.com
Data protection requests: kvkk@colorthepicture.com
Support: destek@colorthepicture.com
Content/moderation: moderasyon@colorthepicture.com
Legal notices: hukuk@colorthepicture.com

Consent Statement

I have read, understood, and agree to this Explicit Consent Notice. I give my explicit consent to the processing of my personal data described above, and the data of any child profile(s) under my account, for the stated purposes, with the stated third parties (including international transfers), and for the stated retention periods.

I confirm that I am at least 18 years old, that I am authorized to consent on behalf of the child, and that I may withdraw this consent at any time via /profile → Settings or by emailing kvkk@colorthepicture.com, and that I understand the consequences of doing so (Section 9).

☐ (Separate and optional — off by default): I also give my explicit consent to marketing communications, to be notified by email about new features and promotions from Color the Picture. I understand this consent is not a condition of the service and that I may withdraw it free of charge at any time (Section 8).