Color the Picture - Boyama Ekranı

Last updated: July 4, 2026
Effective date: July 4, 2026

Color the Picture (“Color the Picture”, “the platform”, “the service”, “we”, “us”, “our”) is an AI-powered online coloring application for children (colorthepicture.com). Earning and keeping families’ trust — and protecting children’s privacy — is one of our most fundamental priorities.

This Privacy Policy (“Policy”) explains, in line with applicable data-protection law — including, where applicable, the EU General Data Protection Regulation (“GDPR”), the U.S. Children’s Online Privacy Protection Act (“COPPA”), and, for users located in Türkiye, the Turkish Data Protection Law No. 6698 (“KVKK”) — what personal data we process, for what purposes, on what legal grounds, who we share it with, and how you can exercise your rights.

This Policy is written for parents and legal guardians. We’ve written it in plain, clear language — our goal isn’t to overwhelm you with legal jargon, but to show transparently what data processing sits behind your child’s experience.

1. Data Controller and Contact Information

Your personal data is processed, in the capacity of data controller, by the following business:

Legal name: Color the Picture
Address: ———
MERSİS No.: ———
Trade Registry No.: ———
Registered e-mail (KEP) address: ———
Website: colorthepicture.com

Our contact channels:

General inquiries: iletisim@colorthepicture.com
Data protection / privacy requests: kvkk@colorthepicture.com
Technical support: destek@colorthepicture.com
Content moderation / safety reports: moderasyon@colorthepicture.com
Legal notices: hukuk@colorthepicture.com

Note: Once the company’s official legal name, address, and registration details are finalized, the bracketed fields above will be updated. The current version of this Policy is always available on this page on the platform.

2. User Model: Parent Account and Child Profile

Color the Picture is not a platform where children open accounts directly.

Accounts may only be created by parents or legal guardians (age 18 or older).
Children (roughly ages 3–13) use the service through a “child profile” created under a parent account.
We do not collect personal data directly from the child. Any information tied to a child profile (such as a nickname) is set and managed by the parent.

This model is designed to align with COPPA’s “verifiable parental consent” approach and the protections GDPR affords to children — and, for users located in Türkiye, with the heightened sensitivity that children’s data receives under KVKK.

3. Categories of Personal Data We Process

3.1. Parent Account Data

E-mail address (for registration, login, and communication)
First / last name (optional; may be supplied by Google when signing in with Google)
Password — never stored in plain text; only stored as a bcrypt hash
Account creation date and last login time
IP address (for session security and audit logging)
Device / browser information (type, operating system, language preference)
Subscription and payment status (plan, trial status, and the customer/subscription ID held by our payment provider)

3.2. Child Profile Data

Important: Child profile data is created and managed by the parent. We do not ask for or collect the child’s real name, e-mail address, or phone number.

Nickname — a real name is not required
Avatar (an emoji or small profile image)
Colored artwork
Unfinished drafts
Game scores (Color Points) and level
Earned badges

3.3. Images Uploaded for AI Processing (Temporary Processing Only)

Images you upload for the photo-to-coloring-page feature are processed only on a temporary basis:

The image is not stored as a persistent file on our servers; it is processed as base64 data for the duration of the generation request only.
Once AI generation is complete, no copy of the original uploaded image is retained.
See Section 8 (Artificial Intelligence and Image Processing) for details.

3.4. Automatically Collected System Data

IP address (for security purposes and audit-logging obligations)
Browser, operating system, language preference
Page-view and session data (Google Analytics 4 — collected only where cookie consent has been given, and in anonymized form)
AI generation and usage statistics (e.g., which feature was used and when)

4. Purposes of Processing

We process your personal data for the following purposes:

Providing the service: account creation and login, management of child profiles, the coloring canvas, the ready-made coloring library, AI coloring-page generation, and gamification features.
Gallery and moderation: enabling shared artwork to be published in the child-friendly gallery, kept safe through administrator moderation.
Subscription and payment management: tracking plan status (Premium / Family / Teacher), managing credit balances, and administering the free trial.
AI generation: the technical integrations required for credit-based AI coloring-page generation (see Sections 6 and 8).
Security and abuse prevention: detecting suspicious activity, rate limiting, and protecting against brute-force attacks.
Complying with legal obligations: maintaining audit logs, recording deletion/download requests, and meeting tax and other regulatory requirements.
Improving the service: aggregate, anonymized analysis, troubleshooting, and performance improvement.

We do not use your data for any purpose beyond those listed above, and we do not sell it.

5. Legal Bases for Processing

We process your personal data on the basis of at least one of the following legal grounds (GDPR Art. 6; for users located in Türkiye, also KVKK Arts. 5–6):

Consent: processing carried out under the explicit consent you give for cookie-based analytics and during registration.
Performance of a contract: opening your account, delivering the service, and administering subscriptions and payments.
Legal obligation: maintaining audit records and meeting retention requirements arising from tax and other applicable law.
Legitimate interests: security, fraud and abuse prevention, and safeguarding the technical integrity of the service (balanced against your fundamental rights and freedoms).

Where processing is based on consent, you may withdraw that consent at any time (see Section 9).

6. Sharing with Third Parties and International Transfers

To provide the service, your personal data may be shared with the following service providers, to the extent relevant and limited to the stated purpose. Because some providers’ servers are located outside your country of residence, these transfers are subject to applicable cross-border data transfer rules (including, for users located in Türkiye, KVKK’s international transfer provisions).

Service Provider	Purpose	Location	Data Transferred
Google Cloud (Gemini)	AI image generation	US / EU	Temporarily processed uploaded image (base64) and text prompts
Google OAuth	Authentication via “Sign in with Google”	US / EU	E-mail, name, profile information
Google Analytics 4	Anonymous site analytics (subject to cookie consent)	US / EU	Anonymized visit/interaction data
Lemon Squeezy	Payments and subscriptions (Merchant of Record)	US	E-mail, payment/billing information, subscription ID
Hetzner	Server / hosting infrastructure	Germany (EU)	Application data

Providers that may be added in the future (this table will be updated when they go live): Apple Sign In (authentication), Resend / SendGrid (transactional e-mail).

For international transfers, we rely on appropriate safeguards such as your explicit consent or other lawful transfer mechanisms recognized under KVKK, and, where GDPR applies, Standard Contractual Clauses (SCCs) and data processing agreements (DPAs). Payments are handled by Lemon Squeezy as Merchant of Record; we never see or store your card details.

7. Data Retention Periods

We retain your personal data for as long as the purpose of processing requires and applicable law permits:

Data	Retention Period
Account and child profile data	For as long as the account remains active
Upon deletion of a child profile	Data belonging to that profile is permanently deleted
Upon deletion of an account	All data linked to the account is permanently deleted
Deletion / download audit logs	5 years (legal obligation)
System / security logs	90 days
Uploaded images (for AI generation)	Not retained; discarded after generation
Cookie data	Depends on the type of cookie (see our Cookie Policy)

Data whose retention period has expired is deleted, destroyed, or anonymized.

8. Artificial Intelligence and Image Processing

When you use the photo-to-coloring-page feature, the image you upload:

Is not stored as a persistent file on our servers; it is processed temporarily (as base64 data) for the duration of the generation request.
Is transmitted to Google Cloud (Gemini) for AI image generation, and no copy of the original uploaded image is retained once generation is complete.
The generated coloring page (line-art image) may be stored as platform content linked to the relevant user/child profile, and may be published in the gallery only after administrator moderation.

About AI-generated output: AI-generated coloring pages are created automatically. We cannot guarantee that output will always meet expectations; for this reason, generated content passes through administrator moderation in the gallery queue before it is shown to children. If you encounter inappropriate content, please report it to moderasyon@colorthepicture.com.

9. Your Rights as a Data Subject

Under GDPR and, for users located in Türkiye, KVKK Art. 11, you have the following rights regarding your personal data:

To learn whether your personal data is being processed,
To request information about such processing where it is taking place,
To learn the purpose of processing and whether your data is used consistently with that purpose,
To know the third parties, domestic or foreign, to whom your data has been transferred,
To request correction of incomplete or inaccurate data,
To request erasure or destruction of your data (the “right to be forgotten”),
To request that any correction or erasure be notified to third parties to whom your data was transferred,
To object to a decision produced solely by automated analysis that has an adverse effect on you,
To claim compensation for damage suffered due to unlawful processing,
To receive your data in a portable format (consistent with GDPR Art. 20).

9.1. How to Exercise Your Rights

You can exercise many of your rights directly, on a self-service basis, from your profile page:

Download my data (JSON): you can download all data tied to your account and child profiles — including artwork, drafts, and badges — as a single JSON file.
Correction: you can update profile information such as nickname or avatar directly from your profile page. To change your e-mail address or password, contact destek@colorthepicture.com.
Deleting a child profile: all data belonging to that child profile is permanently deleted.
Deleting your entire account: your account, together with all linked child profiles and data, is permanently deleted. This action cannot be undone; we recommend using “Download my data” to keep a backup beforehand.
Withdrawing consent: where processing is based on consent, you may withdraw it at any time. This request is logged for audit purposes and results in deletion of the relevant data.

You may also submit requests to kvkk@colorthepicture.com. We will respond within the timeframe required by applicable law (for users covered by KVKK, no later than 30 days). We may request reasonable additional information to verify your identity.

9.2. Automated Decision-Making

Certain limits — such as credit or trial limits — are calculated automatically. If you wish to object to a decision of this kind, you can reach us at kvkk@colorthepicture.com.

9.3. Right to Lodge a Complaint

If your request is denied or you find our response unsatisfactory, you retain the right to lodge a complaint with the competent supervisory authority. If you are located in Türkiye, this is the Turkish Personal Data Protection Authority (KVKK Kurumu); if you are located in the EU/EEA, you may lodge a complaint with your local data protection authority.

10. Children’s Privacy (COPPA and GDPR; for Users in Türkiye, Also KVKK Art. 8)

Children’s privacy sits at the center of our service’s design:

Accounts can only be opened by a parent or legal guardian (18+); children cannot open accounts directly.
Child profiles are created and managed under a parent account.
We do not collect data directly from the child; we do not ask for the child’s real name, e-mail address, or phone number.
The parent always has the right to view, correct, and delete their child’s profile data (see Section 9).
Under COPPA, we rely on the parent who opens the account to have given verifiable parental consent and to be authorized to consent on the child’s behalf (see Section 11).

If you become aware that a child’s data has been processed without our knowledge and without appropriate parental consent, please notify us at kvkk@colorthepicture.com; we will act promptly to delete it.

11. Parent / Legal Guardian Representations

By creating an account or using the service, you represent and warrant that:

You are at least 18 years old and have full legal capacity,
You are the parent or legal guardian of the child profile(s) you manage, and are authorized to consent on that child’s behalf,
You hold all rights necessary in any image or content you upload, and that doing so does not infringe any third party’s intellectual property, privacy, or other rights.

To the extent permitted by law, you are responsible for any third-party claims arising from a breach of these representations, and you agree to indemnify us for any resulting losses.

12. User Content and Content Moderation

Artwork shared in the gallery passes through administrator moderation to keep the environment safe for children. We reserve the right not to publish, to remove, or to restrict access to content that violates our community guidelines, applicable law, or third-party rights. This authority is exercised to protect child safety, not to restrict your freedom of expression.

13. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

Password protection: passwords are hashed with bcrypt; they are never stored in plain text.
Transmission security: all data transfers are encrypted via HTTPS/TLS.
Access control: role-based access control (RBAC) is enforced; only authorized personnel can access data, and only to the extent required by their role.
Audit logging: sensitive operations such as data deletion and data export are logged for audit purposes.
Infrastructure: our servers are hosted in the EU (Germany).

No system can guarantee absolute security, but we maintain reasonable, up-to-date measures to protect your data. If you become aware of a security incident, please contact us at moderasyon@colorthepicture.com or destek@colorthepicture.com.

14. Cookies

Detailed information about cookies and similar technologies is set out in a separate Cookie Policy. Analytics cookies operate only where you have given your consent.

15. Service Disclaimers and Limitation of Liability

The limitations below apply to the maximum extent permitted by applicable law and without prejudice to any mandatory consumer-protection or data-protection rights you may have.

Service provided “as is”: the service is provided “as is” and “as available.” To the extent permitted by law, all implied warranties not expressly stated (such as merchantability or fitness for a particular purpose) are excluded. We do not guarantee that the service will be uninterrupted or error-free, or that AI-generated output will always be accurate, complete, or fit for any particular purpose.
Scope of liability: to the maximum extent permitted by law, we are not liable for indirect, incidental, special, or consequential damages.
Liability cap: to the maximum extent permitted by law, our total liability for claims arising from the service is limited to the fees you paid us in the 12 months preceding the event giving rise to the claim.

Nothing in this section excludes or limits our liability for intent, gross negligence, death or personal injury, or any other liability that applicable law does not permit to be limited. Your rights under applicable consumer-protection law remain unaffected and cannot be waived by this Policy.

16. Governing Law and Jurisdiction

The company is headquartered in Türkiye. This Policy, and any dispute arising from use of the service, is governed by the laws of the Republic of Türkiye, and the courts and enforcement offices of Istanbul, together with the competent consumer arbitration boards (tüketici hakem heyetleri), have jurisdiction.

That said, any rights granted to you under the mandatory consumer-protection or data-protection laws of your country of residence remain reserved and cannot be overridden by this Policy. With respect to such mandatory rights, you retain the ability to apply to the competent authorities of your place of residence.

17. Changes, Suspension, and Termination

Changes to the service and this Policy: we may update the service and this Policy from time to time. We will provide reasonable notice of material changes, either by notifying the e-mail address on your account or by posting a notice on the platform. The current version is always available on this page, and the “Last updated” date will be revised accordingly.
Suspension and termination: we reserve the right to suspend or terminate your account or access to the service in the event of a violation of applicable law, our terms of use, or security requirements. You may also delete your own account at any time.

18. Force Majeure

We will not be held liable for failure to perform our obligations to the extent such failure results from events reasonably beyond our control (force majeure), including natural disasters, fire, epidemic, war, cyberattacks, infrastructure or third-party service outages, or changes in law. This does not eliminate any mandatory rights you have under applicable data-protection law.

19. Severability and Entire Agreement

If any provision of this Policy is found invalid or unenforceable, the remaining provisions remain in full force and effect; the invalid provision will be construed, to the extent possible, to reflect its original intent. Together with the applicable Terms of Use and Cookie Policy, this Policy constitutes the complete disclosure regarding our processing of personal data.