Skip to main content
Colour Me
Sign in Register

Privacy notice

Last updated:

The short version for children

A grown-up has the Colour Me account and should help you use it. Describe a picture, but do not type your name, school, address, phone number or anything else that tells people who you are.

Computer tools check the idea and draw the page. The grown-up can see, print and delete it. The idea and page are kept privately for no more than 30 days. Ask your grown-up if you want to know more or want something removed.

Who is responsible

Colour Me Ltd is the data controller for the Colour Me service. Company number: 17378275. Registered office: 3 Ilex Crescent, Locks Heath, Southampton SO31 6SE. Privacy contact: privacy@colour-me.co.uk

Who Colour Me is for

Accounts are for adults aged 18 or over. Children do not receive accounts or profiles. An adult may use the service to create a printable activity for a child under their supervision.

Information we use

  • the adult account holder’s email address, chosen display name and authentication records;
  • the time and version of adult, supervision, terms and privacy declarations;
  • colouring-page prompts and confirmations that they contain no identifying child information;
  • generated images and printable PDFs created from those images;
  • safety and rights-check outcomes, moderation decisions, job status and credit-balance records;
  • subscription and credit-pack status, Stripe references, purchase-time consent and confirmation-delivery records, and limited payment outcomes needed to provide paid access and aggregate reporting; and
  • limited technical and operational records needed to secure, diagnose and operate the service.

Please do not enter a child’s name, contact details, school, address, photograph or other identifying information in a prompt. Colour Me does not intentionally create child accounts or child profiles.

Why we use it

We rely on contract where information is needed to create and manage an adult account, provide requested colouring pages, administer credits, subscriptions and purchases, and provide customer support.

We rely on our legitimate interests to keep Colour Me safe, secure and reliable; prevent misuse; apply proportionate safety and rights checks; investigate faults; and maintain minimised operational totals. We limit this processing to what is reasonably necessary and take account of the privacy interests of adult account holders and children using the finished activities.

We rely on legal obligation where information must be used or retained for tax, accounting, consumer-protection or data-rights purposes. Optional analytics and advertising measurement rely on consent, which can be changed at any time through Cookie settings in the footer.

Automated checks and human review

Automated safety and rights checks can refuse a prompt, block an output or hold a page for review. Pages may also be reviewed manually before release. These controls protect children and avoid unsuitable or recognisable protected material. Contact Colour Me support if you believe a decision is wrong.

Services we use

  • Supabase for adult authentication, database records and private generated-image storage;
  • OpenAI for prompt safety, rights classification, image generation and generated-image safety;
  • Netlify for application hosting and server execution;
  • Stripe for hosted checkout, subscription and credit-pack payments, billing management, invoices and payment records;
  • Resend for hosted sign-in codes and any essential service messages that are enabled;
  • Cloudflare Turnstile for proportionate bot and automated-abuse checks when an adult registers, signs in or requests another code;
  • Silktide Consent Manager, served by Colour Me, to record and apply the optional cookie choices made in this browser; and
  • Google Tag Manager, Google Analytics and approved Google Ads measurement only after the relevant optional consent has been given.

We do not sell personal information, use session replay, enable personalised advertising or upload customer details to advertising platforms.

Stripe may collect the adult customer's billing contact, billing address and payment-method information through its hosted pages. Colour Me receives only the customer, subscription, checkout and payment references, payment status, amount and currency needed to provide paid access, handle support and maintain financial records. Colour Me does not receive or store complete card details.

Where a paid purchase is enabled, Stripe records the customer's required checkout acknowledgement. Colour Me retains the transaction reference, time and exact notice and Terms versions, then uses a separate Resend credential to email a contract confirmation to the adult account address. The consent record does not contain an IP address, user agent or card details.

Essential storage is used to keep an adult account holder signed in, protect their private account and remember this browser’s cookie choices. Silktide stores the essential, analytics and advertising choices locally in the browser. Rejecting optional cookies does not prevent registration, generation, printing, downloading or payment.

If analytics is accepted, Google Analytics may receive minimised information about page types, approved calls to action, selected social accounts and FAQ questions, sign-up or sign-in completion, successful display-name updates, checkout starts, broad page-request outcomes and reasons, and requests to print, download or delete a colouring page. Page-request reasons use fixed categories such as unavailable, unsuitable, or named material; they never contain the description entered. Dynamic page identifiers, URL queries, prompts, generated images, email addresses, display names, social destination URLs and account or Stripe identifiers are excluded. If advertising is accepted, approved Google Ads conversion measurement may also be enabled. Optional Google tags are not loaded before the relevant choice is granted, and choices can be changed through Cookie settings in the footer.

Turnstile may process limited network, browser, device and security signals to decide whether an authentication request appears automated. Colour Me does not use those signals for advertising, behavioural analytics or to build user profiles.

We keep limited application-wide operational and commercial totals, such as how many pages are requested or completed, estimated generation costs and normalised payment outcomes. These totals do not contain prompts, images, email addresses, IP addresses, device fingerprints or persistent visitor identifiers, and cannot be used to reconstruct an individual journey.

International processing

OpenAI is accessed through its global API endpoint. Prompt text and generated output may therefore be processed outside the UK. OpenAI’s standard abuse-monitoring position may retain relevant customer content for up to 30 days. Colour Me does not currently claim Zero Data Retention, Modified Abuse Monitoring or UK regional processing.

Some other service providers and their subprocessors may also process information outside the UK. Where UK transfer restrictions apply, we use an applicable UK adequacy regulation or UK-approved contractual safeguards, together with proportionate security and data-minimisation measures. Contact privacy@colour-me.co.uk for more information about the safeguards relevant to your information.

How long we keep information

  • generated prompts, images and printable pages expire after 30 days and can be deleted earlier by the adult;
  • OpenAI’s standard abuse-monitoring retention may be up to 30 days;
  • account and authentication records are kept while the account remains open, then deleted or de-identified unless a limited record is still needed for security, a dispute or a legal obligation;
  • subscription, purchase, consent and normalised payment records are normally kept for six years after the end of the company financial year to which they relate, and longer only where required by law or an active dispute; Stripe remains responsible for full payment and invoice records;
  • moderation and operational records are kept only for as long as needed to review safety decisions, secure and diagnose the service, resolve disputes or meet legal obligations, then deleted or de-identified.

Deletion from live systems may not immediately remove information from encrypted provider backups, which expire according to the relevant provider’s retention process.

Your information rights

Depending on the circumstances, you may ask for access to your personal information, correction, deletion, restriction, portability or object to its use. Until self-service account export and deletion are implemented, send requests to privacy@colour-me.co.uk. We may need to verify that the request belongs to the account holder.

You can also complain to the Information Commissioner’s Office. We would appreciate the opportunity to address your concern first.

Changes

This notice is versioned. Material changes will be presented to account holders before the changed use begins. This version took effect on .