Privacy Policy

ColorPageLab — colorpagelab.com
Operated by: Miartmedia LTD
Contact: Contact page
Effective Date: February 28, 2026
Last Updated: July 14, 2026

1. Who We Are

ColorPageLab is operated by Miartmedia LTD, the data controller for personal data processed through this Service. For any privacy questions, contact us via our contact page.

2. What This Policy Covers

This Privacy Policy explains what data is collected when you use colorpagelab.com (the "Service"), why it is collected, who it is shared with, how long it is retained, and what rights you have. It reflects what the Service actually does at the Last Updated date above.

3. What We Collect and Why

3.1 Browsing the Site — Google Analytics 4

Every public page on the Service loads Google Analytics 4 (GA4) in production. GA4 automatically collects:

• Pages visited and navigation path
• Browser type and version
• Operating system and device type
• Country and region (derived from IP address, which is then discarded by Google before storage)
• Session duration and pages per session
• Referring URL (where you came from)

We have configured GA4 so that full IP addresses are not stored by Google. We use this data solely to understand how the Service is used so we can improve it.

We track the following custom GA4 events specifically:

None of these GA4 events include your name, email address, or any identifier that can be linked to you personally.

GA4 is not loaded on localhost, in admin routes, or in non-production environments.

3.2 Optional Google Account Authentication

You may browse, download, and print public content without an account. If you choose Continue with Google, Google authenticates you and provides Supabase Auth with the basic account information needed to create or recognize your ColorPageLab account:

• A Google account identifier
• Your email address and email-verification status
• Your name and profile image, if available from your Google profile

We request only the openid, email, and basic profile scopes. We do not request access to your Google Drive, contacts, messages, calendar, or other Google services, and we do not retain Google provider access or refresh tokens for use with Google APIs.

Supabase Auth stores the authentication identity, issues the ColorPageLab session, and associates the account with an internal user ID and the default basic_user access role. We use this information only to authenticate you, protect your dashboard, prevent abuse, and support account features that you choose to use. Google sign-in is optional and is separate from the administrator login system.

The protected profile page displays your Google name and email as read-only identity details. If you save preferences, we store your chosen account language and default download or print paper size under your internal user ID. These preferences are used only to present the supported language and paper format you selected while signed in. They are protected by owner-only database row-level security and are deleted with your ColorPageLab account.

3.2.1 Cloud Collections

Cloud collections are available only while you are signed in. If you create or update a collection, Supabase stores the collection name, the identifiers of the coloring pages you add, and creation or update timestamps under your internal user ID. We do not store collections in browser storage, and anonymous visitors cannot create or modify collections.

Database row-level security restricts collection records to the account that owns them. You can rename or delete your collections from the protected dashboard. Deleting a collection also deletes its saved page associations.

When you share a collection, we store the recipient email, sender and collection identifiers, a hash of a random invitation token, delivery time, expiry, and acceptance/copy state. The invitation expires after 30 days and collection data is shown only after the recipient authenticates with Google using the invited email. The URL alone does not grant access. Administrator accounts cannot receive these invitations, and senders are limited to five invitation emails per rolling hour.

You may permanently delete your ColorPageLab account from the protected account settings page after completing a recent Google authentication check and entering an explicit irreversible confirmation. Deletion removes the Supabase Auth identity, access role, private collections, saved items, and sent or received collection invitations linked to that account. It does not delete or modify your Google account.

The deleted Supabase user identifier is irreversibly removed from retained operational error history. Narrow records may remain only where required by law or strictly necessary for fraud prevention, security investigations, disputes, or compliance. Those records are restricted from ordinary use and retained only for the applicable period described below. Anonymous aggregate analytics that cannot reasonably be linked to the account are not affected.

3.3 Downloading a Coloring Page

When you download a PDF or PNG, an aggregate download count is incremented on the coloring page record in our database to show which pages are popular. This aggregate count is not linked to an individual visitor identity.

3.4 Making a Voluntary Support Payment — Stripe

If you click "Support" and complete a payment, Stripe, Inc. handles all payment processing. We never see or store your card number, CVV, expiry date, or billing address.

What Miartmedia LTD receives from Stripe after a completed payment:

• The Stripe checkout session ID (a reference code)
• The payment amount
• A confirmation that payment succeeded

We store these items for financial record-keeping. We do not create a user profile from your payment or use it for marketing. Stripe may email you a receipt directly. We do not receive your email address from this transaction flow.

By making a payment you also agree to Stripe's Privacy Policy.

3.5 Social Sharing — Pinterest, Facebook, X, WhatsApp

The Service includes sharing buttons for Pinterest, Facebook, X (Twitter), and WhatsApp. These are outbound links that open the relevant platform in a new tab. We do not send any data to these platforms on your behalf merely from loading the page (except as described for Pinterest's script below).

Pinterest script: The Service loads Pinterest's pinit.js script on all public pages to enable the "Pin It" button. This script may set a Pinterest cookie or record your visit to the page if you are logged into Pinterest in the same browser. We do not control this behaviour. See Pinterest's Privacy Policy.

3.6 Affiliate Links — Amazon Associates

Some blog posts on the Service contain affiliate links to products on Amazon. ColorPageLab participates in the Amazon Associates Program, an affiliate advertising programme designed to provide a means for sites to earn fees by linking to Amazon.

When you click an affiliate link:

• You are redirected to the Amazon website (amazon.com or the relevant regional Amazon site)
• Amazon may set cookies on your device to track the referral
• If you make a purchase on Amazon within the applicable attribution window, we may receive a small commission at no additional cost to you
• We do not receive your name, email address, payment details, or any personal information from Amazon as a result of this referral

Amazon's collection and use of data when you visit their site is governed entirely by Amazon's Privacy Notice. We have no control over Amazon's data practices.

Affiliate links are clearly identified within blog content. Our participation in the Amazon Associates Program does not influence our editorial content or product recommendations — we only recommend products we consider genuinely useful to our audience.

3.7 Error Monitoring

The Service includes infrastructure for error monitoring. When errors occur, error details (including the error message, stack trace, and request context) may be captured and stored server-side or transmitted to a connected monitoring service (e.g., Sentry). Error data is used solely for diagnosing and fixing technical issues. We do not include payment card data, passwords, or sensitive PII in error logs.

3.8 Operational Telemetry and Security Logging

The Service logs inbound requests and service interactions for the purposes of security monitoring, abuse prevention, rate-limit enforcement, and operational performance. This may include IP addresses, request paths, HTTP status codes, and timing data. These logs are retained for a limited period (see Section 8) and are not used for marketing or user profiling.

3.9 What Is Stored in Our Database

Our database and authentication system (hosted by Supabase, Inc.) stores:

• Coloring page content: titles, slugs, category names, image URLs, download counts
• Optional customer account identity data described in Section 3.2, Supabase user IDs, authentication identities, and access roles
• Customer-created cloud collection names, saved coloring-page identifiers, and collection timestamps
• Administrator authentication records and roles managed by Supabase Auth — passwords are never stored by ColorPageLab in plaintext
• Stripe session IDs and payment amounts for financial records
• Product metadata and aggregate operational counters needed to run the Service

The database does not create an account or store an email address merely because someone browses or downloads public content. It does not store payment card data. If you voluntarily submit the contact form, the details you provide (such as your name, email address, subject, and message) are transmitted through our email provider to our inbox so we can respond, but they are not stored in the application database.

4. Data We Do Not Collect

To be explicit:

• We do not collect your name or email address through anonymous browsing or downloading. We receive basic account information only if you choose Google sign-in or provide it through the contact form.
• We do not use account identity data for behavioural advertising or track named account holders across unrelated services.
• We do not sell, rent, or trade personal data to third parties.
• We do not display third-party advertising or use customer account, collection, or activity data for advertising or ad personalisation. This does not prevent clearly disclosed Amazon Associates affiliate links, which may generate a commission after you choose to visit Amazon.
• We do not share data with anyone except the service providers listed in Section 7, and only to the extent needed to operate the Service.

5. Cookies

Necessary authentication cookies

After a successful customer Google sign-in or administrator login, Supabase sets necessary session and PKCE cookies. Authentication cookies are HttpOnly, use Secure in production, and use SameSite=Lax so the Google OAuth callback can complete safely. They are not advertising cookies. Visitors who do not sign in do not receive authentication cookies.

Analytics cookies (Google Analytics 4)

GA4 sets the following cookies for public visitors in production:

Pinterest

The Pinterest pinit.js script may set its own cookies if you are logged into Pinterest. These are outside our control and governed by Pinterest's own privacy policy.

Amazon Associates

When you click an affiliate link and visit Amazon, Amazon may set cookies on your device to track the referral for commission attribution purposes. These cookies are set by Amazon, not by us, and are governed by Amazon's Privacy Notice and Cookie Policy.

Cookie consent (EU/UK visitors)

If you are visiting from the EU or UK, GA4 analytics cookies require consent under the ePrivacy Directive and UK PECR. We are implementing a compliant cookie consent mechanism. Until it is live, you can opt out at any time using the Google Analytics Opt-Out Browser Add-on.

6. How We Use Your Data

7. Third-Party Services and Processors

OpenAI is used exclusively as a backend admin tool to generate coloring page artwork. No visitor data is ever sent to OpenAI. We do not use Google profile information, authentication data, collection names, private collections, or customer activity to train, fine-tune, or evaluate artificial-intelligence models.

8. Data Retention

9. International Data Transfers

Miartmedia LTD is based in the United Kingdom. The ColorPageLab Supabase project is hosted in the West US (Oregon) region. Google and other service providers may also process personal data outside the UK and EEA.

For restricted transfers handled by Supabase, its Data Processing Addendum incorporates the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. Google states in its data-transfer framework notice that it participates in the UK Extension to the EU-US Data Privacy Framework and relies on Standard Contractual Clauses where required. Other restricted transfers use an applicable adequacy regulation, approved contractual safeguard, or another mechanism permitted by data-protection law.

10. Legal Bases (GDPR and UK GDPR)

For visitors in the European Economic Area and United Kingdom, the legal bases we rely on are:

You have the right to object to processing based on legitimate interests. To do so, contact us via our contact page.

You have the right to lodge a complaint with your supervisory authority:

• UK: Information Commissioner's Office — ico.org.uk
• EU: Your national authority — edpb.europa.eu

We ask that you contact us first so we can try to resolve your concern directly.

11. Your Rights

Depending on where you are located, you may have the right to:

• Access personal data we hold about you
• Correct inaccurate personal data
• Delete personal data we hold about you ("right to erasure")
• Restrict processing of your personal data
• Object to processing based on legitimate interests
• Portability — receive a copy of your data in a structured, machine-readable format
• Withdraw consent where processing is based on consent (e.g., GA4 analytics cookies)

Public use of the Service does not require an account. If you create an optional account, you may permanently delete it from protected account settings after recent Google reauthentication. You may also contact us via our contact page with the subject line "Privacy Request" for access, correction, portability, restriction, objection, or assisted deletion requests. We will respond without undue delay and normally within one month.

To opt out of GA4 analytics specifically, use the Google Analytics Opt-Out Browser Add-on.

12. California Users (CCPA / CPRA)

We do not sell your personal information. We do not share your personal information with third parties for cross-context behavioural advertising.

The personal information we collect is limited to optional account identity data, GA4 analytics data, operational security logs, contact information you submit, and — if you make a voluntary payment — a Stripe session ID and payment amount.

California residents may submit requests to know, delete, or correct their personal information by using our contact page with the subject line "California Privacy Request". We will respond within 45 days. We will not discriminate against you for exercising your CCPA/CPRA rights.

13. Children

The Service provides content suitable for children but does not target children under 13 as a primary audience and does not knowingly collect personal data from children under 13. Account creation is optional, and users under 18 may use an account only with parental or guardian consent.

If you believe a child under 13 has submitted personal data to us, contact us via our contact page and we will delete it promptly.

14. Security

Technical security measures currently in place include:

• HTTPS/TLS for all data in transit
• Rate limiting on customer authentication, administrator login, and public API endpoints
• Server-side PKCE code exchange with fixed OAuth callback and post-authentication destinations
• Server-verified authentication-method checks that keep Google customer sessions separate from password-authenticated administrator sessions
• HttpOnly, production-Secure, SameSite=Lax Supabase authentication cookies
• Server-side session verification for protected customer and administrator routes
• Environment variable validation at application startup
• SSL-enforced database connections in production
• Request body size limits on all upload endpoints
• Security headers: X-Frame-Options, X-Content-Type-Options, HSTS, Referrer-Policy, CSP

No security measure is perfect. If you discover a security vulnerability, please report it responsibly via our contact page.

We maintain procedures to investigate and respond to personal-data breaches. Where legally required, we will notify the Information Commissioner's Office without undue delay and, where feasible, within 72 hours after becoming aware of a reportable breach. Where a breach is likely to create a high risk to affected individuals, we will also notify those individuals without undue delay.

15. Changes to This Policy

We will update the "Last Updated" date at the top of this page when material changes are made. Continued use of the Service after changes are posted constitutes acceptance of the revised policy.

16. Contact

Miartmedia LTD
Contact: Contact page
Website: colorpagelab.com

ColorPageLab is a trading name of Miartmedia LTD.