Privacy Policy

This Privacy Policy explains how BéKa Studio, the operator of Once Upon a Colour, collects, uses, shares, and protects personal data. BéKa Studio is the data controller for the data described here. If you have any question about it, write to us at the address in the contact section.

1. What we collect

We collect the following, depending on how you use the service.

• Account data: your email address, your password in hashed form, and the display name and profile picture you choose to add.
• Authentication data: sign in records, session tokens, and, if you sign in with Google or Apple, the account identifier, email address, and basic profile details those providers return to us. We never receive your Google or Apple password.
• Billing data collected at checkout: billing name, billing address, country, and, if you enter one, a tax identification number. Card details are entered directly with our payment provider and are never stored on our servers.
• Subscription and payment status received from our payment provider, such as plan, renewal date, payment success or failure, invoice records, and one time rush fee payments.
• Page requests you submit, including the theme description, any notes, and the delivery timing you choose.
• Photos you choose to upload: pictures of coloured pages you share, and any optional screenshot you attach to a help message.
• Activity data: which pages you download, when, your saved collections, and search terms used in the library.
• Any note or message text you send us, including help messages and request notes.

2. Why we use it

We use this data to create and run your account, to give access to the library, to take payment and issue invoices, to fulfil page requests, to answer help messages, to send service emails you expect, and to understand which pages and features are useful so we can keep the library growing in a sensible direction. We do not sell personal data, and we do not send unrelated marketing without your consent.

Our legal bases are the performance of our contract with you for account, library, and payment functions, our legitimate interest in keeping the service secure and improving it, your consent where you choose to upload a photo or opt in to optional emails, and our legal obligations for accounting and tax records.

3. Who processes your data for us

We work with a small number of service providers who process personal data on our instructions and only for the purposes below.

• A payment provider, Stripe, for checkout, subscription billing, one time rush fees, billing address and tax id collection, invoices, and fraud prevention.
• A cloud platform provider, Supabase, for authentication, the application database, and file storage of coloring pages, profile pictures, and uploaded photos.
• An email service used to send transactional notices, such as subscription confirmations, page request updates, invoice notices, and alerts when new pages go live.
• An AI vision service used to generate captions and tags for coloring pages, and to help match a photo of a coloured page you upload to the correct page in the library. Photos you upload may be processed by that service for this matching purpose. They are not used to train public models by us, and we do not send them for any other purpose.

We may also share data where we are legally required to, for example with tax authorities or in response to a lawful request.

4. Transfers outside the EU and EEA

Some of these providers, or their own infrastructure providers, may be located outside the European Union and European Economic Area, or may access data from outside it. Where that happens we rely on providers that commit to an adequate level of protection and we put appropriate contractual and technical safeguards in place for the transfer. You can ask us for more detail about a specific provider at any time.

5. How long we keep it

• Account, profile, and subscription data: for as long as your account exists, and then deleted or anonymised within a reasonable period after you close it.
• Billing and invoice records: kept for the period required by accounting and tax law, which is typically several years, even after an account is closed.
• Page requests, help messages, and uploaded photos: kept while your account is open so you and we can refer back to them, and removed on request or when the account is closed. You can delete a photo you uploaded at any time.
• Download and search activity: kept in aggregate to understand library use, and no longer linked to you once your account is closed.

6. Your rights

If you are in the European Union or European Economic Area you have the right to access your personal data, to have it corrected, to have it deleted, to receive a copy in a portable format, to object to or restrict certain processing, and to withdraw consent where processing is based on consent. Withdrawing consent does not affect processing already carried out.

You can update much of your data yourself from your account page. For anything else, write to us at the address below and we will answer within one month. You also have the right to complain to your national data protection authority.

7. Children

Accounts are intended for adults, such as parents, teachers, therapists, and other grown ups working with children. We do not knowingly collect personal data directly from children, and children should not create accounts. A photo of a coloured page or the description in a page request may occasionally show or refer to a child, but it is submitted and controlled by the adult who holds the account, and that adult is responsible for having the right to share it. If you believe a child has given us personal data directly, write to us and we will remove it.

8. Cookies and tracking

We use essential cookies and similar browser storage. They do two things: keep you signed in so the library and your account work, and carry out a secure checkout with our payment provider. Because these cookies are strictly necessary for a service you asked for, we do not ask for consent to them, we simply tell you they exist. You can clear or block cookies in your browser settings, though signing in and checkout will not work without them.

With your permission we also load a first party attribution pixel from partner.onceuponacolour.com, operated by our marketing partner Trybe (jointrybe.com). It lets us credit the creators in our campaigns for the visits and purchases they bring. It records a store identifier and conversion events, such as a purchase, tied to a Trybe creator. It does not record your browsing history and is not part of any advertising network. You can read Trybe's privacy policy at https://jointrybe.com.

The pixel only loads if you choose Accept all in the cookie notice. If you choose Essential only, it never loads and Trybe receives nothing from your visit. You can change your choice at any time by clearing the saved consent in your browser storage, which shows the notice again.

9. Security

Access to the library, uploads, and account data is protected by authentication and per account access rules, and traffic is encrypted in transit. No system is perfect, so please use a strong password and tell us if you notice anything unusual.

10. Contact

For privacy questions or data requests, contact BéKa Studio at hello@onceuponacolour.com. You can also read our Terms of Service and what you can do with the pages.