Privacy Policy

Who We Are

Online Cars Coloring ("we", "us", "our") operates the website https://onlinecarscoloring.com. We are the data controller responsible for your personal information collected through this Service.

For privacy-related inquiries, contact us at: [email protected]

Information We Collect

We collect the following categories of information:

Information you provide directly:

• Account data: Name, email address, and password (stored as a secure hash) when you register.
• User content: Saved coloring drawings and associated metadata (title, timestamps).
• Contact messages: Name, email, subject, and message body when you use our contact form.

Information collected automatically:

• Session data: PHP session tokens for authentication and flash messages.
• Log data: Server-side logs (IP address, browser type, pages visited, timestamps) for security and debugging purposes. Logs are retained for a maximum of 30 days.

Information we do NOT collect:

• We do not collect payment card numbers, bank details, or full payment information. All payment processing is handled by Square.
• We do not use third-party advertising trackers or analytics platforms (such as Google Analytics) by default.

How We Use Your Information

We use your personal information for the following purposes:

• Providing the Service: Creating and managing your account, enabling Premium features, and saving your drawings.
• Transactional emails: Sending account verification, password reset, subscription confirmation, and subscription cancellation emails via Brevo.
• Customer support: Responding to your contact form submissions and support requests.
• Security: Detecting and preventing fraudulent or unauthorized access.
• Legal compliance: Meeting our obligations under applicable laws and regulations.
• Service improvement: Analyzing aggregated (non-personal) usage patterns to improve the platform.

We do not use your data for advertising profiling, behavioral tracking, or sale to third parties.

Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), we process your personal data under the following legal bases as defined by the GDPR:

• Contract performance (Art. 6(1)(b)): Processing necessary to provide the Service you requested, including account creation and Premium subscription management.
• Legitimate interests (Art. 6(1)(f)): Security monitoring, fraud prevention, and service improvement — where these interests are not overridden by your rights.
• Legal obligation (Art. 6(1)(c)): Processing required to comply with applicable laws.
• Consent (Art. 6(1)(a)): Where we rely on your consent (e.g., optional marketing emails), you may withdraw it at any time.

Sharing of Information

We do not sell, rent, or trade your personal data. We share information only with the following service providers, under strict data processing agreements:

• Brevo (Sendinblue): Our transactional email provider. Receives your name and email address to deliver account-related emails. Brevo Privacy Policy →
• Square: Our payment processor. Receives billing information necessary to process subscriptions. We share only what is required for payment processing. Square Privacy Policy →
• Hosting provider: Our web server provider has access to server logs and uploaded files as part of providing hosting infrastructure.

We may disclose your information if required by law, court order, or to protect the rights, property, or safety of Online Cars Coloring or others.

Payment Data

All payment transactions are processed by Square. When you subscribe to Premium, you enter your payment details directly into Square's secure, PCI-DSS-compliant payment interface.

We do not receive, store, or process your full card number, CVV, or bank account details. We receive only a transaction reference ID and subscription status from Square.

Square's handling of your payment data is governed by Square's Privacy Policy.

Email Communications

We send the following types of emails:

• Transactional emails (required): Email verification, password reset, subscription confirmation, and subscription cancellation. These are necessary for account operation and cannot be opted out of while you have an active account.
• Service announcements: Occasional emails about significant changes to the platform. These are limited and infrequent.

We do not send promotional or marketing emails without your explicit consent. You can unsubscribe from any optional communication at any time by contacting us at [email protected].

Cookies and Tracking

We use the following cookies and session technologies:

• Session cookie (PHPSESSID): A strictly necessary cookie used to manage your login session. It remains active for up to 30 days of inactivity or until you log out, whichever comes first. No consent is required for this cookie under ePrivacy Directive exceptions.
• No third-party tracking cookies: We do not use Google Analytics, Facebook Pixel, or any other advertising or behavioral tracking cookies by default.

Your browser settings allow you to refuse or delete cookies. Note that disabling session cookies will prevent you from logging in.

Data Retention

We retain your personal data for as long as necessary to provide the Service and fulfill the purposes described in this Policy:

• Account data: Retained for the lifetime of your account plus 90 days after deletion request processing.
• Saved drawings: Retained while your account is active. Deleted upon account deletion.
• Payment records: Retained for up to 7 years as required by financial regulations.
• Server logs: Retained for a maximum of 30 days, then automatically purged.
• Contact messages: Retained for up to 2 years for support continuity.

Your Rights (GDPR / LGPD)

Depending on your location, you may have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data, subject to legal retention obligations.
• Right to Data Portability: Request your data in a machine-readable format (applicable under GDPR).
• Right to Restriction: Request restriction of processing in certain circumstances.
• Right to Object: Object to processing based on legitimate interests.
• Right to Withdraw Consent: Withdraw consent where processing is consent-based, without affecting prior processing.
• Right to Lodge a Complaint: File a complaint with your local data protection authority (e.g., in the EU; or the ANPD in Brazil under LGPD).

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

Children's Privacy

Our Service is designed to be family-friendly and suitable for all ages. However, we do not knowingly collect personal information from children under 13 without verifiable parental consent.

If we learn that we have collected personal data from a child under 13 without parental consent, we will delete that information promptly. If you believe a child has provided us with personal data without consent, please contact us at [email protected].

Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, or disclosure:

• Passwords are stored using bcrypt hashing — never in plain text.
• All data transmission is encrypted using HTTPS/TLS.
• Database access is restricted to application-layer prepared statements (preventing SQL injection).
• CSRF tokens protect all state-changing form submissions.
• User-uploaded files are stored outside the public web root.

No method of transmission or storage is 100% secure. In the event of a data breach that is likely to affect your rights, we will notify you and relevant authorities as required by law.

International Transfers

Your data may be processed in countries outside your own, including the United States, where our hosting and service providers (Brevo, Square) are located.

When transferring data from the EEA, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) as approved by the European Commission. For Brazilian users, transfers comply with LGPD Chapter V requirements.

Third-Party Links

Our Service may contain links to third-party websites (e.g., Square, Brevo documentation). This Privacy Policy applies only to our Service. We encourage you to review the privacy policies of any third-party sites you visit, as we are not responsible for their practices.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Notify registered users by email at least 14 days before the changes take effect.

Your continued use of the Service after changes take effect constitutes acceptance of the updated Privacy Policy.

Contact

For any privacy-related questions, data access requests, or complaints, please contact us:

• Email: [email protected]
• Contact form: https://onlinecarscoloring.com/contact

We aim to respond to all privacy inquiries within 30 calendar days.