Privacy Policy — Pikazo

Last updated: September 24, 2026

Who is responsible

World of Eureka AS (organization number 938 223 904), Møllergata 6, 0179 Oslo, Norway, runs Pikazo (pikazocoloring.com) and is responsible for your personal data as its controller. Because we are established in Norway, we follow the EU/EEA General Data Protection Regulation (GDPR) for everyone who uses Pikazo, wherever you live. Contact: [email protected].

What we collect

Photos you upload, and the coloring pages and covers we generate from them. Photos can show you and other people, including children.
An anonymous account created automatically in your browser, and the books, pages and cart linked to it.
Order details: your name, email address, phone number, delivery and billing address, and what you bought. Payment details go directly to Stripe; we never see your full card number.
Technical data: IP address, browser and device information, and error reports, which we use to keep the service secure and working.
Analytics and advertising data (pages you visit, device and browser, and ad click identifiers), only if you accept cookies.

How we use it, and our legal basis

To make, print and deliver your book and to help you with your order. This is necessary to perform our contract with you (GDPR Art. 6(1)(b)).
To keep the service secure, prevent abuse and fix errors. This is our legitimate interest in a safe, working service (Art. 6(1)(f)).
To keep accounting records and meet other legal requirements (legal obligation, Art. 6(1)(c)).
To understand how the site is used and to measure our advertising, only with your consent (Art. 6(1)(a)). You can withdraw it at any time with the Cookie settings button.

We do not sell your personal data. We do not use your photos for advertising, and we do not use them to train AI models. We do not use face recognition or create biometric identifiers from your photos.

Who we share it with

We share personal data only with service providers that process it for us, under our instructions:

Supabase: database, accounts and file storage
Vercel: website hosting
fal.ai: AI processing that turns your photos into coloring pages
Lulu: printing and shipping (print files and your delivery address)
Stripe: payments
Resend: order emails
Google: address suggestions at checkout (Google Maps Platform) and, if you accept cookies, Google Analytics
Meta: if you accept cookies, the Meta Pixel measures how our Facebook and Instagram ads perform
Stape: hosts our server-side tagging, which passes analytics data on to Google
CookieScript: shows the cookie banner and stores your cookie choice
Sentry: error monitoring

We may also disclose data when the law requires it, for example to report illegal content to the authorities.

Transfers outside Europe

Several of these providers store or process data in the United States. When data leaves the EU/EEA, we rely on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

How long we keep it

Photos, pages and books: until you delete them or ask us to. After an order, we keep that order's print files so we can handle reprints and complaints.
Order and payment records: five years after the end of the financial year, as Norwegian bookkeeping law requires.
Error reports and logs: for a limited period, normally no more than 90 days.

Cookies

Cookies and similar browser storage we always use, because the site needs them to work:

sb-…-auth-token (Supabase): keeps your anonymous account signed in; up to 400 days
CookieScriptConsent (CookieScript): remembers your cookie choice
__stripe_mid and __stripe_sid (Stripe, on the checkout page): payment fraud prevention; 1 year and 30 minutes
Browser session storage for your checkout details, cleared when you close the tab

Cookies we set only if you choose Accept all:

_ga and _ga_… (Google Analytics): measure how the site is used; up to 2 years
_fbp (Meta): measures how our ads perform; up to 90 days

You can change your choice at any time with the Cookie settings button at the bottom of every page.

Your rights

You can ask to access, correct or delete your personal data, to restrict or object to how we use it, and to receive a copy in a portable format. Where we rely on your consent, you can withdraw it at any time. Email [email protected] to use these rights. You can delete books and covers yourself in the app; to delete your photos and account entirely, email us.

If you live in a US state with a consumer privacy law, such as California, you also have the rights that law gives you, including to know, correct and delete your personal information. We do not sell your personal information. If you accept advertising cookies, the Meta Pixel shares information about your visit with Meta to measure and target our ads, which some US state laws call "sharing". You can opt out at any time by choosing Decline all in the Cookie settings.

You can complain to the Norwegian Data Protection Authority, Datatilsynet, or to the data protection authority where you live. We would appreciate the chance to help first.

Children

Pikazo is a service for adults, and you must be 18 or older to place an order. Parents often make books from photos of their children. When you upload photos of a child, you confirm that you are the child's parent or guardian or have their permission, and we use those photos only to make your book. We do not knowingly collect personal data directly from children under 13.

Security

Photos and books are kept in private, access-controlled storage and are transferred over encrypted connections. We share print files with our printer only for your order.

Changes

We will update this policy when our practices change, and the date at the top shows the latest version.

Contact

World of Eureka AS, Møllergata 6, 0179 Oslo, Norway. Email: [email protected].