Privacy policy

1. The short version

• We do not sell your personal data, and we never have.
• We do not use your uploads, prompts or generated pages to train any AI model.
• Uploads are deleted automatically within 30 days, and immediately when you delete them.
• We do not run advertising trackers or third-party advertising cookies.
• We never see your full card number.

2. What we collect

We do not ask for your name, address, telephone number or date of birth, and there is no field to give them.

3. Your uploads are not training data

This one matters enough to state on its own. Photographs you upload, the descriptions you write and the pages you generate are never used to train, fine-tune or evaluate any artificial-intelligence model, ours or anyone else's. They are not sold, rented or shared for marketing. They exist to produce your page, and then they are deleted.

Your upload is sent to the image model provider that draws the line art, purely in order to produce your result. That provider is contractually prohibited from retaining your content or using it for training.

4. Your card details

Card payments are processed entirely by an external payment provider certified to PCI DSS Level 1. Your card number is entered on that provider's own secure form and is never transmitted to, seen by or stored on Colorune's systems. We receive only a confirmation of payment, the card brand and the last four digits.

5. Who else touches your data

We use a small number of service providers to run the site. Each processes data only on our instructions and only for the purpose listed.

• Hosting and content delivery — serving this website and its files.
• Database and file storage — holding your account, your uploads and your generated pages.
• The image model provider — drawing the line art. Prohibited from retaining or training on your content.
• The payment provider — taking payment and managing subscriptions. Certified to PCI DSS Level 1.
• Email delivery — sending receipts, account emails and support replies.

We do not sell personal data, and we do not share it with advertisers or data brokers. We disclose data to anyone else only where the law requires it, or to protect someone's safety.

6. International transfers

Our providers may process data in countries other than the one you live in, including the United States. Where data leaves the European Economic Area or the United Kingdom, transfers are covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

7. Legal bases (UK and EU users)

• Performance of a contract — running your account, generating pages, taking subscription payments.
• Legitimate interests — keeping the service secure, preventing abuse, fixing faults.
• Legal obligation — keeping billing records for the period tax law requires.
• Consent — any optional email we might send you, which you can withdraw at any time.

8. Your rights

Wherever you live, you can ask us to do any of the following. Write to support@alestrasara.shop from the address on your account. We answer within 30 days, and normally within one business day. There is no charge.

• See a copy of what we hold about you.
• Correct anything that is wrong.
• Delete your uploads, your generated pages, or your whole account.
• Export your data in a portable format.
• Object to or restrict processing based on legitimate interests.
• Withdraw consent to optional email at any time.
• Complain to your national data protection authority. We would rather you came to us first.

If you are in California, you have the same practical outcomes under the CCPA/CPRA, including the right to know, delete and correct, and the right to opt out of sale or sharing. We do not sell or share personal information as those terms are defined, so there is nothing to opt out of.

9. Deleting things yourself

• One upload or page: delete it from your account page. It is removed immediately.
• Everything: choose Delete account, or email us. Your account, uploads and generated pages are removed within 30 days. We keep only the minimal billing record the law requires.

10. Security

The site is served over HTTPS throughout. Passwords are stored as one-way hashes. Uploads are stored in private storage that is not publicly listable. Access to production systems is limited and authenticated. No system is perfectly secure, but we take this seriously, and if a breach ever affected your data we would tell you.

11. Children

Colorune is made for grown-ups to use, often on behalf of children. Accounts are for people aged 16 and over, or younger with a parent or guardian's consent. We do not knowingly collect data from a child directly. If you believe a child has created an account, email us and we will remove it.

12. Cookies

We use a small number of strictly necessary cookies and no advertising trackers. See the cookie policy.

13. Changes

If we change this policy we will update the date at the top, and we will email account holders before any material change takes effect.