Privacy Policy
PhotoSketch AI (https://photosketchai.com)
Last updated: 2026-07-31 (version 1.3)
The short version
You upload a photo, we turn it into a colouring page. We do not keep your photo. The pages we generate for you are deleted after 30 days. Payment is handled by Stripe and we never see your card details. We do not sell your data.
You can try the service without an account. If you want more than your first free page, you sign in with your email address and we send you a link, so there is no password to choose or lose. When you have an account we hold your email address, the credits you have bought or been given, and a record of the pages you have made, so that you can come back to them. We do not build an advertising profile of you; if you accept cookies, our advertising and analytics providers (Meta and Google) may use cookies to measure and optimise our ads, and you can decline these on our banner.
The rest of this page explains that in the detail UK data protection law requires.
1. Who we are
PhotoSketch AI is operated by COLEAI LIMITED, a company registered in England and Wales (company number 17125345) with its registered office at 325-327 Oldfield Lane North, Greenford, Middlesex, UB6 0FX, United Kingdom.
COLEAI LIMITED is the "controller" of your personal data for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are registered with the UK Information Commissioner's Office (ICO) as a data controller under registration reference ZC205735.
Contact for anything in this policy: support@photosketchai.com
2. What we collect, why, and on what legal basis
| What | Why we process it | Legal basis (UK GDPR) | How long we keep it |
|---|---|---|---|
| The photograph you upload (JPG, PNG or WebP, up to 15 MB) | To generate your colouring page. It is sent to our AI provider for this purpose only. | Performing our contract with you (Article 6(1)(b)) | We do not store your photo. It is processed only for as long as it takes to generate your page, then it is gone from our systems. |
| The colouring pages and watermarked previews we generate for you | So you can view your preview and download anything you buy | Performing our contract with you (Article 6(1)(b)) | 30 days, then deleted automatically by a daily job |
| Your email address, when you sign in | To create and run your account: to send you the sign-in link, to keep you signed in, to hold your credits and the pages you have made, and to email you the files you buy | Performing our contract with you (Article 6(1)(b)), because the account is how we give you your free allowance, your credits and your pages. We also rely on our legitimate interests (Article 6(1)(f)) for the narrower purpose of stopping abuse: making sure one person cannot mint an unlimited number of free allowances, and capping how many sign-in emails can be sent to one address. | While your account is open, and for 12 months after you last sign in, after which the account is anonymised. If you ask for a sign-in link and never follow it, the empty account record is deleted within 7 days. |
| Sign-in links and sign-in sessions | To let you sign in without a password, and to keep you signed in on your device | Performing our contract with you (Article 6(1)(b)) | We never store the link or the session token itself, only a one-way (SHA-256) fingerprint of it. A sign-in link stops working after 15 minutes or one use. A session lasts 30 days, or until you sign out. We remove the expired records within 30 days after that. |
| Your credits, and the record of what you bought, were granted and spent | To show your balance, to stop a page being charged for twice, and to keep the accounting record of every sale | Performing our contract with you (Article 6(1)(b)), and complying with a legal obligation (Article 6(1)(c)) for the tax and accounting record | 6 years after the end of the financial year of the transaction, as UK tax and accounting law requires. This record survives a request to delete your account, for the reason explained in section 7. |
| The record of the pages you have made (which style, when you made it, when you unlocked it, and links to the generated pages) | So a signed-in customer can find their pages again, and so we can apply the daily free-preview allowance | Performing our contract with you (Article 6(1)(b)) | 30 days, alongside the pages themselves. This record never refers to the photograph you uploaded. |
| Your IP address | To apply the allowance on free previews for visitors who are not signed in, and to protect the service against abuse | Our legitimate interests in running a fair, secure service (Article 6(1)(f)) | Only for as long as needed to operate the daily limit and for short-lived security logs |
| The email address you give at checkout, your billing name and address, and your payment reference | To send your receipt, deliver your files, work out the country of supply for VAT, provide support, and handle any refund | Performing our contract with you (Article 6(1)(b)); complying with a legal obligation (Article 6(1)(c)) for the tax, VAT and accounting record | With our transaction records, kept for 6 years after the end of the financial year of your purchase, as UK tax and accounting law requires |
| Your subscription, if you take one (the customer and subscription references Stripe gives us, whether it is active, whether you have asked it to stop at the end of the month, and the date the current month ends) | To run your subscription: to know that you are entitled to the service, to add your 20 credits when each monthly payment succeeds, to show you your renewal date, and to stop billing when you cancel | Performing our contract with you (Article 6(1)(b)). Every part of this is needed to operate the subscription you asked for | While your subscription is live, and then with our transaction records for 6 years after the end of the financial year, as UK tax and accounting law requires |
| How the website is used (pages viewed, roughly where in the world the request came from, which site referred you, and whether an action such as making a page succeeded or failed) | To see whether the website is working, to find faults, and to understand where people get stuck. We use Vercel Web Analytics, which is cookieless: it sets nothing on your device, uses no advertising identifier, and does not track you across other websites | Our legitimate interests in running, securing and improving our own website (Article 6(1)(f)). We have considered your interests and consider this proportionate because it is aggregated, uses no cookies, and cannot be used to identify you | Aggregated and kept for up to 12 months |
| Automated content checks on uploaded images | To decline images that appear unlawful or that break our terms | Our legitimate interests in keeping the service lawful and safe (Article 6(1)(f)) | The check happens during processing; declined images are not kept |
We never see or store your card details. Payments are processed entirely by Stripe.
There are no passwords: we never ask for one, so we never hold one. There are no marketing lists, and we do not use your photos or your pages for anything other than providing the service to you.
We also measure how the website itself is used, so that we can tell whether it is working. This is described in the row below and in section 4. It uses no cookies and no advertising identifiers, and it does not build a profile of you or follow you to other websites. Separately, and only if you accept cookies on our banner, we process the consent-based advertising measurement described in section 4; rejecting cookies switches all of that advertising measurement off.
3. Your photo
Your photo may show you, your family or other people, so we treat it with particular care:
- It is not stored on our servers. It exists in our systems only while your page is being generated.
- It is transmitted once to our AI provider (see section 4), which processes it under a data processing agreement that restricts use of your image to providing the service.
- We do not use your photo to train AI models, for advertising, or for any purpose other than creating your colouring page.
- Only the generated black-and-white pages and watermarked previews are stored, and only for 30 days.
- The record we keep in your account of a page you have made holds the generated page and when you made it. It holds no copy of, and no reference to, the photograph it came from.
You are responsible for making sure you have the right to upload the photo, including the permission of anyone shown in it. See our Terms of Service.
4. Who we share data with
We share personal data only with the service providers (processors) we need to run PhotoSketch AI:
- AI image generation: OpenAI (United States). Your uploaded photo is sent to OpenAI's API platform, which processes it solely to generate your colouring page, under OpenAI's Data Processing Addendum. OpenAI does not use API content to train its models, and may retain API inputs for up to 30 days for abuse monitoring before deletion, per its published API terms.
- Payments: Stripe. Stripe collects your payment details, your email address and your billing name and address at checkout, and processes your payment. We receive confirmation of payment, your email address, your billing details and a payment reference, never your card details. Stripe's own privacy policy applies to the data it collects: https://stripe.com/privacy
- Hosting, file storage and website measurement: Vercel. The website is hosted by Vercel, and your generated pages and previews are stored on Vercel Blob storage located in Frankfurt, Germany (EU). Vercel also provides the cookieless Web Analytics described in section 2, which reports aggregated usage of the site itself and sets nothing on your device.
- Database hosting: Railway. Your account record, your credits and the record of the pages you have made are stored in a PostgreSQL database hosted by Railway in the Netherlands (EU). Railway hosts the database for us; it does not use the data for anything of its own.
- Email delivery: Resend. We use Resend to send transactional email: your sign-in link, and the email containing your download links after a purchase. Resend receives your email address and the content of that message. It is not used for marketing, because we do not send any.
- Advertising and analytics (only if you accept cookies): Meta and Google. If, and only if, you accept cookies on our banner, we use Meta (Pixel and Conversions API) and Google (Analytics and Ads, via Google Tag Manager) to measure and improve our advertising. They receive limited event data: which pages you view, the steps you take, and, when you buy, the order value and a one-way hashed (irreversible) version of your email so the purchase can be matched to an ad. We never send them your uploaded photo, your filename, your face, or your card details. Meta and Google process this data as independent controllers under their own policies (https://www.facebook.com/privacy/policy and https://policies.google.com/privacy), and as US-based providers rely on the UK Extension of the EU-US Data Privacy Framework, with standard contractual clauses and the UK IDTA as a fallback. If you reject cookies, none of this runs and none of your data reaches them.
We do not sell your personal data or share it with data brokers. The only advertising or analytics sharing we do is the consent-based measurement described in the bullet above, and only if you accept cookies. We may disclose data if the law requires it, for example to a court or regulator.
5. International transfers
Your generated pages and previews stay in the EU (Frankfurt, Germany). Your account record, your credits and the record of the pages you have made stay in the EU (Netherlands).
Your uploaded photo is transmitted to OpenAI in the United States so that your page can be generated. This is a restricted transfer under UK GDPR, and it is safeguarded by OpenAI's Data Processing Addendum, which incorporates legally recognised transfer mechanisms (the EU-US Data Privacy Framework including its UK Extension, or standard contractual clauses with the applicable UK addendum).
Your email address is transmitted to Resend in the United States when we send you a sign-in link or your download links, safeguarded by the standard contractual clauses and UK addendum in the Resend data processing agreement.
Stripe, Vercel and Railway are, or are owned by, companies based outside the UK and EEA, and may transfer limited personal data outside the UK or EEA in operating and supporting their services, even where the data itself is stored in the EU. Where they do, they rely on equivalent recognised safeguards. You can ask us for more information about these safeguards using the contact details below.
6. How long we keep data
- Uploaded photos: not stored. Gone once your page is generated.
- Generated pages and previews: deleted automatically 30 days after creation.
- The record in your account of a page you made: 30 days, alongside the page itself.
- Your account and email address: while your account is open, and for 12 months after you last sign in, then anonymised. An account record created by a sign-in request that was never completed is deleted within 7 days.
- Sign-in links: 15 minutes, or one use, whichever comes first. Sign-in sessions: 30 days, or until you sign out. The expired records are removed within 30 days after that.
- Rate-limiting and security data (IP addresses): kept only as long as needed to operate the daily preview limit and protect the service.
- Credits, purchase and payment records (email, billing name and address, payment reference, what was bought, what was spent): 6 years after the end of the financial year of the purchase, as required by UK tax law. These records do not include your photo or your pages.
- Subscription records (the Stripe customer and subscription references, the status, and the period dates): while the subscription is live, then with the transaction records above for 6 years after the end of the financial year, as required by UK tax law.
- Support emails: kept for as long as needed to resolve your query and for a reasonable period afterwards.
7. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Erase your data ("right to be forgotten")
- Restrict how we process your data
- Receive a copy of data you gave us in a portable format
- Object to processing based on our legitimate interests
To exercise any of these rights, email support@photosketchai.com. We respond within one month.
What erasure actually means here. If you ask us to delete your account, we replace your email address with a meaningless value, so nothing in our records points back to you, and we close every sign-in session and every unused sign-in link, so nothing can be signed in as you. The pages you generated are deleted on the normal 30-day cycle, so they are gone within 30 days of the day each one was made; if you want them removed sooner, say so and we will delete them straight away.
There is one thing we must keep. The record of what you paid, what you were charged and what you spent is part of our accounting records, and UK tax law requires us to keep those for six years. UK GDPR recognises this: the right to erasure does not apply where we need the data to comply with a legal obligation (Article 17(3)(b)). We keep that financial record, and we cut the link between it and your email address, so what remains is a transaction, not a named person. Stripe keeps its own copy of the payment for the same legal reason and for the same period.
One honest caveat: because we keep so little, there may be little or nothing else to find. If your pages are more than 30 days old they have already been deleted, and we cannot recover them or your photo. To locate a purchase record we may ask for the email address you used at checkout or your Stripe payment reference, so that we can find the right record and not disclose data to the wrong person.
8. Children
PhotoSketch AI is intended for adults. You must be at least 18 to create an account or to make a purchase. Parents and guardians may of course upload photos of their own children to make colouring pages; those photos are handled exactly as described in section 3.
9. Security
All traffic to and from the site is encrypted (HTTPS). We do not use passwords, so there is no password of yours for us to lose: we sign you in with a single-use link that expires in 15 minutes, and we store only a one-way fingerprint of that link and of your sign-in session, never the value itself. Your account records are held in a database in the EU that is reachable only by the application. Files are stored with a reputable EU-located provider and deleted on a fixed schedule. Payment security is handled by Stripe, a PCI DSS certified payment processor.
Anyone who can read your email can sign in as you, because that is how a sign-in link works. If you think someone else has access to your inbox, sign out and tell us at support@photosketchai.com.
No internet service can promise perfect security, but we deliberately minimise what we hold: the less we keep, the less there is to lose.
10. Complaints
If you are unhappy with how we handle your personal data, please contact us first at support@photosketchai.com and we will try to put it right.
You also have the right to complain to the UK supervisory authority, the Information Commissioner's Office (ICO): https://ico.org.uk or 0303 123 1113.
11. Changes to this policy
If we change this policy we will update this page and the date at the top. If a change materially affects how your data is handled, we will make that clear on the site.
12. Contact
COLEAI LIMITED (trading as PhotoSketch AI) 325-327 Oldfield Lane North, Greenford, Middlesex, UB6 0FX, United Kingdom Email: support@photosketchai.com