Skip to content
Test version, no real money is charged. Test card 4242 4242 4242 4242, any future date, any CVC.

Privacy policy

Draft. This text will be legally reviewed before launch. This is a translation for your convenience; only the German version is legally binding.

1. Who is responsible?

Manuela Küpper, wowpapy
Ringstraße 17, 56237 Nauort, Germany
Email: bestellung@wowpapy.com

We are not required to appoint a data protection officer. If you have questions about data protection, just write to the address above.

2. The most important points

  • We only use your photos to turn them into coloring pages. We delete the photos right afterwards.
  • For the conversion we send the photo to OpenAI. OpenAI does not use it to train its AI.
  • Payment is handled by Stripe. We never see your card details.
  • We only set advertising cookies and pixels (Meta, TikTok, Pinterest, Google, Snapchat, Reddit, Microsoft) if you agree in the cookie banner. You can change your consent at any time via “Cookies” at the bottom of every page.

3. Legal bases

We process personal data on these legal bases of the GDPR:

  • Contract (Art. 6(1)(b)): designing, ordering, paying for, printing and shipping your book.
  • Legal obligation (Art. 6(1)(c)): invoices and accounting under tax and commercial law.
  • Legitimate interest (Art. 6(1)(f)): secure operation of the website, abuse prevention, anonymous analysis of which ad campaign leads to orders.
  • Consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG): advertising cookies, pixels and passing events to advertising partners.

4. Hosting and server log files

Our website is hosted by ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. We have a data processing agreement with ALL-INKL (Art. 28 GDPR).

With every visit the server stores technical data: IP address, date and time, page visited, referrer, browser and operating system. We need this for the website to work and stay secure (Art. 6(1)(f)). The log files are deleted after a short time.

5. Designing a coloring book: photos, name, coloring pages

When you design a book, we process the name you write on the cover, optionally a gender (to address your child correctly in the book) and the photos you upload. The photos often show children. Please only upload photos you are allowed to use for this; for photos of children you need the consent of their legal guardians.

  • Photos: we store them only briefly to create a coloring page and delete them right afterwards.
  • Coloring pages without an order: are deleted automatically after 7 days.
  • Coloring pages of an order: we keep them until your book is printed and delivered and any complaints are settled.

The legal basis is the performance of the contract or pre-contractual steps (Art. 6(1)(b)).

Conversion by OpenAI

To turn your photo into a coloring page, we send it to the image API of OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. OpenAI acts as our processor. According to OpenAI, data from the API is not used for training and is stored for up to 30 days for abuse monitoring. Data may also be processed in the USA, based on the EU standard contractual clauses (Art. 46 GDPR).

6. Order, payment, printing and shipping

For your order we process name, email address, billing and shipping address, order contents, amount and payment status (Art. 6(1)(b)).

Payment via Stripe: payment is processed by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. You enter your payment details directly with Stripe; we only receive payment status, name, email and address. Stripe processes the payment for us but is itself responsible for its own purposes such as fraud prevention and legal obligations. Transfers to the USA are covered by the EU-US Data Privacy Framework (Stripe, LLC is certified). Stripe’s privacy policy: stripe.com/privacy.

Printing and shipping: to print and send your book, we pass the print files, your name and the shipping address to our print partner in Germany and, depending on the shipping method, to the carrier.

Emails: we send the order confirmation, invoice and shipping information by email via our server at ALL-INKL.

Retention: we keep invoices and accounting vouchers for 8 years, books and records for 10 years (§ 147 AO, § 257 HGB). The period starts at the end of the calendar year. After that we delete the data.

7. Cookies and consent

For the cookie banner we use the WordPress plugin CookieYes in its local version. Your choice is stored only with us, in the cookie cookieyes-consent (1 year). The cookie pll_language for your chosen language is also technically necessary. We set necessary cookies without consent (§ 25(2) no. 2 TDDDG).

All other cookies and pixels listed in section 8 only load once you agree to the “Advertising” category. You can withdraw your consent at any time via “Cookies” at the bottom of every page; the withdrawal applies to the future. A current list of all cookies and their duration is available there too.

8. Advertising and measurement (only with consent)

We advertise on social networks and search engines. To measure which ads work and to show relevant ads, we use the pixels or tags of our advertising partners, only after your consent. Events such as page view, viewing a book, starting the design, starting checkout and purchase (with order value and order number) are transmitted, together with IP address, browser data and cookie or click IDs.

We also send these events from our server directly to the partners (so-called conversion APIs). For a purchase we only transmit your email address, name and place of residence as an encrypted checksum (SHA-256 hash), so the partner can attribute the purchase to its ad. Without your consent none of these transfers take place.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Some partners also process data in the USA and other countries. Where a partner is certified under the EU-US Data Privacy Framework, this is stated; otherwise standard contractual clauses apply. We only use partners that are actually active.

Meta (Facebook, Instagram)

Meta Pixel and Conversions API of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. We and Meta are joint controllers for collecting and transmitting the data to Meta (Art. 26 GDPR); the agreement: facebook.com/legal/controller_addendum. Meta alone is responsible for further processing. Transfer to the USA: Meta Platforms, Inc. is certified under the Data Privacy Framework. Privacy policy: facebook.com/privacy/policy. Cookies: _fbp, _fbc.

TikTok

TikTok Pixel and Events API. For users in the EEA, TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, and TikTok Information Technologies UK Limited, Kaleidoscope, 4 Lindsey Street, London EC1A 9HP, United Kingdom, are responsible. TikTok stores data in the USA, Malaysia and Singapore among others and grants group companies, including in China, limited remote access, based on standard contractual clauses. Privacy policy: tiktok.com/legal/page/eea/privacy-policy. Cookies: _ttp, _wpt_ttclid.

Pinterest

Pinterest Tag and Conversions API of Pinterest Europe Ltd., Waterloo Exchange, 3rd Floor, Waterloo Road, Dublin 4, Ireland. Transfer to the USA: Pinterest, Inc. is certified under the Data Privacy Framework. Privacy policy: policy.pinterest.com/privacy-policy. Cookie: _epik.

Google Ads

Google Ads conversion tracking with enhanced conversions of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use Google Consent Mode: without your consent Google sets no advertising cookies. For a purchase we transmit your email address as a hash. Transfer to the USA: Google LLC is certified under the Data Privacy Framework. Privacy policy: policies.google.com/privacy. Cookie: _gcl_aw.

Snapchat

Snap Pixel and Conversions API of Snap Inc., USA; its representative in the EU is Snap B.V., Keizersgracht 165, 1016 DP Amsterdam, Netherlands. Snap Inc. is certified under the Data Privacy Framework. Privacy policy: values.snap.com/privacy. Cookies: _scid, _wpt_sccid.

Reddit

Reddit Pixel and Conversions API of Reddit, Inc., USA. Reddit, Inc. is certified under the Data Privacy Framework. Privacy policy: reddit.com/policies/privacy-policy. Cookies: _rdt_uuid, _wpt_rdtcid.

Microsoft Advertising (Bing)

UET tag and UET Conversions API of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. Microsoft processes the UET data under its own responsibility. Transfer to the USA: Microsoft Corporation is certified under the Data Privacy Framework. Privacy statement: privacy.microsoft.com/privacystatement. Cookies: _uetsid, _uetvid, _uetmsclkid.

Our own identifier

With your consent we set the cookie _wpt_vid (13 months) with a random identifier. It lets us match events from your browser and from our server so partners don’t count anything twice.

9. Anonymous campaign analysis (without cookies)

Links in our ads contain campaign details (e.g. campaign and ad name). If you order, we store these details with the order to see which ad led to orders. We set no cookies for this, store nothing on your device and send nothing to advertising partners. The legal basis is our legitimate interest in the cost-effectiveness of our advertising (Art. 6(1)(f)).

10. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)). Just send us an email.

You can also lodge a complaint with a data protection supervisory authority. The authority responsible for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz, Germany, poststelle@datenschutz.rlp.de.

11. Obligation to provide data

For an order we need name, email and shipping address, otherwise we cannot deliver the book. All consents are voluntary; the shop also works without them.

As of October 2026