Privacy Policy

1. Responsible Party

The party responsible for data processing on this website is:

2. General Information on Data Processing

We take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

The use of our website is generally possible without providing personal data. Where personal data is collected on our pages, this is always done on a voluntary basis. We pass data on to third parties only as described in this policy – to our payment service provider (section 7) and for image generation (section 7c) – or where we are legally obliged to do so.

The legal basis for the processing of personal data is the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

3. Server Log Files

The hosting provider of this website automatically collects and stores information in so-called server log files, which your browser automatically transmits. These are:

• Browser type and browser version
• Operating system used
• Referrer URL
• Hostname of the accessing computer
• Time of the server request
• IP address

This data cannot be attributed to specific individuals. This data is not merged with other data sources. The data is deleted after statistical evaluation. The legal basis is Art. 6(1)(f) GDPR (legitimate interest).

4. Cookies and localStorage

Our website uses cookies and your browser's localStorage technology. Cookies are small text files that are stored on your device. localStorage is a browser storage mechanism that allows data to be stored locally.

We use the following types of cookies and localStorage:

• Technically necessary cookies: These are required for the operation of the website: wimolino_session keeps your session (such as your login) together, XSRF-TOKEN protects forms against misuse by other sites – both expire after 2 hours of inactivity. If you choose “Remember me” when logging in, or sign in with Google, remember_web_… is added (400 days or until you log out). For each session we store the IP address and browser identification on our server; expired sessions are deleted automatically.
• Analytics cookies: Only with your consent, our self-hosted web analytics Matomo sets its cookies (section 5).
• localStorage: In your browser's localStorage we store your cookie choice as well as game progress and game settings (such as sound). If you choose “Don’t show again” on a hint about bookmarks or app installation, we remember that for twelve months. We do not count visits or page views for these hints. This data stays on your device and is not transmitted to us; you can delete it via your browser settings.

You can configure your browser to inform you about the use of cookies so that you can decide on a case-by-case basis whether to accept or reject a cookie. The legal basis for technically necessary cookies is Art. 6(1)(f) GDPR, for all other cookies Art. 6(1)(a) GDPR (consent).

5. Web analytics with Matomo

We use the software Matomo (version 5) to measure reach and to improve our offering, and only if you select “Accept all” in our cookie banner. We operate Matomo ourselves on a server of Provimedia GmbH; requests run through our own domain (path /mtm/). The data is not passed on to third parties.

We record the pages you open (without search terms, access links or other details from the address bar), clicks on the purchase buttons of the premium page, completed registrations and purchases with their amount (without payment details), how far blog articles are read, whether a search returned no results, and technical error messages from scripts. Matomo does not record what you type into forms or the search.

After you consent, Matomo sets the cookies _pk_id to recognise your browser (13 months) and _pk_ses to assign your session (30 minutes), and, if you come to us from another website, _pk_ref for that origin (6 months); to check whether your browser accepts cookies, briefly _pk_testcookie, which expires immediately. Without consent, Matomo sends no data and sets no cookies. IP addresses are stored only in anonymised (shortened) form. We respect the “Do Not Track” setting of your browser. We delete individual visits (raw data) after 365 days; summarised reports without personal reference remain.

The legal basis is Section 25(1) TDDDG and Art. 6(1)(a) GDPR (consent).

5a. Links to Amazon

In our "Gift Ideas" section we link to product pages on Amazon (amazon.de). These links are ordinary references: no content, scripts or cookies from Amazon are loaded when you visit our pages, and we receive no payment for the links.

Only when you click such a link do you leave our website. Your browser then tells Amazon that you came from "wimolino.com", but not which page you came from. What data Amazon processes afterwards is Amazon's responsibility; details can be found in Amazon's privacy policy.

6. Your consent and how to withdraw it

On our website, only the web analytics with Matomo (section 5) requires consent. We do not use advertising or analytics services from Google or other third parties. Where children use our pages, consent should be given by a parent.

You can withdraw your consent at any time with effect for the future. The lawfulness of processing carried out until the withdrawal remains unaffected. Via “Cookie settings” in the page footer or the button below you reopen the cookie banner; choosing “Only necessary” withdraws your consent. Matomo then deletes its cookies and instead sets the cookie mtm_consent_removed, which only records that you have withdrawn, so that your browser is no longer counted (up to 30 years; many browsers delete it sooner).

Open cookie settings

7. Payment Processing (Stripe)

For processing our paid Premium subscriptions we use the payment service provider Stripe Inc., 510 Townsend Street, San Francisco, CA 94103, USA ("Stripe").

During payment processing, the payment data you enter (e.g., credit card number, expiration date, CVV) is transmitted directly to Stripe. We ourselves do not have access to your complete payment data. Stripe processes this data on our behalf for payment processing. In our own system we only store a Stripe customer identifier plus the status and end date of your subscription.

Further information can be found in Stripe's Privacy Policy. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

7a. Withdrawal declarations

If you withdraw from a contract using our withdrawal function, we store your name, the contract reference you provide, your email address, any reason you voluntarily give, the time of receipt as well as your IP address and browser identification.

Name, contract reference, email address and time of receipt are required by law (section 356a German Civil Code) and at the same time serve as proof that and when your declaration was received. The legal basis is Art. 6(1)(c) GDPR (legal obligation) in conjunction with Art. 6(1)(b) GDPR.

We store the IP address and browser identification because the withdrawal form is accessible without a login and we must be able to detect abuse. The legal basis is Art. 6(1)(f) GDPR (legitimate interest). We delete these two items after 90 days; the remaining data is kept for the duration of the statutory commercial and tax retention periods.

7b. User account and sign-in with Google

Some features (such as saved pictures, children’s profiles and Premium) require a user account. When you register, we store your name, your email address, your password (only as a hash, never in plain text) and the language you chose. In your profile you may voluntarily add your address and phone number.

If you use the Google button to sign in or sign up, your browser takes you to Google; Google thereby learns that you are signing in to Wimolino. After you confirm there, we receive from Google your name, your email address, your Google ID and the address of your profile picture, and store them in your account. We do not receive your Google password. While you are signed in, your browser loads the profile picture directly from a Google server; Google receives your IP address in the process. When you sign in with Google, we set the cookie remember_web_… (section 4) so that you stay signed in.

In your account we also store what you create and use there: children’s profiles (nickname, avatar, points and streaks), colored pictures, game progress and points, coloring pages you generated (section 7c) and coloring books (including the name you enter for the cover), as well as the status of your subscription (section 7).

Before you use the AI generator, you confirm that you are an adult; if you register with our form, this happens as part of the registration. We store the time of this confirmation in your account.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract). We store this data for as long as your account exists. You can have your account deleted at any time – an email to info@provimedia.de is sufficient. You can also delete your account at any time yourself: in your profile under “Delete account”, confirmed via a link we send to the email address stored in the account; while a paid Premium subscription is running, this is only possible by emailing us. We delete it without undue delay, within one month at the latest, and permanently: account, children’s profiles, saved progress, generated pictures and coloring books. If a Premium subscription is still running, we cancel it before the deletion. Only data we are required to keep or need as evidence is retained: invoices and payment data held by our payment provider Stripe in line with statutory retention obligations, and withdrawal declarations remain as evidence (section 7a).

We back up our database daily. A deleted account remains in these backup copies for no longer than 30 days; after that the copies are deleted. The same applies to other data we delete after the periods stated here (such as the per-IP count): after deletion it remains in the copies for no longer than 30 days. If we ever have to restore a backup, we delete the accounts it still contains that had already been deleted.

7c. Coloring pages with AI

With our generator you can have a coloring page created from a description or from a photo. It is available only to signed-in adults who have confirmed that they are of age (section 7b). To do this, we send your description or your downsized photo to Google’s Gemini interface (API), which creates the picture from it. The same applies to the theme you enter for a coloring book. We do not send your name, your email address or your IP address along with it.

Google processes this content on our behalf. Under Google’s terms for the paid use of the interface, which is what we use, Google does not use descriptions, photos or results to improve its own products; to detect abuse, Google logs them for a limited period. Processing may also take place outside the European Union, in particular in the USA; for this Google relies on the EU-US Data Privacy Framework and on standard contractual clauses. Google’s data processing terms, which contain these safeguards, are available at business.safety.google/processorterms.

We process your photo only for the conversion. Depending on the process it is either not stored on our server at all or only briefly, and it is deleted immediately after the conversion, after three days at the latest. We store the generated coloring page and your description in your gallery for as long as your account exists; on request we delete individual pictures earlier. Pictures that were generated without a user account before 6 October 2026 are deleted together with their description after 30 days.

To limit abuse and costs, for free use we count how many pictures are generated per account and day, and additionally how many per IP address and day. We delete the entries per IP address after 7 days.

The legal basis for image generation is Art. 6(1)(b) GDPR (providing the service you requested); for the limit per IP address it is Art. 6(1)(f) GDPR (legitimate interest in protection against abuse).

Please upload photos showing other people only with their consent – for children, with that of their parents.

8. Newsletter

If you wish to receive the newsletter offered on the website, we require an email address from you. We use the double opt-in procedure, meaning we will send you a confirmation email after your registration.

Your email address will be used exclusively for sending the newsletter. You can unsubscribe from the newsletter at any time using the unsubscribe link in each newsletter email. The legal basis is Art. 6(1)(a) GDPR (consent).

9. Children's Privacy

Our website is also directed at children. We take the protection of children's data very seriously. We do not knowingly collect personal data from children under 16 years of age without the consent of a parent or legal guardian.

Our "Gift Ideas" section is aimed at parents and other adults looking for a present for a child. It contains links to Amazon (see section 5a); children should only use these links together with an adult.

The use of our free coloring pages is possible without registration and without providing personal data. If we discover that we have received personal data from children under 16 without verifiable parental consent, we will delete this data immediately.

We recommend that parents supervise their children's online activities and discuss safe internet usage with them.

10. Your Rights

You have the following rights with respect to the personal data concerning you:

• Right of access (Art. 15 GDPR): You have the right to obtain information about the personal data we store about you.
• Right to rectification (Art. 16 GDPR): You have the right to have inaccurate data corrected.
• Right to erasure (Art. 17 GDPR): You have the right to request the deletion of your personal data, provided there are no legal retention obligations.
• Right to restriction of processing (Art. 18 GDPR): You have the right to request the restriction of processing of your data.
• Right to data portability (Art. 20 GDPR): You have the right to receive your data in a structured, commonly used, and machine-readable format.
• Right to object (Art. 21 GDPR): You have the right to object to the processing of your personal data at any time.
• Right to withdraw consent (Art. 7(3) GDPR): You have the right to withdraw any consent given at any time.
• Right to lodge a complaint (Art. 77 GDPR): You have the right to lodge a complaint with a supervisory authority if you believe that the processing of your data violates the GDPR.

11. Cookie Policy

When you first visit our website, we display a cookie banner. There you can choose whether to accept all cookies or only the technically necessary ones. Your decision is stored in your browser's localStorage and taken into account for future visits.

If you choose “Accept all”, our web analytics Matomo additionally sets its cookies (section 5). If you choose “Only necessary”, only technically required cookies are set. We never transmit data for advertising purposes.

You can change your choice at any time via “Cookie settings” in the page footer (section 6).

12. Contact for Data Protection Inquiries

For questions regarding data protection or to exercise your rights, please contact:

13. Changes to This Privacy Policy

We reserve the right to change this privacy policy to adapt it to changed legal situations or to changes in the service and data processing. The current version published on our website always applies.

Last updated: October 2026