Color Pop

GDPR overview

GDPR implementation is concrete and documented. The privacy policy, last updated on 20 April 2026, names MWM as data controller under the GDPR and as a Business under the CCPA, identifies it as a French SAS registered in Nanterre under number 513 627 299, and gives its registered address. A data protection officer is designated and reachable at dpo@mwm.io; rights are exercised at privacy@mwm.io with proof of identity, or by post. The listed rights cover access, rectification, erasure, restriction, portability, objection, post-mortem instructions and withdrawal of consent, with a right to complain to the CNIL. Transfers outside the EEA rely on standard contractual clauses, adequacy decisions or binding corporate rules, and EU and UK consent is collected through a TCF v2.2 consent management platform. No Article 27 representative is named, which is expected for an EU-established company.

Who owns the data?

MWM states plainly that it does not claim ownership of user content. In exchange, using the app grants MWM a worldwide, royalty-free, non-exclusive licence to reproduce that content for the whole term of copyright, both to share it with other users inside the app and to promote the app and the wider MWM ecosystem on any channel. Content generated by the AI is treated separately and more broadly still: MWM is simply free to use and reproduce it. Where a picture shows the user, MWM may also use their likeness for promotion. Crucially, this licence survives account deletion, and derivative works made by other members remain in circulation.

Reuse rights

Between users, reuse is permitted but strictly non-commercial. Publishing a creation authorises other members to republish, adapt, modify and build derivative works from it inside the app, or to download it for their own private use; no member may put another member's work, or anything derived from it, to commercial use without prior written consent. The same logic governs the publisher's own catalogue: MWM grants a personal, non-exclusive right to use, adapt and create derivative works from its content within the app, or to download it for private, non-commercial use. Printed coloring pages may be used at home, shared with family and friends, and used in classrooms and educational settings. What is refused without written authorisation from MWM: redistributing or reselling templates in digital form, packaging them into commercial products such as books or merchandise, using them to train AI models or for data mining, and stripping copyright notices or watermarks.

Data retention & training

Hosting summary

Hosting is the least transparent part of the documentation. No country and no region are named anywhere: the privacy policy says only that personal data may be processed and stored at MWM premises and on its service providers' servers. Transfers outside the European Economic Area are contemplated and are said to rest on appropriate safeguards — standard contractual clauses adopted by the European Commission, adequacy decisions, or binding corporate rules. AI-powered features may add further transfers, since the providers processing prompts and uploaded content can sit outside the user's country of residence, including outside the EEA and the UK. Stated security measures are access limitation, firewalls, encryption and de-identification or anonymisation procedures. One practical detail: creations are only stored in the cloud once the account's email address has been verified; otherwise they remain on the device. The website's own IP address resolves to an anycast content-delivery node and says nothing about where user data actually lives.