PaletteKit Back

Privacy Policy

Last updated: April 16, 2026

1. Who we are

PaletteKit is a color palette generation tool operated by Fabrice Randrianaivo. Contact: fabricerandrianaivo8@gmail.com

2. Data we collect

  • Account data: email address, authentication provider (Google, GitHub, or email/password).
  • Usage data: palettes generated, generation count, favorites, plan type.
  • Uploaded images: screenshots uploaded for AI analysis are processed in memory and not permanently stored.
  • Payment data: handled entirely by Stripe. We never see or store your credit card information.
  • Analytics: Vercel Analytics collects anonymous usage metrics (page views, performance). No personal data.

3. How we use your data

  • Provide and improve the PaletteKit service.
  • Save your generated palettes and preferences.
  • Process payments via Stripe.
  • Send transactional emails (account confirmation, password reset).
  • We do NOT sell your data to third parties.

4. Third-party services

  • Supabase (database, authentication) — EU hosted, GDPR compliant.
  • Stripe (payments) — PCI DSS Level 1 compliant.
  • Vercel (hosting, analytics) — GDPR compliant.
  • Anthropic (AI analysis, Pro feature) — images processed per their privacy policy.
  • Google / GitHub (OAuth login) — only email and profile name are accessed.

5. Cookies

We use essential cookies for authentication (session tokens). We use Vercel Analytics which may set anonymous performance cookies. No advertising cookies are used. You can manage cookies via our cookie banner or your browser settings.

6. Your rights (GDPR)

If you are in the EU, you have the right to:

  • Access your personal data.
  • Rectify inaccurate data.
  • Delete your account and all associated data.
  • Export your data in a portable format.
  • Object to or restrict processing.

To exercise these rights, email us at fabricerandrianaivo8@gmail.com.

7. Data retention

Account data is retained until you delete your account. Generated palettes are retained for 12 months of inactivity, then automatically deleted. Payment records are retained as required by law (typically 7 years).

8. Security

All data is encrypted in transit (TLS) and at rest. Authentication tokens are stored as HTTP-only cookies. We follow industry best practices for application security.

9. Changes

We may update this policy. Significant changes will be notified via email or in-app notification. Continued use after changes constitutes acceptance.

10. Contact

Questions? Email us at fabricerandrianaivo8@gmail.com.