Privacy & Your Photos

We collect the minimum we need to run your color analysis and your account. Your photos are used to generate your result — never to train AI models, never sold, and never shown to other members unless you choose to post them to the community feed.

Account details (email, display name, password handled by our auth provider), the photos and links you submit to a tool, the results those tools generate, your membership and credit status, and anything you post publicly such as community posts, comments, and likes.

When you upload a photo, it is sent to our AI provider to produce your analysis or preview, then returned to you. We use the image only to fulfil that request and to show you your own history. We do not use your photos for advertising, do not sell them, and do not permit our AI provider to train models on them.

Our tools estimate coloring from a photo for styling purposes. They are not identity recognition and we do not build or store faceprints or other biometric identifiers.

Supabase (database, authentication, and file storage), our AI model provider (image and text analysis), Stripe (payments — they handle card details, we never receive them), and Shopify (product catalogue and checkout for physical products).

We keep account data while your account is open, and purchase records for as long as tax and accounting rules require. You can delete individual analyses and posts at any time from your dashboard. Photos you upload to a tool are held only so you can revisit your own history, and are removed when you delete the result or your account. Your dashboard has one-click controls to download everything we hold on you and to permanently delete your account — no email or waiting required. Purchase records we're legally required to keep are retained in anonymised form.

Artists who apply for a Verified badge upload a photo or PDF of their professional licence, with their consent, so we can confirm they hold it. The document is stored in private, access-controlled storage — never shown on a profile or shared with members. An automated check (Google Gemini, via the Lovable AI gateway) reads the document once and compares it with the details the artist typed in; it is not used to train any model. If the name, licence number and issuing authority match, the badge is granted automatically. Anything else is reviewed by a member of our team, and an artist can always ask for a human review or contest a decision by contacting us.

The document itself is deleted as soon as a decision is made, and any undecided upload is deleted after 30 days. We keep only the licence details the artist typed in, the outcome, and the date — which is what we need to stand behind the badge.

Depending on where you live — including California, other US states with privacy laws, the UK, and the EU — you can ask for a copy of your data, ask us to correct or delete it, and opt out of any sale or sharing of personal information. We do not sell or share personal information for cross-context behavioural advertising. To make a request, use the Download my data and Delete my account controls in your dashboard, or contact us and we'll respond within the timeframe the law requires.

Notice at collection: we collect identifiers (name, email), account and purchase records, content you create (posts, comments), and photos you choose to upload. Photos and any coloring characteristics inferred from them are treated as sensitive personal information. We use them only to deliver the tool you asked for, keep your history, run your account and payments, and keep the service secure — never to infer characteristics for advertising.

We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of under "Do Not Sell or Share My Personal Information." We do not use or disclose sensitive personal information beyond the purposes permitted by CPRA, so no limitation right applies.

California residents have the right to know, access, correct, delete, and to be free from discrimination for exercising those rights. Use the Download my data and Delete my account controls in your dashboard, or contact us — you may also use an authorised agent. We keep each category only as long as described in "Keeping and deleting" above.

We use only the cookies and local storage needed to keep you signed in, remember your cart, remember that you've agreed to have your photos analyzed, and keep the site secure. We don't run third-party advertising trackers, and there is no cross-site profiling to opt out of.

Color Lab isn't intended for children under 16. If you believe a child has created an account, contact us and we'll remove it.