Privacy Policy

1. Who We Are

PaintGuide.ai is operated by David Emery (“PaintGuide,” “we,” “us,” or “our”). When we say “you” or “your,” we mean you as a user of our service. This policy explains what we collect, why, how we handle it, and the rights you have over it.

We are the data controller for the personal information described here. For any privacy request or question, contact us at support@paintguide.ai.

2. What We Collect

We collect the following information:

• Account information — your email address and a hashed password when you sign up, or your name and email address if you sign in with Google
• Paint collection — which paints you mark as owned in your Paint Rack
• Uploaded photos — reference photos of your miniature and photos of your paints that you upload for AI analysis (see Section 4)
• Generated guides — the painting guides you create, including the text descriptions you provide
• Course progress — which lessons you've completed
• Payment information — your subscription tier and billing status. Payments are processed by Stripe; your full card number never touches our servers
• Usage & diagnostic data — pages visited and features used (via Vercel Analytics, which is anonymous and cookie-free), plus error reports and session diagnostics if something breaks (via Sentry — see Section 5)

3. How We Use Your Data & Lawful Basis

We use your data only for the purposes below. For users in the EU/UK, the applicable lawful basis under the GDPR is shown in brackets.

• To provide the service — generating personalized painting guides from your paint collection and uploaded photos [performance of a contract]
• To save your guides, paint collection, and course progress so they persist across sessions [performance of a contract]
• To process payments and manage your subscription [performance of a contract]
• To keep the service secure, working, and reliable — diagnosing errors and preventing abuse [legitimate interests]
• To understand and improve the service through anonymized, aggregated usage patterns [legitimate interests]
• To contact you about your account, such as password resets and important service updates [performance of a contract / legitimate interests]
• To send marketing emails only where you have opted in [consent]

We do not sell your personal information, and we do not use it for automated decision-making that produces legal or similarly significant effects.

4. Uploaded Photos

When you upload a photo of your miniature or your paints, the image is sent to our AI provider, Anthropic (Claude), to analyze it and generate your painting guide or detect your paints. We do not store your uploaded photos in our own database — only the resulting guide text and the paints you choose to keep are saved to your account.

Images processed through Anthropic's API are subject to Anthropic's own retention and privacy terms. We do not use your uploaded photos for advertising, model training, or any purpose other than generating your guide or detecting your paints.

5. Third-Party Processors

We rely on the following service providers (“processors”) to operate PaintGuide.ai. We share only the minimum data each one needs to perform its function:

• Supabase — database, authentication, and account storage
• Anthropic (Claude) — AI analysis of your uploaded photos to generate guides and detect paints
• Stripe — payment and subscription processing (PCI-compliant; handles your card data directly)
• Vercel — hosting and anonymous, cookie-free analytics
• Sentry — error monitoring and session diagnostics, which may capture a diagnostic replay of your interaction with a page when an error occurs, to help us fix bugs
• Google — OAuth sign-in, if you choose to sign in with Google
• RevenueCat — subscription management for our mobile app only (not used on the website)

Each processor has its own privacy policy governing the data it handles on our behalf.

6. Data Retention

We keep your account data — email, paint collection, generated guides, and course progress — for as long as your account is active, so your work remains available to you. Uploaded photos are not retained in our database beyond the moment they are analyzed (see Section 4). Payment and subscription records are retained by Stripe and by us as required for billing, tax, and legal compliance. When you ask us to delete your account, we remove your personal data from our systems within 30 days, except where we are legally required to retain certain records.

7. Your Rights (GDPR)

If you are in the EU, UK, or a similar jurisdiction, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your data (“right to be forgotten”)
• Restrict or object to certain processing
• Receive a portable copy of your data
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with your local data protection authority

To exercise any of these rights, email support@paintguide.ai. We will respond within the time required by law (generally within one month). You can delete your account and all associated data yourself at any time from Settings → Delete account; email remains available as a fallback and for data-access or export requests.

8. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect and how we use it (described above)
• Request access to, or deletion of, your personal information
• Correct inaccurate personal information
• Not be discriminated against for exercising your privacy rights

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the preceding 12 months. To exercise your California rights, email support@paintguide.ai.

9. Data Security

We use industry-standard security measures including encrypted connections (HTTPS), secure authentication (Supabase Auth), and PCI-compliant payment processing (Stripe). Your password is hashed and never stored in plain text. No method of transmission or storage is perfectly secure, but we work to protect your data using reasonable safeguards.

10. Cookies

We use essential cookies only — primarily to keep you signed in (authentication). We do not use advertising or cross-site tracking cookies. Vercel Analytics is cookie-free and privacy-friendly. Because we only use strictly necessary cookies, we do not display a cookie consent banner.

11. International Transfers

Our processors may store or process data in the United States and other countries. Where personal data is transferred out of the EU/UK, our processors rely on recognized safeguards such as Standard Contractual Clauses to protect it.

12. Children

PaintGuide.ai is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us at support@paintguide.ai and we will delete it.

13. Changes

We may update this privacy policy from time to time. If we make significant changes, we will notify you by email or by posting a notice on the site. Your continued use of PaintGuide.ai after changes take effect constitutes acceptance of the updated policy.