Privacy Policy

• Your photo — the selfie you upload for color analysis, and any photo you upload for the try-on studio (plus the try-on images we generate from them, which we treat exactly like your photo).
• Your quiz answers — eye color, hair color, and style preferences.
• Your email — to deliver your report.
• Purchase records — handled by Stripe; we never see or store your card number.
• Technical & security data — your IP address and browser user-agent, recorded when you purchase or upload a photo. We use these to run the service securely, prevent fraud, and defend against payment disputes (chargebacks). The ones recorded at purchase are also sent to Meta for advertising measurement, as described under Service providers.

• Your photo is analyzed on our servers to extract skin, hair and eye colors — the analysis output is a set of color values and scores, not an image.
• It is stored encrypted (AES-256-GCM), with location metadata (EXIF) removed on upload, and is accessible only to you.
• We never create or store a face template, never use your photo to identify you, never match faces across users, and never sell your photo. The only company we send it to is Google, and only when you ask for a try-on look in the studio (see Service providers).

Retention & destruction schedule: each uploaded photo is scheduled for destruction 29 days after upload, and an automated purge job that runs every six hours permanently deletes it, so no photo is kept longer than 30 days. Try-on images expire with the photo they were made from. If a deletion fails, the job retries it on its next run. Derived results (your season and palette) contain no photo or biometric data and are kept with your report.

You can also delete your photo (and any try-on images) immediately, any time, with the “Delete my photo now” control on your report page. Deletion permanently removes the encrypted photo and try-on image files. Your request is saved before we start, so if the deletion doesn’t finish right away, our scheduled purge (every six hours) keeps retrying it. We keep a short record of each deleted file, with no image in it: its upload, deletion-request and deletion dates, its type (selfie or try-on photo), its pixel dimensions, its file reference and, for try-on images, the color and label you tried. The IP address recorded with the upload is erased at deletion.

The only photo-related content that survives past 30 days is your derived result: season name, palette color values, and the written report. None of that contains your photo or any biometric identifier. Other records stay too, and none of them contain an image: the short record of each deleted photo described above, the record of your photo consent (its version and time), your account and email address, and your order and receipt records.

The IP address recorded with a photo upload is deleted together with the photo. The IP recorded with a purchase stays with your order and receipt records, which we keep for fraud protection, payment-dispute defense, and accounting.

Some states regulate “biometric identifiers.” We design for the strictest reading: we collect your photo only with your explicit written consent (recorded with a version and timestamp), we publish this retention/destruction schedule, we destroy photos within 30 days or sooner at your request, and we never create face geometry templates or perform face matching. Consent is enforced on our servers at every endpoint that touches photo data — not just in the interface.

We use these providers to run Palettewell:

• Supabase: encrypted photo storage and our database.
• Vercel: hosting and privacy-friendly page analytics.
• Stripe: payments.
• Google (Gemini API): makes the try-on looks you request in the studio, from your photo (details below).
• Anthropic: writes the text of your report from your computed season, palette and quiz answers. It never receives your photo, name or email address.
• Postmark: sends our emails, so it receives your email address.
• Sentry: error monitoring. Before an error report is sent we remove cookies, request headers and request bodies, image data and private report links, and keep only your account ID rather than your name or email. An error message itself can still contain an email address or IP address. Reports never include your photo.
• Meta and Google: advertising measurement (details below).

Payment, analytics, advertising, email and error-monitoring providers never receive your photo.

Page analytics and advertising tags run across our site, including the quiz, checkout and studio pages. They are switched off on your report pages, so the private link to your report is never shared with an analytics or advertising provider.

On your first visit we note the page you landed on and the name of the site that sent you (for example, google.com), in our own pw_land and pw_ref cookies for 30 days. If you buy, we save both with your order so we can tell which pages bring customers. They stay with us and are not sent to an advertising provider.

If you reach us from an ad and then buy, we tell Meta and Google that the purchase happened, so we can tell which ads are worth running. Both messages contain the amount, the currency and an order reference. Google’s tag in your browser also sends a scrambled (SHA-256 hashed) copy of your email address, hashed by the tag before it is sent. Our server sends Meta the purchase too, with a copy of your email address that our server hashes before sending, plus your IP address and browser user-agent from the purchase and Meta’s browser and ad-click cookie identifiers (the _fbp and _fbc cookies) if your browser has them. Meta uses these to match the purchase to the ad you clicked. We never send your photo, your color result, or anything derived from your photo to an advertising provider.

Global Privacy Control. We honor Global Privacy Control when your browser sends it. For that browser, the Meta and Google advertising tags don’t load, and our server doesn’t send Meta your purchase or the details above. Page analytics (Vercel Analytics) still runs, and your purchase, report and email work as usual.

When you request a try-on look in the studio, your photo is sent to Google (Gemini API) to make that look, and the result is stored encrypted and deleted with the photo it was made from. We send one look at a time, never your name or account details alongside it. Google processes and keeps the request under its Gemini API terms. We ask for your consent to this before the first try-on, including for a photo you uploaded before we asked. If you delete your photo, there is nothing left for us to send.

Palettewell provides style and color guidance for fun and confidence. It is not a medical, dermatological, or diagnostic service.

If a breach affects your private information and you live in New York, we will notify you as New York General Business Law § 899-aa (the SHIELD Act) requires — in the most expedient time possible and without unreasonable delay, and no later than 30 days after the breach is discovered, unless a law-enforcement agency determines that notice would impede a criminal investigation. Wherever you live, we will also notify you as other state and federal breach-notification law requires, and we will tell you if a breach affects a photo you uploaded or any biometric identifier derived from it, even where the law does not require it.

Privacy questions or deletion requests: support@palettewell.com.

Lyra Ventures LLC
348 4th Avenue Ste 1031, Brooklyn, NY 11215, United States