Legal
Privacy Policy
Last updated: 14 October 2026.
ChromaGain is a service for recording paint colours in homes and workplaces (the chromagain.com website and an Android app). Here we explain in plain language what data we process, why, who we share it with, and what rights you have. The data controller is the ChromaGain team; contact: chromagain.team@gmail.com.
1. What data we process and why
| Data | Purpose | Legal basis | How long |
|---|---|---|---|
| Account: email, password (stored hashed by the authentication provider — we cannot see it), language, account type, the date you accepted the terms. If you sign in with Google or Facebook, we receive your email and, if they provide it, your name. | Creating and running your account. | Performance of a contract (GDPR Art. 6(1)(b)) | While you have an account |
| Your content: properties, rooms, surfaces, colour records (brand, code, finish, quantity), notes, costs and the photos you upload. | The service itself: letting you view and manage your records. | Performance of a contract | Until you delete them or your account |
| Schedule share link: anyone with the link sees the rooms and colours of the property you chose. | Sending a paint schedule to a painter or anyone else. | Your choice (you switch it on) | Until you switch it off |
| "Your suggestions" (Οι δικές σας προτάσεις): a photo, a title, a short note and a signature you choose. | Choosing and publishing the week's three ideas. | Consent (given in the form) | Ideas that are not picked are deleted when the week ends. Picked ones stay public until you ask for removal or delete your account |
| Contact form: name, email, message, property type and your IP address. | To reply to you; the IP address is only used to prevent abuse. | Legitimate interest (Art. 6(1)(f)) in replying and protecting the form | As long as needed to reply and support you |
| Security log: type of event (sign-in, failed sign-in, password reset, sign-up, account deletion), a hashed email — not the email itself —, IP address and browser. | Protecting accounts from takeover and abuse (e.g. locking sign-in after many failed attempts). | Legitimate interest (security) | 90 days |
| Analytics (PostHog): pages you view, technical details (browser, device, country) and a random identifier. If you are signed in, your account id — not your email. We do not record clicks or what is on your screen. | Understanding how the service is used so we can improve it. | Your consent (GDPR Art. 6(1)(a) and Art. 4 of Greek Law 3471/2006). Loaded only if you accept. | Until you withdraw consent; PostHog cookies expire within 1 year |
| Technical errors: the error message and location, the page and technical device details. They do not include the content of your records. | Finding and fixing faults. | Legitimate interest (reliability and security) | A limited time, as needed to fix the problem |
| Newsletter emails: your email, if you chose to receive trends and news. | Sending updates. | Your consent, which you can withdraw at any time | Until you withdraw it |
We do not sell personal data, we do not run profile-based advertising and we make no automated decisions that affect you. We do not collect special-category data (such as health data). The service is intended for people aged 18 and over.
2. Cookies and local storage
We use only what the service needs to work, and analytics (usage statistics) only if you agree in the message shown on your first visit. You can change your mind at any time from "Cookie settings" at the bottom of the page. If your browser sends a Do Not Track or Global Privacy Control signal, we respect it and do not load analytics.
| Name | What it is for | Category | Duration |
|---|---|---|---|
| Sign-in and account security cookies | Keep you signed in, complete sign-in by email or Google/Facebook and the password-reset process. | Necessary | Up to 400 days or until you sign out; the temporary ones, up to 1 hour |
Preferences (cg-locale, cg-theme, cg-consent) |
Remember your language, the light or dark look and your cookie choice. | Necessary / Functional | Up to 12 months or until you clear them |
| Home-page functional data (local storage) | Remember your use of the interactive colour wheel on the home page. | Functional | Until you clear it |
ph_… (PostHog cookie and local storage) |
Usage analytics. | Analytics — only with your consent | Up to 1 year |
3. Who we share data with
We use providers that process data on our behalf and are contractually bound to protect it:
- Supabase — database, authentication and file storage (photos).
- Vercel — website hosting (records technical details of requests, such as IP).
- PostHog — analytics, only with your consent.
- Sentry — technical error monitoring.
- Resend — sending email (for example the reply to the contact form).
- Stripe — payments, when they are switched on; we do not store card details.
- Google and Facebook — only if you choose to sign in with them.
- Cloudflare (Turnstile) — a check that the sign-up and contact forms are filled in by a person and not by a program; it receives your IP address and technical details of your browser while the form is open.
- Sanity — managing the website's articles; it receives no personal data of users.
Some of these providers may process data outside the European Economic Area. Where they do, we rely on a European Commission adequacy decision or standard contractual clauses. If a public authority or court requires us by law to hand over data, we will do so only to the extent required.
4. Retention and deletion
We keep data for the periods in the table in section 1. You can delete your account at any time, yourself, from Settings or at chromagain.com/delete-account. Deletion permanently removes your account and content from our database and deletes your photos and files from storage (the files first, then the account). Our providers' backups expire under their own policies. You can also request deletion by email.
5. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent whenever you like (for example from "Cookie settings"). To exercise any of them, write to chromagain.team@gmail.com; we reply within one month. If you believe your rights are being infringed, you can complain to the Hellenic Data Protection Authority (www.dpa.gr).
6. Security
All communication uses HTTPS. Each user sees only their own data (access rules enforced in the database), photos are kept in private storage, repeated failed sign-ins temporarily lock the sign-in form, and uploaded files are checked for type and size. No method is perfectly secure; if we detect a breach affecting you, we will tell you as the law requires.
7. Changes
If we change this policy materially, we will show it here with a new date and, where needed, inform you or ask for your consent again.