Politika e privatësisë

3.1 What data we collect from you and from whom we receive this data

First and foremost, we process personal data that you provide to us or that we collect when operating our website. We may also receive personal data about you from third parties. These may be the following categories:

• Personal master data (name, address, dates of birth, etc.);
• Contact information (cell phone number, email address, etc.);
• Financial data (e.g. account details);
• Online identifiers (e.g. cookie identifier, IP addresses);
• Location and traffic data;
• Sound and image recording;
• particularly sensitive data (e.g. biometric data or information about your health).

3.2 Under what conditions do we process your data?

We process your data in good faith and for the purposes set out in this privacy policy. In doing so, we ensure transparent and proportionate processing.

If, in exceptional cases, we are unable to comply with these principles, the data processing may still be lawful because there is a justification. A justification reason may be in particular:

• Your consent;
• the execution of a contract or pre-contractual measures;
• our legitimate interests, unless your interests are overridden.

3.3 How can you withdraw your consent?

If you have given us consent to process your personal data for specific purposes, we will process your data within the scope of this consent unless we have another justification.

You can revoke your consent at any time by sending an e-mail to the address given in the imprint. Data processing that has already taken place is not affected by this.

3.4 In which cases can we share your data with third parties?

3.5 How long do we keep your data?

We store personal data only for as long as is necessary to fulfill the individual purposes for which the data were collected.

Data that we store when you visit our website is kept for twelve months. An exception is made for analysis and tracking data, which may be kept longer.

We store contract data for longer, as we are obliged to do so by legal regulations. In particular, we must retain business communications, concluded contracts and accounting records for up to 10 years. As far as we no longer need such data from you to perform the services, the data will be blocked and we will only use it for accounting and tax purposes.

3.6 How do we protect your data?

We will keep your information secure and take all reasonable steps to protect your information from loss, access, misuse or alteration.

Our contractual partners and employees who have access to your data are obliged to comply with data protection regulations. In some cases, it will be necessary for us to pass on your requests to companies affiliated with us. In these cases, too, your data will be treated confidentially.

Within our website, we use the SSL (Secure Socket Layer) procedure in conjunction with the highest encryption level supported by your browser.

3.7 What rights do you have?

3.8 Changes to the privacy policy

We may change this privacy policy at any time. The changes will be published on https://imagecolorpicker.com, you will not be informed separately.

4.1 Providing the website and creating log files

4.2 Brevo (formerly Sendinblue)

We may use the service of Brevo, formerly known as Sendinblue, for our newsletter and as CRM (Customer Relationship Management). Brevo does not load on our website.

If we send you our newsletter through Brevo, your email address and, if applicable, your name are stored and transmitted to Brevo for processing. Brevo uses technologies such as tracking pixels to determine whether emails have been opened and which links in them have been clicked. This helps us to measure the effectiveness of our emails. You can unsubscribe at any time with the link in every newsletter or in the settings of your account.

Messages from our contact form and sign-in codes are not sent through Brevo but through Resend (sections 4.16 and 4.17).

4.3 Google Analytics

We use Google Analytics 4 on our website, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). It loads on every page.

Google Analytics sets the cookies "_ga" and "_ga_<ID>" on our domain, which hold a random ID and are kept for up to two years. With them, Google receives the address of the pages you open, the page you came from, the technical data of your browser and device, your approximate location (derived from your IP address) and the actions you take on our website, for example which tools you use, whether a checkout was opened or completed (with the amount, but without your name, email address or payment details) and whether you are signed out, signed in or a supporter. We never send your name, your email address or the ID of your account to Google Analytics. According to Google, Google Analytics 4 does not log or store IP addresses.

Google's advertising features (Google signals) are turned on in our Google Analytics property. Because of this, your browser also contacts Google's advertising servers on every page (for example stats.g.doubleclick.net), whether or not you are signed in to Google. If you are signed in to a Google account and have allowed ad personalization there, Google can link this data to your Google account and use it for reports about groups of users and for advertising audiences.

Google uses this data on our behalf to create reports about the use of our website. Google keeps the data for the period we set in Google Analytics, at most 14 months, and may process it in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework. We use Google Analytics because we have a legitimate interest in knowing how our tools are used, so that we can improve them (Art. 6(1)(f) GDPR).

You can prevent the collection by blocking cookies in your browser or with the browser add-on from Google: https://tools.google.com/dlpage/gaoptout. You can turn off ad personalization for your Google account at https://myadcenter.google.com.

4.4 Trustpilot and Featurebase

Trustpilot is a service of Trustpilot A/S, a company located at Pilestræde 58, 5th floor, 1112 Copenhagen, Denmark. Trustpilot is an online review platform where customers can share their experiences and opinions about companies and their products or services.

We use Trustpilot to give our customers the opportunity to leave feedback on our products and services. This helps us to continuously improve our offerings and give potential customers insight into the quality of our services. For example, when you make a purchase on our website, you might receive an invitation to leave a review on Trustpilot after completing the purchase.

Our website does not load anything from Trustpilot and does not set Trustpilot cookies. We only link to our Trustpilot page. Trustpilot is contacted, in a new tab, only if you click such a link, and then Trustpilot's own privacy policy applies.

When you leave a review on Trustpilot, it will be publicly visible, along with the username you choose. Trustpilot offers various options in its privacy settings to control and limit data collection and processing. If you do not want Trustpilot to collect data about you, you should not leave a review or adjust the relevant privacy settings in your Trustpilot account.

The link "Give feedback" in our footer leads to our feedback board at imagecolorpicker.featurebase.app, which Featurebase runs for us. Featurebase is contacted only if you click the link, and then Featurebase's own privacy policy applies.

4.5 Cloudflare CDN

Our website uses the Content Delivery Network (CDN) service provided by Cloudflare, Inc, 101 Townsend St, San Francisco, CA 94107, USA (" Cloudflare"). A CDN helps deliver content from our website faster by distributing copies of the content to a network of fast loading servers.

When you visit our website, your IP address is transmitted to Cloudflare and cookies may be set in your browser, which are necessary for the optimization and security of the service. Cloudflare uses this data to speed up traffic between our web server and your end device and to protect our website from attacks.

4.6 Microsoft 365

For various office and communication tasks, we use Microsoft 365, a service provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA.

Microsoft 365 offers a range of productivity tools, including email (Outlook), document storage (OneDrive), collaboration tools (Teams), and Office applications such as Word, Excel, and PowerPoint. When you contact us, for example by email, or when we share documents, these interactions are processed and stored through Microsoft 365.

Microsoft uses servers in different countries to provide the Microsoft 365 services. This means that your data may be stored in data centers outside of Switzerland. However, Microsoft has implemented various security and privacy measures to protect its customers' data.

4.7 Cloudflare Workers, D1, R2 and KV

Our website and our servers run on Cloudflare Workers, a service of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA ("Cloudflare"). Cloudflare stores the data of our service for us: the data of your account and the palettes, gradients, colors, projects and collections you save in our database (Cloudflare D1), the images you save with a palette in Cloudflare R2, and short-lived counters and cached data in Cloudflare KV. Cloudflare processes these data on our behalf. Our database is located in Western Europe, but Cloudflare may process data in other countries, including the USA (section 3.4 c).

Cloudflare also measures how fast our pages load with Cloudflare Web Analytics. Your browser loads a small script from static.cloudflareinsights.com on every page and reports the address of the page, the page you came from, the technical data of your browser and the loading times. According to Cloudflare, Web Analytics does not use cookies or local storage and does not identify you by your IP address. We use it because we have a legitimate interest in a fast website (Art. 6(1)(f) GDPR).

4.8 Data stored in your browser

Besides the cookies described above, our website itself saves some entries in your browser: in "local storage", in "session storage" and in an in-browser database called IndexedDB. We use them to make the site work the way you expect, for example so that your image is still there after you reload the page. These entries stay on your device and are not sent to us, with one exception: the rating ID described in section 4.9. Other websites cannot read them. We do not use them for advertising. We store them to provide the functions you ask for. This is our legitimate interest.

4.9 Star ratings on our website

On our home page you can rate imagecolorpicker.com with one to five stars. When you click a star, we store the number of stars, a random ID that we create and keep in the local storage of your browser, the language of the page and the time of the rating. The ID is not linked to your name, your email address or an account. We use it so that each browser counts once: if you rate again, your earlier rating is replaced. Your browser also keeps your rating in its local storage, to show you the stars you chose. You can delete both entries at any time by clearing the site data of your browser.

We use the ratings to show the average rating and the number of ratings on our website once there are enough of them. This is our legitimate interest (Art. 6(1)(f) GDPR) in showing other visitors what users think of the tool and in improving it.

We keep the ratings for as long as the rating feature exists and delete them when we remove it. To limit repeated ratings, we also keep a keyed hash (HMAC) of your IP address, or of the network prefix for IPv6, not the address itself, together with the date and the number of ratings. We delete it within an hour after the end of the day (UTC).

You have the right to object to this processing under Art. 21 GDPR on grounds relating to your particular situation. To do so, contact us and tell us the ID in your browser's local storage (the entry icp_rating_visitor_id). We can find your rating only with this ID. If you clear the site data of your browser, the ID is gone and the rating can no longer be linked to you.

To protect the rating from automated abuse, we check each rating with Cloudflare Turnstile (see also sections 4.5 and 4.7). The Turnstile script is loaded only when you click a star. Cloudflare receives technical data such as your IP address and browser information for this check.

The rating card always shows a link to Trustpilot (see section 4.4). We do not contact Trustpilot when you rate or when the page loads. Trustpilot is contacted, and opens in a new tab, only if you click the link.

4.10 Images from links and website screenshots (thum.io)

In the image picker you can open an image from a link ("Image URL") or a screenshot of a website ("Website URL"). Your browser does not load these from the address you entered. It requests them from thum.io, a screenshot service (www.thum.io, contact: support@thum.io). thum.io downloads the image or opens the website and takes a screenshot, and sends the result back to your browser. If thum.io cannot return the link under "Image URL" as an image, we ask it for a screenshot of that page instead. The photo you pick in the image search (section 4.11) is loaded the same way.

thum.io receives the link, your IP address and the technical data your browser sends with every request, such as the browser type and the address of our website. thum.io keeps a copy of the image or screenshot for a while, so it can answer the same request faster. Links can contain personal data, for example a name or a private access code, so only enter links you are fine sharing with thum.io. The image itself is then processed in your browser like a file you upload, and we do not receive it.

thum.io is contacted only when you load an image from a link, take a screenshot of a website or pick a photo in the image search, never when you upload, paste or drop a file. thum.io runs its servers in the USA, so your data is transferred there. We have no data processing agreement with thum.io, so the contractual safeguards described in section 3.4 c do not apply to this transfer. We send your data to thum.io only when you use one of these functions, because the transfer is necessary to provide it (Art. 6(1)(b) and Art. 49(1)(b) GDPR). If you do not want this, save the image on your device and upload it as a file instead.

4.11 Image search (Pexels)

The "Search" tab of the image picker finds free photos on Pexels, a brand of Canva Germany GmbH, Pappelallee 78/79, 10437 Berlin, Germany. When you open the tab, and every time you change the search term, your browser sends the search term to Pexels (the tab starts with the term "color"). Pexels receives the search term, your IP address and the technical data of your browser. Our server fetches the preview images from Pexels and delivers them to you from our website, so Pexels does not receive your IP address for them. Pexels is contacted only when you open the "Search" tab. The photo you pick is loaded through thum.io (section 4.10).

We use Pexels to provide the image search you ask for (Art. 6(1)(b) GDPR). You can read the privacy policy of Pexels here.

4.12 Wall of Love (Senja)

Our page "Wall of Love" (/wall-of-love) shows reviews and videos from our users with a widget of Senja, a service of Senja Proof LTD, Flat 9, 2 Battlebridge Lane, London SE1 2HL, United Kingdom. When you open that page, your browser loads the widget, the reviews and their pictures from Senja and from the services Senja uses for this (Amazon Web Services and ImageKit), and the widget reports the visit to the statistics of Senja. The widget also loads its font from Google Fonts, a service of Google LLC, USA, so Google receives your IP address too. Some reviews show profile pictures or images that are stored at Trustpilot or X (Twitter). If they are shown, your browser loads them from there. These services receive your IP address, the address of the page and the technical data of your browser, and may use cookies or similar technologies. The widget is loaded only on this page, not on the rest of our website.

The link to record a video review leads to love.imagecolorpicker.com, a page that Senja runs for us. Senja is contacted there only if you click the link. Senja and the services it uses may process data outside the United Kingdom, in particular in the USA.

We use Senja because we have a legitimate interest in showing what our users say about the tool (Art. 6(1)(f) GDPR). You can read the privacy policy of Senja here.

4.13 Payments (Paddle)

Payments for our supporter plan and tips are processed by Paddle.com Market Limited, 30 Old Bailey, London EC4M 7AU, United Kingdom ("Paddle"). Paddle is the reseller of our plan (merchant of record): you buy from Paddle, which collects the payment, handles taxes and invoices and is itself responsible for the payment data it processes. You can read the privacy policy of Paddle here.

So that the checkout opens without delay, every page with our site header and every page of your account loads the script of Paddle (Paddle.js from cdn.paddle.com), which also loads a script of ProfitWell (Paddle Retain, public.profitwell.com), a service of Paddle. Paddle receives your IP address and the technical data of your browser when the page loads, and sets a security cookie ("__cf_bm") on paddle.com. To show prices in your local currency, our server also sends your IP address to Paddle when a page shows our prices.

When you open the checkout, you enter your payment details directly at Paddle. We never see or store them. If you are signed in, we pass your email address and the ID of your account to Paddle, so that the payment is linked to your account. From Paddle we receive and keep the ID of your Paddle customer record, your email address, the status and end date of your plan, the currency, and for tips the amount. We need these data to provide the plan you bought (Art. 6(1)(b) GDPR) and keep them while your account exists. If you buy without an account, we keep these data, including your email address, so that the purchase can be linked to an account you create later with the same address, and as long as the law requires us to keep accounting records (section 3.5). When you delete your account, we cancel your plan at Paddle, delete the records of your plan and remove your email address and your account from the records of your tips. Paddle keeps its own records of your payments as the law requires.

4.14 Your account and sign-in

You can create an account to save palettes, gradients, colors, projects and collections. For your account we store your email address, your name if Google gives it to us, your profile picture link, your language, your theme and the status of your supporter plan, together with what you save. We also store whether you want our newsletter (it is on when you create your account, and you can turn it off in your settings or with the link in every newsletter), the date of that choice and the code of your unsubscribe link. You can sign in with a code we send to your email address (section 4.16), with a passkey or with Google (section 4.15). For a passkey we store only its public key and technical data about it, never your fingerprint, face or device PIN, which stay on your device.

For every sign-in we store a session with your IP address and the type of your browser and device, so that you stay signed in and we can detect misuse. We delete a session when you sign out or delete your account. A session that is not used for a year expires and can no longer be used. We delete its record, including the IP address, within a day after it expires. The cookies of the sign-in are described in section 4.8.

If you are signed in, we note once a day that you visited our website (the ID of your account, the date and whether you are a supporter), to count active users. Our login and sign-up pages and our contact form are protected against automated abuse with Cloudflare Turnstile. Cloudflare receives your IP address and the technical data of your browser for this check.

The images you save with a palette (only possible with a supporter plan) are stored in Cloudflare R2 (section 4.7) and can only be seen by you. An image that no saved palette uses anymore is deleted after 7 days.

You can delete your account at any time in the settings. We then delete your account, your sessions and everything you saved, including your images. We keep the records of your tips without your email address and without a link to your account, and the daily visit notes (the ID of your deleted account, the date and whether you were a supporter). If our support worked on your account, the record of that work, which can contain your email address, is kept for security. We process the data of your account to provide our service (Art. 6(1)(b) GDPR) and, for the session data and the support records, because we have a legitimate interest in the security of our service (Art. 6(1)(f) GDPR).

4.15 Sign in with Google

You can sign in with your Google account. This service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, USA ("Google").

If you are not signed in, every page except the login and sign-up pages loads the Google sign-in script from accounts.google.com, which can show a small "Sign in with Google" prompt (Google One Tap). Google receives your IP address, the address of the page and the technical data of your browser. If you are signed in to Google in this browser, Google also receives its own cookies and can therefore tell that you visited our website. The script saves a cookie "g_state" on our domain that remembers whether you closed the prompt, so it does not show again for a while.

When you sign in with Google, Google sends us your name, your email address, whether Google has verified it, your profile picture and the ID of your Google account. We do not keep the access tokens Google gives us and cannot access anything else in your Google account. Your profile picture is loaded by your browser directly from Google (googleusercontent.com) when we show it.

We use Sign in with Google to provide the sign-in you choose (Art. 6(1)(b) GDPR). We show the prompt because we have a legitimate interest in an easy sign-in (Art. 6(1)(f) GDPR). Google may process data in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework. You can read the privacy policy of Google here.

4.16 Emails we send (Resend)

We send emails through Resend, a service of Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA ("Resend"). These are the codes for signing in and the messages from our contact form (section 4.17). For a sign-in code, Resend receives your email address and the code. A code is valid for 10 minutes. Resend processes these data on our behalf and may process them in the USA (section 3.4 c). We send these emails to provide the sign-in and to answer you (Art. 6(1)(b) GDPR). You can read the privacy policy of Resend here.

4.17 Contact form

If you write to us with our contact form, we receive your name, your email address and your message. Our server sends them by email (through Resend, section 4.16) to our mailbox (Microsoft 365, section 4.6). We do not store the message in our database. We keep the email as long as we need it to answer you and as long as the law requires us to keep business letters (section 3.5).

The form is protected with Cloudflare Turnstile, which loads when you open the contact page and receives your IP address and the technical data of your browser. To limit the number of messages to 5 per day, we keep a keyed hash (HMAC) of your IP address, or of the network prefix for IPv6, not the address itself, together with the date and the number of messages. We delete it within an hour after the end of the day (UTC).

We process your message to answer your request (Art. 6(1)(b) GDPR) and, for the protection against abuse, because we have a legitimate interest in a working contact form (Art. 6(1)(f) GDPR).

4.18 Color descriptions (OpenAI)

Some texts on our color pages (for example /color-code/ff0000) are written by an AI model of OpenAI (San Francisco, USA). Our server sends OpenAI only the hex code of the color and the language of the text, never data about you. We store the text and show it to every visitor of that color page.