1. Who is responsible
The operator of catarinaribeiro.shop is the controller of the personal data described here. All privacy requests go to support@catarinaribeiro.shop and are answered within 2 business days.
2. What happens to the picture you upload
This is the part most people care about, so it comes first.
- Your picture is read inside your browser. The colour clustering, the area merging, the numbering, the colour key and the PDF are all built on your own device.
- If you leave the optional simplification step switched on, that single step sends a reduced copy of the picture to a picture model configured by the site operator, which returns a simplified version. It is used for that request and is not retained by us.
- If you switch that step off, the picture never leaves your device at all.
- We keep no copy of your picture, your outline, your colour key or your reference image. When you close the tab, nothing of them remains with us.
- Your pictures and the results are never used to train any model, ours or anyone else’s.
3. What we collect
3.1 If you only use the free plan
Nothing that identifies you. The count of sheets you have made this month is stored in your own browser (in local storage) so the page can show you how many are left. It never reaches us.
3.2 If you subscribe
- your email address, so we can send receipts, renewal notices and support replies;
- which plan you hold, when it started, when it renews and whether it has been cancelled;
- a record that a payment succeeded or failed, together with the last four digits and the brand of the card. We never see or store your full card number. Card details are handled entirely by the payment provider configured by the site operator.
3.3 If you email us
Your message, your address and anything you attach, kept as long as needed to deal with the matter and any follow-up.
3.4 Technical records
Our hosting provider keeps short-lived server logs — IP address, page requested, time, user-agent — for security and diagnostics. We do not build profiles from them and do not sell or share them.
4. What we do not do
- We do not sell, rent or trade personal data.
- We do not run advertising trackers or advertising pixels.
- We do not build behavioural profiles or score you.
- We do not use your uploads, or anything generated from them, for model training.
- We do not ask for a name, an address or a phone number.
5. Why we are allowed to hold what we hold
Where the GDPR or a similar law applies: we process subscription data because it is necessary to perform our contract with you; we keep billing records because we have a legal obligation to; and we keep short security logs on the basis of our legitimate interest in keeping the service working and safe.
6. How long anything is kept
- Uploaded pictures and generated sheets — not kept at all.
- Simplification requests — held only for the duration of the request.
- Subscription and billing records — for as long as the law requires financial records to be kept, then deleted.
- Support email — up to 24 months, then deleted.
- Server logs — a short rolling window set by our hosting provider.
7. Who else is involved
We use a small number of processors to run the service: a hosting and content-delivery provider, an email provider for receipts and support, and — if the site operator has configured them — a payment provider and a picture-model provider. They act on our instructions and only for the purposes described here.
Some of these providers operate outside your country. Where personal data is transferred internationally it is protected by the safeguards the applicable law requires, such as standard contractual clauses.
8. Your rights
Depending on where you live you may have the right to ask for a copy of what we hold, to have it corrected, to have it deleted, to restrict or object to how we use it, to receive it in a portable form, and to withdraw consent where we relied on it. If you are in California, you also have the right not to be discriminated against for exercising these rights — and since we do not sell or share personal information, there is nothing to opt out of.
Write to support@catarinaribeiro.shop. We answer within 2 business days and complete the request within 30 days. You may also complain to your local data protection authority.
9. Children
Paintoku is for adults. It is not directed at children, we do not knowingly collect their data, and we ask that photographs of children are only uploaded by an adult who holds the rights to them. If you believe a child has given us personal data, tell us and we will delete it.
10. Security
The site is served over HTTPS. Because your picture is processed on your own device, the most sensitive thing in the flow never reaches a server at all. Payment card data never touches our systems. No system is perfectly secure, but we hold as little as possible, which is the most effective protection there is.
11. Cookies
We do not use advertising or analytics cookies. What little browser storage the site uses is described in the cookie policy.
12. Changes
If this policy changes, the date at the top of the page changes with it. Material changes affecting existing subscribers are emailed before they take effect.
13. Contact
support@catarinaribeiro.shop — privacy requests, questions, or a complaint about how we have handled your data.