Privacy policy
Last updated: 9 August 2026
This policy explains what personal data PaintCards collects, why it is processed, and what you can do about it. The company named in the legal notice is the data controller. There is no guest mode here: using the service means having an account, so most of what follows applies to everyone who uses it.
1. Who we are, and what this covers
The data controller is the company identified in the legal notice. Its name, registration and postal address are set out there rather than repeated here, so that there is one place to keep correct.
This policy covers the PaintCards website and the account behind it. It does not cover a site you reach by following a link someone put in a recipe, nor the paint manufacturers whose products the catalogue describes.
For any question about this policy or about your data, write to [TO BE COMPLETED].
2. What we collect
Everything below is either something you typed, something you uploaded, or something a server has to record in order to answer a request.
- Your account
- Email address, a password (stored only as a hash, never in readable form), your username, an optional display name, an optional short bio, and an optional avatar image. Also the date the account was created and last changed, whether the email address has been verified, and whether a moderator has suspended the account and why.
- Your sessions
- Each time you sign in, a session is recorded with its expiry, the IP address and the browser user agent it was opened from. This is what lets you see where your account is signed in, and what makes a stolen session recognisable.
- What you create
- Your recipes and their steps, the categories and tags you invent, your paint mixes, your custom paints, which catalogue paints you mark as owned or wanted and any note you attach to them, your bookmarks, your print settings and print sheets, and the revision history of a recipe.
- Your photographs
- Images you upload of painted miniatures, together with their dimensions, file type, size and a checksum. A smaller preview is derived from each one. Cropping is non-destructive: the framing you choose is stored as numbers alongside the recipe, and the original file is left as uploaded.
- What you publish
- When you make a recipe public, its content becomes visible to anyone, along with your username, your display name and your avatar. A share link is different: it is an unguessable URL, the link itself is stored only as a hash, and you can revoke it or give it an expiry date. Recipes are private until you decide otherwise.
- Reports and moderation
- If you report a recipe or a catalogue error, the report is stored with your account attached to it. Decisions taken by moderators are written to an audit log that records who acted, on what, and when.
- Technical records
- The server writes a log line per request with the method, the path, the IP address, the user agent and a request identifier. Authorization headers, cookies and any password or token in a request body are stripped before anything is written. Rate limiting counts requests per IP address, in memory only.
There is no analytics. No audience measurement, no product analytics, no advertising network, no session recording, no third-party tag of any kind is integrated into this service, so none of the data that such tools collect exists here.
3. Why we process it, and on what basis
- Running the service
- Creating and authenticating your account, storing and displaying your recipes and photographs, rendering cards and print sheets, and showing a recipe to the people you chose to show it to. Legal basis: performance of the contract formed by the terms of use.
- Sending service email
- Verifying your address, resetting a password, confirming a change of address and confirming a request to delete the account. Legal basis: performance of the contract. These are not marketing messages and there is no mailing list.
- Keeping the service safe
- Detecting and limiting abuse, rate limiting sign-in attempts, investigating a fault from the logs, and handling reports of unlawful content. Legal basis: legitimate interest in a service that stays available and lawful.
- Meeting legal obligations
- Acting on a valid report of unlawful content and keeping a record of what was decided. Legal basis: compliance with a legal obligation.
No processing on this service currently relies on consent, because nothing here is optional in the sense that consent requires. If that changes, you will be asked first, and asked in a way you can refuse without losing the service.
4. Who else handles it
Your data is not sold, rented or shared for anyone else’s marketing. It is handled by the publisher and by the following processors, each acting on the publisher’s instructions:
- Hosting
- OVH SAS, France. Runs the servers and the database on which the service and your content are stored.
- Image storage
- [TO BE COMPLETED]. Holds the photographs you upload, in an S3-compatible object store.
- Email delivery
- [TO BE COMPLETED]. Delivers the verification, password reset, address change and account deletion messages. Receives the recipient address and the content of those messages, and nothing else.
Beyond that, data is disclosed only where the law requires it, for example in response to a valid request from a court or a competent authority.
5. Where the data is
The intention is that everything stays inside the European Union. The host is OVH SAS, a French company, and the servers are in France.
Confirm the same for the image storage and email providers named above before relying on this section. If one of them ever processes data outside the European Union, this policy will say which, in which country, and under which safeguard, which in practice means the European Commission’s standard contractual clauses or an adequacy decision covering that country.
6. How long we keep it
- Account and content
- For as long as the account exists. Anything you delete yourself, a recipe, a photograph, a tag, goes when you delete it.
- After you delete your account
- Deleting your account is confirmed by email and then removes the account and everything attached to it: sessions, credentials, recipes and their steps, tags, mixes, bookmarks, print settings, paint ownership records and uploaded images. Backups are overwritten on their own cycle, so a copy can persist there for a short period after the live data has gone.
- Unattached uploads
- An image uploaded but never attached to a recipe, or attached and then removed, is deleted by a maintenance job after a seven-day grace period.
- Server logs
- [TO BE COMPLETED].
- Moderation records
- Entries in the moderation audit log are kept after the account they concern is gone, in a form that records what was decided rather than who the person was. They exist so that a decision can be accounted for later, which is the point of keeping them.
A recipe you published and then deleted stops being served immediately. Nothing can be done about copies other people made while it was public, which is worth thinking about before publishing.
7. Your rights
Under the General Data Protection Regulation you have the right to:
- ask what data is held about you and get a copy of it (access);
- have inaccurate data corrected (rectification);
- have your data deleted (erasure);
- receive the data you provided in a structured, commonly used, machine-readable format (portability);
- ask that processing be limited while a dispute is resolved (restriction);
- object to processing based on legitimate interest, on grounds relating to your situation (objection).
Much of this you can do yourself without asking anyone: your profile, your recipes, your tags and your photographs are editable and deletable from within the service, and deleting your account is a self-service action confirmed by email.
For anything else, write to [TO BE COMPLETED]. We will answer within one month, which may be extended by two further months for a complex request, in which case you will be told why within the first month. We may need to confirm who you are before acting, which is a protection for you rather than an obstacle.
If you are not satisfied with how a request was handled, you can complain to the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr, or to the supervisory authority of the country you live in.
8. How the data is protected
The measures below are the ones worth stating publicly. The detail of the rest is deliberately not published, because a precise description of a defence is useful to the wrong reader.
- passwords are stored only as hashes, never in readable form, and must be at least twelve characters;
- an email address must be verified before an account can be used;
- session cookies are HTTP-only, restricted to same-site requests, and sent only over HTTPS in production;
- sign-in, registration and password reset are rate limited;
- share links are stored only as a hash, so a copy of the database hands out no working links;
- access to the production systems is restricted to the people who operate them;
- credentials, tokens and signed upload URLs are stripped from logs before anything is written.
No system is perfectly secure. If a breach occurs that is likely to put your rights at risk, you will be told, and the CNIL will be notified within 72 hours as the regulation requires.
9. Children
The terms of use say that a minor may only create an account with the consent of their legal guardian. The service does not currently ask for or verify an age, so that condition rests on the person signing up rather than on a check.
If you believe a child has created an account without their guardian's consent, write to [TO BE COMPLETED] and the account will be reviewed and, where appropriate, deleted.
11. Changes to this policy, and contact
This policy will change when the service does. The date at the top of the page says when it last did.
A change that materially affects how your data is handled, a new processor, a new purpose, a longer retention period, will be announced by a reasonable means before it takes effect, rather than appearing quietly in a new version of this page.
Questions about your data, and requests to exercise any of the rights above, go to [TO BE COMPLETED]. General questions about the service go to [TO BE COMPLETED].