Privacy notice

Last updated October 15, 2026.

If we make a material change to this notice, we will email everyone with an account at the address we hold for them, with a short summary of what changed.

Who we are

Brandtint is a product of Techholds (Private) Limited, based in Lahore, Pakistan. We serve customers worldwide. If you have a question about this page, email privacy@brandtint.app.

What we store

• Your logo. We save it as a PNG in our own database, not on someone else’s file service, shrunk to at most 1024 pixels on its longest edge - far more than a theme ever needs.
• The colours we work out from it.
• Your projects, and every saved version, so you can undo and compare.
• A record of every AI request. We keep it for 180 days, then delete it automatically. A record of every purchase is kept for our accounts and is not deleted on that schedule, even after you delete a project or your account.
• Your email and your name. Also whether you said yes to product email, if you did.
• Logs of AI requests. These store a scrambled version of your network address, never the real one. It is enough to tell two requests apart. It is not enough to work out where they came from. Kept for 180 days, with the rest of the AI request record.
• If you contact support, the ticket: your email, your message, the page you were on, your browser’s user agent, and a scrambled version of your network address. We also forward this by email to our own support inbox. We do not delete tickets on a timer: we keep them while we are helping you and afterwards as a support record. When you delete your account we strip the email, subject, message, browser and network details from every ticket we can match to you, and keep only the empty record that a ticket existed.
• If you ask to be told about a CRM platform we don’t support yet, the email address you gave us. We keep it until we have told you the platform is ready, or until you delete your account, which removes it. There is no automatic expiry.
• The scrambled network address your account was created from, kept on the account record until you delete the account, when it is erased. It is a one-way digest, not the address itself.
• Our general application log: a record of what the service did and when, including errors and payment events. It identifies you by account number, never by email address or name in its text. We keep it for 180 days, and delete the rows tied to your account when you delete it.
• Our audit log: a record of administrative actions on accounts, payments and settings (for example, an admin granting refinements or processing a refund). It is part of our financial and compliance record, so it is kept rather than deleted on a timer, and when you delete your account we scrub the email address and name from entries that recorded them.
• A record of when you signed in and how (link, password, or Google). We keep it for security and support - to investigate a suspicious sign-in or help you with one - for 180 days. The account page shows it to you only when we have switched that view on.
• A scrambled version of a device id your browser generates, and the country your request appeared to come from, both recorded once when your account is created. The device id is easy to clear from your own browser, and we say so on this page.
• The country your billing address is in, and the date you accepted our Terms of Service.
• The email address you typed at checkout, if it is different from your account email - Paddle sends it to us with the payment notification.
• If you sign in with Google, the profile picture URL Google gives us, and the sign-in tokens Google issues for the link between your account and Google, which our login system stores with your account. They are deleted when you delete your account. If you set a profile photo yourself, that image, stored separately from the rest of your account.
• A one-way hash of your password, if you set one. We cannot read the password itself back out of it.
• The sign-in session on your device, for up to 30 days of inactivity, so you are not asked to sign in again every visit.
• The payment notification Paddle sends us, with the card number and other payment details already removed before we store it. We keep it for as long as we keep the purchase record it belongs to, because it is how we can prove a payment happened.

What happens to your logo

The file is uploaded to us as soon as you drop it in. We decode it on our server to read the colours out of it, and we keep the decoded PNG so you can come back to the project later without uploading it again. Nothing about that step needs an account, so if you never sign in it is held against an anonymous draft and deleted after seven days.

What does stay on your computer is the design work. Turning those few colours into a full theme, and checking every text and background pair for contrast, is arithmetic your browser runs on its own. No request is made for it, which is why it is free however often you do it.

If you ask the AI to redesign the colours, we send a smaller copy of your logo, and any text you typed into the Refine theme box, to our AI provider. It is not used to train anything. We save the colours with your project so you can get a file for a new SuiteCRM version later without starting over.

Who processes it

Only the companies we need to run the service. We do not sell your data. We do not share it for advertising. These are all of them:

• Anthropic (United States) - the AI that redesigns your colours. A smaller copy of your logo is sent when, and only when, you press Refine theme. Anthropic does not use it to train their models.
• Paddle (United Kingdom and United States) - payments. Paddle is the seller of record, so they take the payment, hold the billing details and handle the tax. We never receive your full card number. Paddle’s payment notifications include the card type (for example, “this was paid by card”), which is all we keep.
• Resend (United States) - sends the sign-in links, receipts and reminders. They see your email address and the contents of those messages.
• Cloudflare Turnstile (United States) - the human check on sign-in, support and platform-interest requests. It receives your network address and returns whether the request looks human; we do not send it your email or logo.
• Google - only if you choose “Sign in with Google” instead of email. Google confirms your identity and gives us your name, email address and profile picture URL.
• Our hosting provider - runs the servers and the database that hold everything described above. Email us for the current name and location.

Where your data goes

We are based in Pakistan, and the companies above are in the United States and the United Kingdom. So if you are in the UK or the EEA, your data leaves it. Where that happens we rely on the data-protection terms in our contract with each company, including the UK and EU standard contractual clauses where they apply. Ask us and we will tell you which one covers a particular company.

If you are buying for a company

Business customers who need a data processing agreement can get one by emailing privacy@brandtint.app. Tell us the company name and we will send the current version.

Anonymous work

Before you sign in, your logo and colours are saved as a draft. The draft is tied to a cookie in your browser, not to an account. If you never sign in, we delete it after 7 days. If you do sign in, the draft becomes a project you own, and the draft itself stops holding a separate copy of your logo once that happens - only the project does.

To stop one network from filling our database with anonymous uploads, we also count how many drafts your network address currently has open, using a scrambled version of the address rather than the address itself, and cap it. Signing in removes that limit, because a signed-in account cannot be used to flood us anonymously.

Deleting your account

You can delete your account on your account page. That removes your projects, logos, and saved colours right away. We have to keep payment records, so those stay. But we strip your name from them. Your email is swapped for a random one that cannot be traced back to you, your signup details are erased, and the payment messages that held your billing address are wiped. You cannot undo this.

Cookies and local storage

We use cookies the site needs to run: one to keep you signed in, and one that keeps a random id to slow down fake signups (that id marks a browser, not a person). We use no advertising cookies and no third-party analytics - nothing here is shared with, or sold to, anyone else.

The draft cookie does two things. It ties your logo and colours to a draft before you have an account, exactly as described above. It is also the id we attach to a small set of first-party product-usage events - moments like uploading a logo, seeing the instant preview, or reaching the paywall - so we can see where in the process people stop. That measurement is ours alone: it never leaves our own database, it is never used for advertising, and it is kept for 180 days.

We only record those product-usage events if you say yes. The first time you visit, a banner asks you to choose: Accept all turns them on, Reject all keeps them off, and Manage preferences lets you decide category by category. Until you choose, they stay off. The cookies the site needs to run - signing in, saving your draft, slowing down fake signups - are used either way, because the site cannot work without them. We save your answer in a cookie of its own for 12 months, then ask again. You can change it at any time with Cookie settings at the bottom of every page. Our Cookie Policy lists every cookie and storage item, what it is for and how long it lasts.

Four records are different, because they are part of running the service and not of measuring it: that your account was created, that you started a checkout, that a payment was received, and that you downloaded a package. Our servers write them when those things happen. They set no cookie and read none, they are tied to your account and project rather than to a browser, we keep them for 180 days, and they are recorded whatever you choose in the banner. The banner governs the browser usage events above, not these.

Your rights

You can delete your account yourself on your account page, any time, no matter where you live. For everything else - seeing what we hold, getting a copy of it, or correcting it - email privacy@brandtint.app and tell us what you need. We will not charge you, and we will not treat you any differently for asking.

If you live in the EU, the EEA, or the UK, the GDPR gives you the right to access, correct, obtain a copy of (portability), restrict, object to, and erase your data, and the right to lodge a complaint with your local data protection authority. If you live in a US state with its own privacy law, that law’s rights apply too. Account deletion is self-serve; every other right above goes through the email address above.

We do not sell your data. We do not share it for ads. We have never done either one.