Last updated · 30 September 2026

Privacy policy

How PaletteFinch handles your account, illustration briefs, images, payment records and analytics choices.

Service operator: VIDREAM LTD
Company number: 16513006
Registered address: 71-75, Shelton Street, Covent Garden, London, WC2H 9JQ, UNITED KINGDOM
Support contact: support@palettefinch.com
Jurisdiction: England and Wales
Refund request window: 14 days

Who operates the service

PaletteFinch is operated by VIDREAM LTD, the controller of the account and service records described here. Contact support@palettefinch.com about privacy or your data. Our company number and address are shown above.

What we store and why

We store your brief, selected colors, background, image size, generated image, generation status and timestamps to provide the service and your history. Your workspace also stores a credit balance and payment records. An essential HTTP-only session cookie links this browser to its workspace for seven days. Clearing an anonymous cookie can remove access to an unlinked workspace; it does not delete stored records. We use account and order data to perform our contract with you, security records to prevent abuse, and records required by law to meet our legal obligations.

Google sign-in

Google supplies your account identifier, email, name and profile image URL when available. Authentication records include your Google account association and tokens; security sessions can include your IP address and browser information. We use these details and essential cookies to protect your account and reopen your credits, orders and images across devices. We request only basic identity, email and profile permissions, with no access to Gmail or Drive. Signing in links this browser’s anonymous workspace once. Sessions last up to seven days and can renew during use. Signing out ends the current login session. Free trials do not require sign-in; purchases do.

Cloudflare storage and abuse prevention

Cloudflare D1 stores account and service records; Cloudflare R2 stores image files behind a workspace access check. Images are available for 90 days from generation and then expire. R2 automatically deletes expired files through its lifecycle policy; physical deletion can follow the expiry time. Download images you want to keep. Briefs, generation history and credit records can remain until a deletion request is processed. To enforce free-credit daily limits, we derive a daily keyed hash from the connection IP, rather than saving the raw IP in quota logs. Limit events record the time, type and daily count.

Image processing with fal.ai

We send your brief, palette, background and size to fal.ai to run Recraft V4.1 Flash, retrieve the result, and save it in your workspace. Do not enter personal, confidential or sensitive information. Our 90-day image policy applies to our R2 copy. Provider processing and retention follow the provider’s policies; deleting our copy does not by itself delete copies already processed by a provider. Our providers may process data outside your country, including outside the UK and EEA. Contact us for details of applicable transfer arrangements.

Payments through Link

Link is the merchant of record for purchases processed with Stripe Managed Payments. Stripe and Link handle payment and billing information, tax, transaction support and their own required records under their privacy policies. We receive order status, currency, amounts, tax status and billing country when supplied. We never receive or store your full card number or card security code.

Analytics and your choice

When enabled, Cloudflare Web Analytics measures visits and performance without analytics cookies and provides our overall traffic baseline. Google Analytics 4 loads only when configured and after you accept analytics cookies. If you refuse, the service still works and no Google Analytics tag or analytics request loads. If you accept, Google Analytics measures page visits, acquisition sources and generation, checkout and purchase events. We do not send your email, prompt, image, workspace or order identifier to Google Analytics. Your analytics choice is saved in this browser’s local storage. Session storage helps avoid counting the same success page twice. You can change your choice using Cookie settings in the footer. Withdrawing consent stops the tag and removes its first-party cookies; it does not erase data already received by Google. Browsers marked as internal are excluded from Google Analytics. The two analytics totals can differ because consent and browser blocking affect Google Analytics.

Your rights and deletion requests

Email support@palettefinch.com to request access, correction or deletion, or to raise a privacy concern. We respond to support messages within 48 hours and process account and data deletion requests within 30 days, after verifying ownership where needed. We delete the account, briefs and image copies under our control; records we must retain for tax, accounting, fraud prevention or legal claims may be kept for the required period. We will explain any exception. Payment data held by Stripe or Link follows their separate request process. Where applicable, you can object, restrict processing, request portability, withdraw consent or complain to the UK Information Commissioner’s Office or your local data protection authority.

For operator details and contact status, see the contact page.