Privacy Policy
Last updated 9 November 2026
This privacy policy describes how Lepre Oy processes personal data in the MyColors.net service.
1. Controller
Lepre Oy, business ID 2913510-1, VAT ID FI29135101, Lauttakatu 22, 33400 Tampere, Finland, www.mycolors.net, info@varianalyysi.net.
2. Personal data we process
We may process the following data:
Information you give us
- email address
- the first name for the guide's cover, if you give it
- account details
- any other information you give us, for example in a support request
Photos you upload
- photos uploaded for colour analysis
Analysis results
- colour profile
- colour analysis results
- recommendations produced by the Service
Payment information
- purchases
- order details
- the country of your IP address and your billing country at the time of purchase
Lepre Oy does not process your card details: payments are handled by an external payment provider.
Usage and analytics data
- IP address
- technical information about your device
- browser information
- information about how you use the Service
- cookie data
- partner-shop products shown and clicked in the Service
Do you have to give us this data?
Giving us data is voluntary, but some of it is needed for the Service to work:
- A photo is needed for the colour analysis. Without one, we cannot produce an analysis.
- An email address and payment details are needed to buy the Colour Guide: the guide is sent to that email address, and the payment cannot be made without payment details. Without them you cannot buy the guide, but you can still use the free analysis.
- Everything else, such as the first name for the guide's cover, is optional. If you leave it out, the guide is made without it.
- Usage data is collected automatically while you use the Service; you are not asked to give it.
3. Why we process personal data
We use personal data:
- to provide the colour analysis service
- to maintain user accounts
- to process orders
- to personalise the product suggestions shown in the Service
- to provide customer support
- to develop the Service
- to prevent misuse
- to meet our legal obligations, such as accounting and VAT requirements
4. Legal bases for processing
Under the EU General Data Protection Regulation (GDPR), we process personal data on the following bases:
Performance of a contract
When we provide the service you have asked for, including a Colour Guide you have bought.
Legitimate interests
When we develop the Service, personalise the product suggestions shown in it, look after security or prevent misuse.
Legal obligations
For example accounting law, and the VAT rules that require us to keep evidence of the country in which a purchase was made.
Consent
Where we ask for your separate consent, the processing is based on that consent. You can withdraw it at any time by contacting us.
5. How we handle photos
Photos you upload are used only to carry out the colour analysis.
Authorised staff of Lepre Oy may look at a photo and its result where this is needed to check the quality of the analysis or to answer a support request. The photo does not leave the Service when this happens.
Photos are not used to train artificial intelligence models.
The colour analysis is produced automatically, but it is a recommendation. No decisions with legal or similarly significant effects on you are made solely by automated means.
Photos are not disclosed to third parties without your separate consent, other than to the service providers listed in section 8 that process them on our behalf.
Original photos are deleted automatically no later than 90 days after they were uploaded.
6. User account
You can create an account if you wish.
An account may hold:
- your email address
- the first name on your guide's cover, if you give it
- your colour analysis results
- your colour profile
- your earlier analyses
Original photos are not kept permanently in your account.
7. Disclosure of data
We do not sell personal data.
Data may be disclosed:
To our payment provider
to process payments.
To our technology providers
to run the Service.
To the authorities
where the law requires it.
8. Service providers we use
We use, among others, the following services to run the Service:
| Service | Purpose |
|---|---|
| Vercel | website hosting |
| Supabase | database |
| Supabase Storage | photo storage |
| Stripe | payment processing |
| Postmark | |
| Adtraction | routing and tracking of links to partner shops |
| PostHog | analytics |
| Third-party artificial intelligence services | producing colour analyses |
Our service providers may change as the Service develops.
9. Transfers outside the European Economic Area
Some of our service providers are based in the United States or may process data there: website hosting (Vercel), the artificial intelligence service that produces the analysis, email delivery (Postmark) and payment processing (Stripe).
Where a provider is certified under the EU–US Data Privacy Framework, the transfer relies on the European Commission's adequacy decision for that framework. Otherwise it relies on the European Commission's standard contractual clauses. You can ask for a copy of the safeguards at info@varianalyysi.net.
Our database and photo storage (Supabase) store data in the European Union. Our analytics data (PostHog) is stored in the provider's EU region (eu.posthog.com). Like our other providers, PostHog may use sub-processors; these are covered by its data processing terms and, where data leaves the European Economic Area, by the safeguards described above.
10. How long we keep data
| Data | Retention period |
|---|---|
| Original photo | up to 90 days |
| Colour Guide PDF | up to 90 days; created again on request |
| User account | until you ask us to delete it |
| Colour analysis results | for as long as the account exists |
| Purchase information, including the evidence of the country of purchase | up to 10 years from the end of the year of purchase, as accounting and VAT law require |
| Customer support correspondence | until your request and any follow-up to it have been handled |
| Products shown and clicked in the Service | 24 months |
| Usage and analytics data (PostHog) | pseudonymous; kept for as long as it is needed to understand how the Service is used, within the retention settings of our analytics provider, and deleted when it is no longer needed for that purpose |
| Server and database logs, which include IP addresses | kept by our hosting and database providers for a limited period under their own retention settings |
11. Your rights
You have the right to:
- access your data
- have inaccurate data corrected
- have your data erased
- restrict processing
- object to processing
- receive your data in a portable format, where this right applies
- withdraw your consent at any time, where processing is based on consent
You can send requests to info@varianalyysi.net.
You also have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is the Finnish Data Protection Ombudsman (Tietosuojavaltuutettu, tietosuoja.fi). You may also complain to the data protection authority of the EU country where you live.
12. Security
Lepre Oy takes appropriate technical and organisational measures to protect personal data.
Access to data is limited to the people who need it for their work.
13. Changes to this policy
We may update this privacy policy as the Service develops or the law changes.
The current version is always available at www.mycolors.net.