Privacy Policy
Chiaro Note
Last updated: 13 October 2026
This policy explains what personal data Chiaro Note collects, why, and what rights you have over it. It is written to meet the EU General Data Protection Regulation (GDPR).
1. Who is responsible for your data
Data controller: Sofiia Korniichuk, Poland Contact: sof.k252@gmail.com
2. What we collect
When you create an account
- Email address
- Password (stored only as a cryptographic hash — we never see or store the password itself)
- Display name, if you give one
- The medium you work in (painting, drawing, and so on)
When you use the app
- Photographs of your artwork that you upload or capture
- The measurements computed from those photographs (value distribution, palette, contrast)
- Messages you send in chat sessions and the replies you receive
- Journal entries, including the title, medium, minutes logged and your written reflection
- Ideas you save
- Colour palettes you create or extract
- Which exercises you were shown and which you marked as done
When you subscribe
- Subscription status and billing dates
We do not receive or store your card details. Payments are processed by Stripe, who handle card data directly. See section 5.
Automatically
- Basic technical data needed to run the service: IP address, browser type, and error logs
- An authentication token stored in your browser so you stay signed in
We do not use advertising trackers or third-party analytics.
3. Why we use it, and on what legal basis
| What we do | Why | Legal basis |
|---|---|---|
| Create and maintain your account | To let you sign in and keep your work | Performance of a contract |
| Store your photographs, journal entries, sessions and palettes | These are the service | Performance of a contract |
| Analyse your photographs and send the results to an AI model | To produce the feedback you asked for | Performance of a contract |
| Process your subscription | To take payment | Performance of a contract |
| Keep the service secure and fix faults | To prevent abuse and diagnose errors | Legitimate interests |
| Send you service emails (password reset, billing) | To operate your account | Performance of a contract |
We do not sell your data, and we do not use your artwork or writing to train AI models.
4. Your artwork and your writing
Photographs of your work, your chat messages and your journal entries are private to your account. They are not published, shared with other users, or visible to anyone else.
To produce feedback, the content of a chat session — including the photograph and the computed measurements — is sent to an AI model provider (Anthropic (Claude), accessed through Lovable's AI gateway) for processing. This is necessary to provide the service. That provider processes it on our instructions and does not use it to train their models.
You keep all rights in your artwork. Using Chiaro Note grants us no ownership of it and no right to display, publish or sell it.
5. Who else processes your data
We use the following processors, each under a data processing agreement:
- Lovable — hosting, database and file storage (Lovable Cloud, built on Supabase)
- Stripe — payment processing (Stripe is a separate controller for card data; see stripe.com/privacy)
- Anthropic (Claude), accessed through Lovable's AI gateway — processing chat content to generate replies
- Lovable Cloud — sending account emails (password reset, billing notices)
Some of these providers operate outside the European Economic Area. Where that happens, transfers are covered by the European Commission's Standard Contractual Clauses or an equivalent safeguard.
6. How long we keep it
- While your account is open: for as long as you keep it
- After you delete your account: your personal data and uploaded files are deleted within 30 days
- Billing records: retained for 5 years, as required by Polish tax law
- Error logs: 90 days
7. Your rights
Under GDPR you have the right to:
- Access — ask for a copy of the data we hold about you
- Rectification — correct anything inaccurate
- Erasure — have your data deleted
- Portability — receive your data in a machine-readable format
- Restriction — ask us to pause processing while a dispute is resolved
- Object — object to processing based on legitimate interests
- Withdraw consent — where processing relies on consent
To exercise any of these, email sof.k252@gmail.com. We will respond within one month.
You can also delete your account yourself from the account menu, which removes your data as described in section 6.
If you believe we have handled your data improperly, you may complain to the Polish supervisory authority:
Urząd Ochrony Danych Osobowych (UODO) ul. Stawki 2, 00-193 Warszawa uodo.gov.pl
8. Cookies and local storage
Chiaro Note uses only what it needs to work:
- An authentication token, so you stay signed in
- Local storage for small conveniences — a remembered filter, an unsent draft, a running timer
We use no advertising or analytics cookies, so no cookie consent banner is required.
9. Security
Passwords are hashed. Data is transmitted over HTTPS. Database access is restricted per user through row-level security, so one account cannot read another's data. Uploaded files are stored in a private bucket.
No system is perfectly secure. If a breach occurs that is likely to put your rights at risk, we will notify you and the supervisory authority within 72 hours as required by law.
10. Age
Chiaro Note is not intended for anyone under 16. Do not create an account if you are younger than that.
11. Changes
If this policy changes materially, we will tell you by email before the change takes effect. The date at the top shows when it was last revised.