Privacy Policy

In plain EnglishYour logo is read in your own browser — we don't send it to an AI company. We store your account, the patterns you save, and basic usage counts. You can download all of it or delete all of it from your account page, whenever you want.

What we collect

• Account data — your email address and an encrypted password, or the details your Google account passes us if you sign in that way. We never see or store a plaintext password.
• Patterns you save — the settings that describe a pattern (engine, colours, scale), version history, and share links you create.
• Logos and images you upload — only if you save one to your brand kit. See the next section, because this one usually surprises people in a good way.
• Usage events and counters — how many generations, exports and logo imports you've run this month, so we can enforce plan limits and see which features get used.
• Exported files — where an export is produced on the server, the file is kept in private storage so you can re-download it.
• Support messages — what you write to us, plus your plan and browser details so we don't have to ask.

What happens to a logo you upload

In plain EnglishIt's read on your own computer. The tracing that turns your logo into shapes runs in your browser, not on our servers, and we never send the image to an AI model.

If you save a logo to your brand kit, the file is uploaded to a private storage bucket that only your account can read, via time-limited signed links. You can delete it from the brand kit at any time, and deleting your account deletes the files too.

What we send to the AI provider

Two features use a language model: "Describe it" in quick mode, and pattern generation and brand-palette suggestions in the studio. In every case we send text only — your description, plus our own catalogue of engines and palettes — and get back numbers and names that our engine renders. We do not send your logo, your uploaded images, your email address or your account id.

The model runs through the Lovable AI Gateway (currently Google Gemini models). Your description is transmitted to that provider to answer the request. If you'd rather nothing left our systems at all, use "Browse styles" or "Upload a logo" instead — neither involves the model.

Why we're allowed to hold it

• To provide the service you asked for — you can't have an account without account data (contract).
• To enforce plan limits and prevent abuse (legitimate interests).
• To improve the product using aggregate usage counts (legitimate interests).
• To reply when you contact us (contract / legitimate interests).

We don't sell personal data and we don't run advertising.

Where it's stored and who else touches it

• Supabase — our database, authentication and file storage.
• Lovable — application hosting, and the AI gateway described above.
• Google (via the gateway) — processes the text prompts for AI features.
• Resend — only if email notifications are switched on, to deliver support and account email.

That's the full list. No analytics vendor, no ad network, no data broker. See cookies and analytics for what's kept in your browser.

How long we keep it

• Account, patterns, versions and saved logos: for as long as your account exists.
• Usage counters: kept as monthly rows so you can see your history; removed with your account.
• Server-side export files: 30 days, then cleared — download anything you want to keep.
• Support messages: 24 months, so we have context if you write again.

Your rights

You can get a copy of everything we hold about you, correct it, or delete it. Two of those are self-service on your account page: Download my data gives you a JSON file of every row tied to your account, and Delete my account removes the rows, the stored files and the login itself. Deletion is immediate and can't be undone.

For anything else — correction, restriction, objection, or a complaint — write to us. We reply within one working day and complete requests within 30 days. If you're in the UK or EU you can also complain to your data protection authority.

Children

Pattern Lab isn't for under-16s and we don't knowingly collect their data.

Changes

We'll update the date at the top when this changes, and email you if the change is material.

Things we're not certain about (internal)

Flagged rather than guessed, for review before publication:

• Retention periods above are the intended policy, not a job that runs today — there is no scheduled purge of 30-day-old export files yet. Either build the cleanup or soften the wording.
• Whether the AI gateway provider retains prompts, and for how long, is set by the provider's own terms rather than by us. We should confirm and state it plainly instead of staying silent.
• Data residency: we haven't pinned down which region the database and storage buckets physically sit in, which matters for a UK/EU transfer statement.
• Whether Rule29 is controller or processor for logos uploaded by an agency on a client's behalf — likely controller, but worth a decision.
• Google sign-in is offered; we've not confirmed exactly which profile fields are stored beyond email.
• Public share links: a pattern shared by link is readable by anyone holding the link. That's the intended behaviour but isn't currently described in the retention section.

Contact

Privacy questions: the support form, or privacy@rule29.com.