Privacy Policy

Graphkit ("we", "us", or "our") operates graphkit.io. This Privacy Policy explains how we collect, use, and protect your information when you use our platform.

1. Information We Collect

We collect information you provide directly: your name and email address when creating an account, and payment information which is processed securely through Paddle (we never store card details on our servers). We also collect images you upload for processing. If you sign in with Google we receive your name, email address and Google account identifier. If you sign in with a one-time email link, we store your email address, a hashed (not readable) copy of the link token, its expiry time and the IP address the request came from.

We automatically collect technical data including IP address, browser type, pages visited, and tool usage for analytics and service improvement purposes. When you download Graphkit Desktop we record the date, app version, which download button was used, your browser type and a one-way hash of your IP address (not the address itself), so we can count downloads.

2. How We Use Your Information

• To provide and improve our AI tools and services
• To process payments and manage your subscription
• To send service-related emails (account confirmation, password resets, one-time sign-in links, receipts)
• To store the results you choose to save in My Graphkit and show them to you on any device
• To send marketing emails, if you opted in during registration
• To detect and prevent fraud or abuse

3. Image Data

Images you upload are processed by our AI partners (Vectorizer.ai, Remove.bg, Replicate) solely to provide the requested service. Images are automatically deleted from our servers and partner systems within 24 hours. We do not use your images to train AI models.

Many Graphkit tools (for example the image compressor, resizer, converter, color and palette tools) run entirely in your browser; the files you use with them are not uploaded to us.

3a. My Graphkit (saved results)

When you are signed in and choose Save to My Graphkit, we store that result in your account until you delete it: images you save (PNG, JPG or WebP) are stored as files on our server, and colors, palettes and gradients are stored as small data records, together with the title, tool name, collection and date. Saved results are private to your account and are only shown to you after you sign in. If you press Save while signed out, the result is kept temporarily in your own browser (for up to 2 hours) and is uploaded only after you sign in.

You can delete individual saved items, all saved items, or your whole account at any time in My Graphkit → Account.

4. Sharing of Information

We do not sell your personal data. We share data only with service providers necessary to operate Graphkit: Paddle (payments), Vectorizer.ai (vectorization), Remove.bg (background removal), Replicate (AI upscaling), and our email provider. All partners are bound by data processing agreements.

5. Cookies

We use essential cookies for authentication and session management. We may use optional analytics cookies with your consent. See our Cookie Policy for full details.

6. Your Rights

You have the right to access, correct, export, or delete your personal data. To exercise these rights, email us at privacy@graphkit.io. EU/EEA residents have additional rights under GDPR and may lodge a complaint with their local supervisory authority.

7. Data Retention

Account data is retained while your account is active. When you delete your account in My Graphkit, your name, email address, sign-in methods, saved results and their files, collections, favorites and usage history are deleted immediately; records of past payments are kept in anonymised form for 7 years as required by law. Images uploaded for AI processing (vectorizer, background remover, upscaler) are deleted within 24 hours of processing unless you choose to save the result in My Graphkit. One-time sign-in link records are deleted automatically within about a week after they expire.

8. Security

We use industry-standard security measures including HTTPS encryption, hashed passwords, and CSRF protection. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

9. Children

Graphkit is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us data, please contact privacy@graphkit.io.

10. Contact

Privacy questions: privacy@graphkit.io