Privacy Policy

Last updated: 28 August 2026

This Privacy Policy explains how SU Studio (CVR: 46441311) collects, uses, and protects your information when you use BrushLens (brushlens.app).

The short version

• Your reference photos never leave your device. We never see them, store them, or process them on our servers.
• We collect only the information needed to give you access and accept payment.
• We never sell your personal information.
• We do measure whether our Facebook and Instagram ads work, which is described in full below.
• You can ask us to delete your account and data at any time.

What we collect

Account information

When you sign in or create an account, we collect:

• Email address - to identify your account and send service messages
• Name and profile picture (if provided via Google, Facebook, or Patreon login) - displayed in the app
• Authentication provider - e.g. whether you signed in with Google, Facebook, email, or Patreon

Payment information

If you subscribe to BrushLens, payment is processed by Stripe. We do not see, store, or have access to your card details. Stripe handles all payment data under their own privacy policy (stripe.com/privacy). We store only:

• Your Stripe customer ID (a reference, not your card)
• Your subscription status (active, cancelled, etc.)
• Your subscription plan and expiration date

Your reference photos and analysis data

Your photos and the analyses you perform stay on your device only. They are processed locally by your browser and stored in your browser's local storage and IndexedDB. We do not upload, store, or have any access to them.

Technical data

We use Vercel as our hosting provider, which automatically logs basic technical information about visits to brushlens.app (IP address, browser, page accessed) for security and performance monitoring. We do not use this data to track individuals.

Cookies, local storage and advertising measurement

BrushLens is advertised on Facebook and Instagram, and we measure whether those ads work. In plain terms, this is what that involves:

• The Meta pixel. Our pages load Meta's measurement script. It sets first-party cookies in your browser (_fbp, and _fbc if you arrived from an ad) and reports page views, opening the pricing options, and starting a trial.
• Ad attribution. If you arrive from an ad, the campaign identifiers in that link are stored in your browser's local storage for up to 30 days, so a later purchase can be matched to the ad that brought you. This never leaves your browser except as part of a checkout.
• Conversions API. When a trial starts or a payment succeeds, our server sends Meta a record of that event. Your email address is included only as an irreversible SHA-256 hash, never in readable form, alongside your IP address and browser type.
• Vercel Analytics. Aggregate visit counts. It sets no cookies and does not identify you.
• Google Fonts. Our pages load fonts from Google, which means Google receives your IP address as part of serving them.

Meta is established in the United States, so these transfers leave the EU. For the advertising data it receives, Meta acts as an independent data controller under its own terms.

Separately, we set one strictly necessary cookie, bl_session, which keeps you signed in. It carries no advertising data and cannot be switched off without breaking sign-in.

If you are in Europe we ask before any of this runs, and you can change that answer at any time using the Cookies link at the bottom of the front page. Wherever you are, you can also block third-party scripts or enable tracking protection in your browser, and limit activity-based advertising in your Meta account settings. BrushLens works fully either way.

What we don't do

• We don't show advertisements
• We don't sell or rent your personal information
• We don't process your reference images on our servers

How we use your information

• To provide access to BrushLens features
• To process subscription payments via Stripe
• To send transactional emails (login links, payment receipts, important account notifications)
• To respond to support requests
• To comply with legal obligations

Third-party services we use

• Stripe - payment processing
• Vercel - web hosting
• Upstash - encrypted database for user accounts
• Resend - transactional email delivery
• Google, Facebook, Patreon - optional sign-in providers (only if you choose to use them)
• Meta (Facebook/Instagram) - advertising measurement, as described above
• Google Fonts - web fonts, which receives your IP address when a page loads

Your rights (GDPR)

If you are in the EU/EEA, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data ("right to be forgotten")
• Export your data
• Object to or restrict our processing
• Lodge a complaint with the Danish Data Protection Authority (Datatilsynet)

To exercise these rights, email hello@brushlens.app.

Data retention and deletion

We keep your account data for as long as your account is active. If you cancel your subscription, we retain your account record for 12 months in case you wish to return, then delete it. You can request immediate deletion at any time by emailing hello@brushlens.app from the email address associated with your account. We will delete your data within 30 days of receiving the request.

Children

BrushLens is not directed at children under 16. If you believe a child has provided us with personal information, please contact us.

Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email to active subscribers.

Contact

Data controller: SU Studio (CVR: 46441311)
Email: hello@brushlens.app

← Back to BrushLens