1. Privacy summary

Authari values privacy. We try to do as much as reasonably possible locally on your device, especially inside design tools. When a tool can process a file, color, image, logo, gradient, brand guide input, contrast check, or exported design locally in your browser, we prefer that local processing model.

Uploaded design content is only seen by you by default. If you select or drag files into local Authari design tools, those files are intended to stay in your browser and are not uploaded to Authari by default. Authari does not use your creations for training, resale, public examples, portfolios, analytics datasets, or marketing unless you separately and clearly authorize that use.

This Privacy Policy explains when we do collect personal data, why, the lawful bases we rely on, your rights under GDPR and similar laws, US privacy disclosures, retention, security, payments, marketing, analytics, forms, Google Drive integration, and design tool processing.

2. Who is responsible for your data

For personal data processed through the Authari website and services, Authari is generally the data controller, meaning we decide why and how personal data is processed. Contact: hello@authari.io.

If Authari processes personal data on behalf of a business customer under a separate written agreement, Authari may act as a processor for that customer. In that case, the customer's instructions and data processing agreement may apply.

If a data protection officer, EU representative, UK representative, or additional legal entity information becomes required, this Policy should be updated with those details before launch.

3. Local-first design tools

Authari design tools may include Brand Guide Generator, LogoHex-related logo kit workflows, TwoTone, Color Board, Color Palette tools, Gradient Maker, Contrast Board, article resources, and future creative utilities.

Where technically possible, these tools process your creative content locally in your browser. Local processing may include reading a file into browser memory, generating a preview, checking contrast, extracting colors, creating a gradient, producing an export, or preparing a downloadable file without sending the underlying creative file to Authari servers.

Local browser processing can still use your device storage, browser cache, memory, downloads folder, clipboard, or connected browser APIs. Clearing your browser data, closing the tab, or deleting downloaded files may remove local tool state.

We do not intentionally inspect, upload, sell, train on, or reuse your local tool creations. We do not claim copyright in your uploaded files, logos, brand assets, images, palettes, gradients, brand guides, or locally generated exports.

Exceptions happen only when you choose a feature that requires sending data, such as creating an account, saving a hosted project, submitting a message, requesting support, paying, connecting Google Drive, sharing a file, or using a future cloud/collaboration feature that clearly requires upload.

4. Categories of personal data we may collect

Account data: name, email address, username, password or authentication data, avatar, role, company, account preferences, profile settings, language, country, billing region, subscription status, and login history.

Contact and form data: messages submitted through contact forms, support forms, quote requests, feedback forms, newsletter forms, project forms, order forms, and any files or text you intentionally attach or submit.

Project and order data: project names, order status, product selections, design notes, reorder information, previews, delivery instructions, invoice references, support history, and other data needed to provide project or order features.

Payment data: plan selected, billing name, billing email, billing address, tax information, invoices, payment status, transaction identifiers, refunds, and limited card metadata from payment processors. Full card numbers are normally handled by payment processors rather than Authari.

Marketing data: email preferences, consent records, campaign interactions, unsubscribe status, audience segment, and messages you send us about products or resources.

Analytics and device data: page views, clicks, navigation paths, browser type, device type, approximate location from IP address, referrer, timestamps, cookie identifiers, session identifiers, and performance logs. Where required, analytics cookies or similar technologies should be used only after consent.

Security and diagnostic data: IP address, login attempts, error logs, abuse signals, fraud indicators, rate-limit events, and system events needed to protect Authari and users.

Integration data: if you connect Google Drive or another integration, we may process OAuth tokens, account identifiers, permission scopes, selected files/folders, file names, export metadata, and actions you request through the integration.

Design content you intentionally submit: if you choose to upload, save, share, order, or send content to Authari, we may process the submitted file or creative data only for the purpose you selected.

5. Purposes of processing

We process personal data to provide accounts, authenticate users, operate design tools, save settings, manage projects and orders, provide support, respond to submitted messages, process payments, issue invoices, provide receipts, prevent fraud, secure the service, comply with law, send service messages, send marketing where allowed, measure site performance, improve product usability, maintain records, enforce Terms, and protect legal rights.

For forms, we use submitted data to respond to your request, route the message internally, keep a record of the conversation, prevent spam or abuse, and improve support quality. For "submit your data" style forms, we process the data you submit only for the stated form purpose unless another lawful basis applies.

7. Marketing, analytics, and cookies

We may send marketing only where permitted by law, such as with your consent or where a soft opt-in applies. You can unsubscribe using the link in marketing emails or by contacting us. Service messages, security notices, billing notices, and account messages are not marketing and may still be sent.

We may use analytics to understand how pages and tools are used, diagnose issues, measure performance, and improve Authari. Where required by EU/UK law, non-essential analytics cookies or similar tracking technologies should be disabled until you consent. You may also be able to limit cookies in your browser.

Authari does not intend to sell personal data. If future advertising, retargeting, cross-context behavioral advertising, or "sharing" under US state privacy laws is introduced, this Policy and the cookie controls should be updated before that processing begins.

8. Payments and financial data

Payment processors may process card, bank, wallet, billing, tax, fraud, chargeback, and transaction data. Authari receives limited payment information needed to confirm purchases, manage subscriptions, issue invoices, provide support, process refunds, keep accounting records, and comply with law.

Payment processors act as independent controllers or processors depending on the activity and their terms. Their privacy policies apply to their handling of payment data.

9. Google Drive integration

If you connect Google Drive, we request permissions needed for the feature you choose. Depending on the tool, this may include selecting files, reading selected files, exporting generated files, or saving files back to Drive. We aim to request narrow permissions and use them only to perform actions you initiate.

You can revoke Google Drive access through your Google account permissions. Files selected from Google Drive may be processed locally in your browser where possible, or transmitted only when the selected integration action requires it. Google remains responsible for its own services and privacy practices.

10. Sharing personal data

We may share personal data with service providers and processors that help operate Authari, such as hosting, authentication, email delivery, payment processing, analytics, security, support, storage, error monitoring, and integrations. They may process data only as needed to provide services to us, subject to appropriate agreements where required.

We may also disclose data if required by law, court order, regulator request, tax authority, payment dispute, security investigation, merger, acquisition, financing, sale of assets, or to protect rights, safety, users, and the public.

We do not sell your uploaded design content, and we do not use your local tool creations for our own purposes.

11. International transfers

Authari may use providers located in the European Economic Area, the United Kingdom, the United States, and other countries. Where personal data is transferred internationally and GDPR applies, we rely on appropriate safeguards such as adequacy decisions, Standard Contractual Clauses, transfer impact assessments, or other lawful mechanisms.

12. Retention

We keep personal data only as long as reasonably needed for the purposes described in this Policy, including providing services, maintaining accounts, resolving disputes, enforcing Terms, preventing abuse, and meeting legal, tax, accounting, security, and audit obligations.

Typical retention may include: account data while the account exists; support messages for the support lifecycle plus recordkeeping; invoices and tax records for legally required periods; security logs for a limited security period; marketing consent records until withdrawn plus suppression records; and local tool content only on your device unless you intentionally submit or save it to a hosted feature.

13. Security

We use reasonable technical and organizational measures designed to protect personal data, such as access controls, least-privilege practices, encryption where appropriate, provider security review, monitoring, and local-first processing where practical. No system is perfectly secure, and you are responsible for maintaining strong passwords, protecting devices, and controlling access to your browser and downloaded files.

14. Your GDPR and European privacy rights

Depending on your location and the processing, you may have the right to access, correct, delete, restrict, object, port your data, withdraw consent, complain to a supervisory authority, and receive information about automated decision-making. Withdrawing consent does not affect processing already performed before withdrawal.

You may contact us at hello@authari.io to exercise rights. We may need to verify your identity and may refuse or limit requests where permitted by law, such as where retention is required for legal claims, fraud prevention, tax, accounting, or another legal obligation.

15. US state privacy disclosures

Residents of California and other US states may have rights to know/access, delete, correct, receive a portable copy, opt out of sale, opt out of sharing for cross-context behavioral advertising, limit use of sensitive personal information, and not be discriminated against for exercising privacy rights.

Authari does not intend to sell personal information or share it for cross-context behavioral advertising. If this changes, we will update this Policy and provide required opt-out mechanisms.

Categories of personal information we may collect include identifiers, commercial information, internet or network activity, approximate geolocation from IP address, professional or business information you provide, inferences from product interactions, and user-submitted content. Sources include you, your device, service providers, payment providers, analytics providers, and integrations you connect.

16. Children

Authari is not intended for children under 13, and we do not knowingly collect personal data from children under 13. If GDPR child consent rules or stricter local age rules apply, users must meet the applicable age or have appropriate parental consent.

17. Automated decision-making

Authari does not intend to make decisions with legal or similarly significant effects based solely on automated processing. We may use automated systems for security, fraud prevention, analytics, spam filtering, and product functionality.

18. Changes to this Policy

We may update this Privacy Policy as Authari changes. Material updates may be announced through the site, account, email, or another reasonable method. The effective date shows when this version applies.

19. Contact and requests

For privacy questions or requests, contact hello@authari.io. Please include the email associated with your account and the right you want to exercise. Do not send passwords or unnecessary sensitive data.

Legal note: this Privacy Policy is a detailed operational template for Authari and should be reviewed by qualified privacy counsel before public launch, especially for exact company details, processors, cookies, Google API scopes, and regional notices.