Privacy Policy

Palette Daddy (the "Service") is operated by LJK Creative LLC ("we," "us," "our"), a California limited liability company. This Privacy Policy explains what information we collect when you use palettedaddy.com, how we use it, who we share it with, and the rights you have over it.

Notice at Collection (California residents):We collect identifiers, internet activity, approximate geolocation, and inferences. We use this information to operate, analyze, and advertise the Service. We share information with hosting, analytics, email, and advertising service providers. We "sell" or "share" personal information for cross-context behavioral advertising via the Meta and Google ad pixels, but you can opt out at any time. See "Your California privacy rights" below.

Information we collect

We collect information in three ways: information you provide directly, information collected automatically when you use the Service, and information stored in your browser.

• Information you provide.If you subscribe to our newsletter, we collect the email address you submit. We don't ask for or require any other personal information to use the Service.
• Information collected automatically. When you visit the Service, we and our service providers collect IP address (truncated by our analytics provider before storage), browser type and version, operating system and device type, pages viewed and time spent, referring URLs, approximate geographic location (country/region, derived from IP), and interaction events (e.g., features used, palette exports). This data is collected via Google Analytics 4 and via advertising pixels from Meta and Google, which also place cookies on your device.
• Information stored locally.The Service uses your browser's local storage and a small first-party cookie to remember your color, theme preference, and active palette state across visits. This information stays on your device and is not transmitted to our servers.

You can opt out of all analytics and advertising cookies via our cookie banner, your browser's Global Privacy Control (GPC) signal, or the "Do Not Sell or Share My Personal Information" link in our footer.

How we use information

• To operate, maintain, and improve the Service
• To send you the newsletter you subscribed to (we don't send unrelated marketing)
• To measure and analyze usage, traffic, and feature engagement
• To show you relevant advertising for the Service on third-party platforms (Meta, Google) and measure the performance of those ads
• To detect, prevent, and respond to abuse, fraud, or technical problems
• To comply with legal obligations

Service providers and third parties

We share information with the following service providers ("sub-processors") who process data on our behalf under contracts that restrict their use of the data:

• Vercel — hosting and content delivery (IP, request metadata)
• Google Analytics 4 — web analytics (truncated IP, device and browser info, usage events)
• Meta and Google ad platforms — advertising and conversion measurement (hashed identifiers, IP, page-level event data, cookie IDs)
• Email service provider— newsletter delivery (email address, signup timestamp). We'll update this notice with the specific provider before we send the first newsletter.

We may also disclose information when required by law, in response to valid legal process (subpoena, court order, government request), to enforce our Terms of Service, to protect the rights, property, or safety of LJK Creative LLC or others, or in connection with a merger, acquisition, financing, or sale of assets (in which case we'll provide notice before personal information is transferred and becomes subject to a different policy).

Sale and sharing of personal information

We do not sell personal information for monetary value. However, under California law (CCPA/CPRA) and similar laws, our use of the Meta and Google advertising pixels is considered "sharing" of personal information for cross-context behavioral advertising. The categories of information shared are identifiers (cookie IDs, IP address, online identifiers) and internet activity (page-level event data).

You have the right to opt out of this sharing at any time. The easiest ways:

• Click the "Do Not Sell or Share My Personal Information" link in our footer
• Decline analytics and advertising cookies in our cookie banner
• Enable Global Privacy Control (GPC) in your browser — we honor it automatically

We do not knowingly sell or share the personal information of consumers under 16 years of age.

Cookies and tracking technologies

See our Cookies Notice for the full list of cookies we use, what they do, and how to manage them.

International data transfers

We are based in the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S. and other countries where our service providers operate. For transfers from the European Economic Area (EEA), the United Kingdom, or Switzerland, we rely on appropriate safeguards with our sub-processors, including Standard Contractual Clauses approved by the European Commission, the UK International Data Transfer Addendum, or other lawful transfer mechanisms.

Your California privacy rights

If you are a California resident, the California Consumer Privacy Act ("CCPA"), as amended by the CPRA, gives you the following rights:

• Right to know what categories and specific pieces of personal information we collect, the sources, the purposes, and the categories of third parties with whom we share it
• Right to delete personal information we have collected about you
• Right to correct inaccurate personal information
• Right to opt outof the "sale" and "sharing" of your personal information for cross-context behavioral advertising
• Right to limitthe use of sensitive personal information (we don't collect sensitive PI)
• Right to non-discrimination for exercising any of these rights
• Right to data portability — to receive a copy of your personal information in a portable, readily usable format

How to exercise your rights. Email hello@ljkcreative.studio with the subject line "California Privacy Request" and tell us which right you'd like to exercise. We will verify your request by asking you to confirm details we already have on file (e.g., the email address used to subscribe). We respond within 45 days; complex requests may take an additional 45 days, in which case we'll let you know.

Authorized agents. You may designate an authorized agent to make a request on your behalf. We will require written proof of the authorization and may verify your identity directly.

Categories of personal information collected (last 12 months):identifiers (email, IP address, online identifiers, cookie IDs), internet or electronic network activity (browsing and usage data), approximate geolocation (from IP), and inferences drawn from the above (e.g., audience segments for advertising). The sources are you (when you provide information directly) and your browser/device (when collected automatically). The business purposes are operating the Service, security and fraud prevention, analytics, and advertising. We disclose to the categories of recipients listed in "Service providers and third parties" above.

California "Shine the Light" (Civil Code §1798.83). California residents may request information about our disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing.

Your EU/UK privacy rights

If you are in the European Economic Area, the United Kingdom, or Switzerland, the GDPR (or UK GDPR) gives you the following rights:

• Access — to obtain confirmation of and a copy of your personal data
• Rectification — to correct inaccurate data
• Erasure— to have your personal data deleted ("right to be forgotten")
• Restriction — to limit how we process your data
• Portability — to receive your data in a structured, commonly used, machine-readable format
• Objection — to object to processing based on legitimate interests or for direct marketing
• Withdraw consent— at any time, where consent is the legal basis (this won't affect prior lawful processing)
• Lodge a complaint with your local data protection authority

Our lawful bases for processing are:

• Consent (Article 6(1)(a)) for analytics, advertising cookies, and newsletter signup
• Legitimate interests (Article 6(1)(f)) for site security, fraud prevention, and basic service operation
• Contract (Article 6(1)(b)) where applicable for fulfilling your specific request
• Legal obligation (Article 6(1)(c)) where required by law

To exercise any GDPR right, email hello@ljkcreative.studio. We respond within one month; we may extend by two further months for complex requests, in which case we'll let you know.

Sensitive personal information

We do not collect "sensitive personal information" as defined under the CCPA or "special categories" of personal data as defined under the GDPR. Specifically, we do not collect: Social Security numbers, driver's license or government ID numbers, financial account information, precise geolocation, racial or ethnic origin, religious or philosophical beliefs, union membership, genetic or biometric data, health information, sex life or sexual orientation, contents of your private communications, or political opinions.

Automated decision-making

We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you. The audience-segment inferences generated by our analytics and advertising tools do not produce legal or similarly significant effects.

Data retention

• Newsletter email addresses — retained until you unsubscribe, then removed from the active list within 30 days. A suppression list (to prevent re-sending) is retained indefinitely unless you also request deletion.
• Analytics data — retained per the default settings of our analytics provider (currently 14 months for GA4 event data).
• Advertising data — retained per the default settings of Meta and Google.
• Local storage and cookies— retained on your device until you clear them, or until the cookie's natural expiration (typically 13 months for advertising cookies).

After the retention periods above, we delete or anonymize personal information unless we are required by law to retain it (e.g., for tax, legal, or regulatory reasons).

Children's privacy

The Service is not directed to children under the age of 16, and we do not knowingly collect personal information from children under 16. If you believe a child under 16 has submitted personal information to us, please contact us at hello@ljkcreative.studio and we will promptly delete it.

Security

We use commercially reasonable technical and organizational measures to protect personal information, including HTTPS encryption in transit, access controls on internal systems, and vendor selection focused on security posture. No system is perfectly secure, however, and we cannot guarantee absolute security.

Data breach notification

If we become aware of a breach involving your personal information, we will notify you and the relevant supervisory authorities within the timeframes required by applicable law (within 72 hours under the GDPR; without unreasonable delay under California law).

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we'll update the "Last updated" date at the top of this page. For material changes, we'll post a notice on the homepage or email subscribers. Your continued use of the Service after a change takes effect means you accept the updated policy.

Contact us

For privacy questions, requests, or complaints, contact:

LJK Creative LLC
5482 Wilshire Blvd. #290
Los Angeles, CA 90036
United States
hello@ljkcreative.studio