Data Processing
Last updated: November 2026
Purpose of This Document
This page provides complete documentation of how OmniColor processes data — what data is collected, where it is processed, who processes it, and for how long it is retained. It is designed to help compliance teams, IT auditors and privacy officers verify our practices.
For the full privacy policy, see Privacy Policy. For GDPR compliance details, see GDPR Compliance.
Data Controller
Controller: OmniColor project
Contact: privacy@omnicolor.pages.dev
Role: Data controller (we determine purposes and means of processing)
Categories of Data Processed
Data That Never Leaves Your Device
The following data is processed entirely in your browser and never transmitted to any server:
- Images uploaded to tools — processed via Canvas API, never uploaded
- Color selections and palette generations — computed locally in JavaScript
- Saved colors and preferences — stored in browser localStorage
- Cookie consent preference — stored in localStorage
- Recent color history — stored in localStorage
- Gradient edits — handled locally until you copy or download
- Tool interactions — do not generate any telemetry
Data That Reaches Our Servers
The following minimal data reaches Cloudflare (our hosting provider):
- IP address — standard HTTP protocol, retained in logs up to 30 days
- Browser user-agent string — standard HTTP, retained in logs up to 30 days
- Requested URL — standard HTTP, retained in logs up to 30 days
- HTTP request timestamp — standard HTTP, retained in logs up to 30 days
- Referrer header (if sent by your browser) — retained in logs up to 30 days
This is standard web server log data. We do not augment it with any additional tracking, cookies, or identifiers.
Data You Provide Directly
When you contact us, you provide:
- Email address — for reply purposes only
- Name (optional) — to personalize our reply
- Message content — retained until inquiry resolved
Contact form submissions are delivered via your email client (mailto handoff). We do not store contact form submissions on any server.
Data Collected by Third-Party Services
Only if you have opted in via the consent banner:
- Adsterra: May set advertising cookies, see IP address, browser info, and visited page for ad targeting. Adsterra privacy policy
- Google AdSense: May set advertising cookies and use its own tracking. Google advertising policies
If you have not opted in, neither ad network receives any data from your visit.
Data Processing Purposes
Legitimate Interest (no consent required)
- Site delivery: Serving HTML, CSS, and JavaScript files to your browser
- Security: Detecting and preventing abuse, DDoS attacks, and illegal access attempts
- Error logging: Understanding when the site is broken so we can fix it
Consent-based (opt-in required)
- Analytics: Understanding aggregate site usage to prioritize improvements
- Advertising: Displaying advertisements and (if accepted) personalizing them
Contractual (only if you contact us)
- Support response: Replying to your inquiry, issue report, or feedback
Data Flows
Typical user visit (no consent)
- You request a page from omnicolor.pages.dev
- Cloudflare edge serves the page (IP, user-agent, URL in edge logs)
- Page loads in your browser; all tools run locally
- No cookies set except a single localStorage entry remembering you have not yet decided on consent
- No data reaches any analytics or advertising service
Typical user visit (with consent)
- Same as above, plus:
- Ad network scripts load (Adsterra, Google AdSense)
- Ad network sets cookies and receives IP, user-agent, and page URL
- Ad personalization may occur based on those cookies
Image upload for color extraction
- You select an image via file input
- Image is read into browser memory via FileReader API
- Image is processed on an offscreen Canvas
- Colors are extracted and displayed
- Image is released from memory when you navigate away
- At no point is the image uploaded to any server
Contact form submission
- You fill out the contact form in your browser
- On submission, your browser opens your default email client with a prefilled mailto link
- You send the email through your own email provider
- We receive it in our inbox and reply
- No data passes through our servers
Data Retention
| Data Type | Retention | Location |
|---|---|---|
| Cloudflare edge logs | 30 days | Cloudflare |
| Contact emails | Until resolved + 12 months | Email inbox |
| Local storage preferences | Until you clear | Your browser |
| Advertising cookies | Per ad network policy | Your browser |
| Uploaded images | Never stored | Browser memory only |
| Generated palettes/colors | Never stored on server | Your browser |
Sub-processors
OmniColor uses the following sub-processors (details on our Sub-processors page):
- Cloudflare, Inc. — Hosting and CDN (essential to operate the site)
- Adsterra — Advertising (only if you consent)
- Google LLC — Advertising via AdSense (only if enabled and you consent)
International Data Transfers
Cloudflare processes data in geographically-distributed data centers, which may include centers outside your country of residence. Cloudflare is certified under the EU-US Data Privacy Framework and maintains Standard Contractual Clauses for other transfers.
For more details, see Cloudflare's trust hub.
Technical and Organizational Measures (TOMs)
Security measures to protect data:
- Encryption in transit: TLS 1.2+ for all connections
- Encryption at rest: Cloudflare Pages stores static files encrypted
- Access control: Administrative access requires 2FA
- Architecture: No database, no user accounts, no stored personal data
- Minimal data: We do not collect what we do not need
- Regular security reviews: See Security Policy
Data Subject Rights
Your rights regarding your personal data:
- Access: Request a copy of your data (typically nothing)
- Correction: Correct inaccurate data
- Deletion: Request deletion (typically: clear your browser's site data)
- Portability: Receive your data in a portable format
- Objection: Object to processing
- Restriction: Restrict processing
- Withdraw consent: Any time
To exercise these rights, contact privacy@omnicolor.pages.dev.
Data Protection Impact Assessment
Because OmniColor processes minimal data, does not engage in systematic monitoring, does not process sensitive data, and does not track individuals across contexts, a formal Data Protection Impact Assessment (DPIA) under Article 35 of GDPR is not required. However, we have conducted an internal privacy risk assessment and documented it here.
Compliance Frameworks
- GDPR: EU General Data Protection Regulation
- CCPA/CPRA: California Consumer Privacy Act (as amended)
- ePrivacy Directive: EU cookie rules
- PECR: UK Privacy and Electronic Communications Regulations
Changes and Updates
We will update this page when our data processing changes. Material changes will be announced on the homepage.
Contact
Data protection inquiries: privacy@omnicolor.pages.dev
Security issues: security@omnicolor.pages.dev
General: hello@omnicolor.pages.dev