Privacy Policy

How we collect, use, and protect your personal data

Effective date: 14 October 2026 · Chroma Lab Digital OPC · mycolorpass.app

1. Who We Are

MyColorPass is a personal color analysis companion app operated by Chroma Lab Digital OPC, a One Person Corporation registered with the Philippine Securities and Exchange Commission. Our registered address is Bonifacio Global City, Taguig City, Metro Manila, Philippines.

For questions about this Privacy Policy or your personal data, contact us at: admin@mycolorpass.com

2. Scope

This Privacy Policy applies to all users of the MyColorPass mobile and web application, the mycolorpass.app website, and any related communications including email, in-app messaging, and marketing. It covers personal data collected from users in the Philippines and internationally. It also covers color analysis studios that use MyColorPass Studio OS, and the people who message those studios on Instagram or Facebook (see Section 12).

3. Data We Collect

3.1 Account data

• Full name and email address — collected at signup
• Password (stored as a hashed value — we never store plaintext passwords)
• Profile information you choose to provide: profile photo, location preferences

3.2 Color analysis data

• Your color season result
• Wardrobe items you add: photos, Munsell notations, tags, categories
• Train game results and quiz answers
• Notes from your color analysis session if entered into the app

3.3 Payment data

• Subscription tier and billing cycle
• Transaction history (amount, date, status)

We do not store your full credit card number, CVV, or bank account details. Payment processing is handled by Paddle (international) and PayMongo (Philippines). Their privacy policies govern how payment data is stored and processed.

3.4 Session data

• Whether you are a verified studio client
• Session date on record, used to determine founding rate eligibility
• Mobile number and Instagram handle, if provided at the time of your booking

3.5 Usage and analytics data

• Pages and features accessed within the app
• Taps, clicks and other interactions within the app
• Session duration and frequency
• Device type, operating system, browser
• Session replays of in-app interactions, including the visual content of features that use image processing (e.g. Scan, Recolor) — photos you submit to these features may appear in our replay recordings

Analytics are collected through PostHog and Amplitude. Both start only after you accept analytics cookies, and stop as soon as you withdraw consent. When you’re signed in, your analytics are linked to your account ID, not your name or email address, so we can understand how the app is used over time. Session replays record what appears on screen while you use the app. Text you type into form fields is masked. You can opt out at any time through Cookie Preferences.

Separately from analytics cookies, our servers record a small number of account events that we need to run and support your account: your first sign-in, purchases, and changes to your subscription. These are linked to your account ID and sent to PostHog whatever your cookie choice, because they’re part of providing the service (see Section 5).

3.6 Communications data

• Email address and communication preferences
• Marketing email open and click data

4. How We Use Your Data

• To create and manage your MyColorPass account
• To deliver and personalize your color analysis experience
• To process subscription payments and manage billing
• To verify studio client status and apply applicable benefits
• To send transactional emails: subscription confirmations, renewal reminders, receipts
• To send marketing emails, where you have consented
• To understand how the app is used and improve it, through analytics linked to your account ID (only with your consent)
• To comply with legal obligations under Philippine law

5. Legal Basis for Processing

We process your personal data on the following lawful bases under the Philippine Data Privacy Act of 2012 (RA 10173) and, for users in the European Economic Area, the General Data Protection Regulation (EU 2016/679):

• Contract performance (GDPR Art. 6(1)(b)) — processing necessary to provide the subscription service you have purchased, including recording your sign-ins, purchases and subscription changes so we can run and support your account
• Consent (GDPR Art. 6(1)(a)) — for analytics cookies (PostHog, Amplitude and Metricool), session replays and marketing emails. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal
• Legitimate interests (GDPR Art. 6(1)(f)) — for fraud prevention, security, and product improvement, where these interests are not overridden by your data protection rights
• Legal obligation (GDPR Art. 6(1)(c)) — for tax records and regulatory compliance

6. Data Sharing

We do not sell your personal data. We share data only with the following third-party service providers, strictly for the purpose of operating MyColorPass:

• Supabase (USA) — database and authentication infrastructure
• Paddle (UK) — international payment processing (Merchant of Record)
• PayMongo (Philippines) — local payment processing
• Loops (USA) — email marketing and transactional email
• PostHog (USA/EU) — product analytics
• Amplitude (USA) — product analytics and session replay
• Metricool (Spain, EU) — ad campaign attribution
• Netlify (USA) — web application hosting
• Cloudflare (USA) — domain and DNS management
• Anthropic (USA) — AI model that drafts replies to messages sent to studios (see Section 12)

All third-party processors are bound by data processing agreements and are required to maintain appropriate security standards. Cross-border data transfers comply with the adequacy and safeguard requirements of the Philippine Data Privacy Act.

6.1 International data transfers

For users in the European Economic Area, personal data transferred to processors outside the EEA is protected by the following mechanisms:

• Supabase (USA) — Standard Contractual Clauses (SCCs) and Data Processing Agreement
• Paddle (UK) — UK adequacy decision under GDPR Art. 45; Paddle’s own Data Processing Agreement
• PayMongo (Philippines) — no EEA personal data transferred (Philippine users only)
• Loops (USA) — Standard Contractual Clauses (SCCs)
• PostHog (USA/EU) — EU hosting available; Standard Contractual Clauses (SCCs) for US processing
• Amplitude (USA) — EU-US Data Privacy Framework (DPF) certification, with Standard Contractual Clauses (SCCs) as the fallback under Amplitude’s Data Processing Addendum
• Metricool (Spain, EU) — for EEA users, no cross-border transfer (intra-EU); for non-EEA users, transfer to an EU recipient is governed by their local data-protection regime, and the data is then subject to GDPR protections in the EU
• Netlify (USA) — Standard Contractual Clauses (SCCs)
• Cloudflare (USA) — Standard Contractual Clauses (SCCs) and EU-US Data Privacy Framework (DPF) certification
• Anthropic (USA) — Standard Contractual Clauses (SCCs) under Anthropic’s Data Processing Addendum

7. Data Retention

• Active account data: retained for the duration of your subscription plus 12 months after cancellation
• Payment records: retained for 7 years to comply with Philippine tax and accounting regulations
• Marketing consent records: retained for the duration of your subscription or until you withdraw consent
• Analytics data: retained in aggregated, anonymized form indefinitely; individual-level data deleted after 24 months

You may request deletion of your account and personal data at any time by contacting us at admin@mycolorpass.com. We will process deletion requests within 30 days, subject to legal retention obligations.

8. Your Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights:

• Right to be informed — to know what data we hold about you and how it is used
• Right to access — to request a copy of your personal data
• Right to rectification — to correct inaccurate or incomplete data
• Right to erasure — to request deletion of your data, subject to legal obligations
• Right to object — to object to processing based on legitimate interests
• Right to data portability — to receive your data in a structured, machine-readable format
• Right to withdraw consent — for marketing and analytics, at any time, without penalty

To exercise any of these rights, contact us at admin@mycolorpass.com. We will respond within 15 business days.

International users in the European Economic Area have additional rights under GDPR, including:

• Right to restriction of processing (Art. 18)
• Right to data portability in a machine-readable format (Art. 20)
• Right to object to processing based on legitimate interests (Art. 21)
• Right to withdraw consent for analytics cookies at any time via Cookie Preferences (accessible from the page footer or your account profile)
• Right to lodge a complaint with your local EU/EEA supervisory authority

We are in the process of appointing a representative in the European Union under GDPR Art. 27. Until an appointment is made, you may contact us directly at admin@mycolorpass.com for any data protection inquiries.

Users in California have rights under the CCPA. We honor these rights regardless of your location.

9. Cookies and Tracking

MyColorPass uses cookies and similar tracking technologies for:

• Essential functionality — authentication session management (cannot be disabled)
• Analytics & ad attribution — PostHog and Amplitude (product analytics and session replay) and Metricool (ad campaign attribution). All require consent.

A cookie consent banner is displayed on your first visit. You may change your cookie preferences at any time by clicking ‘Cookie Preferences’ in the page footer or in your account profile.

9.1 Cookie inventory

PostHog is configured with localStorage persistence rather than HTTP cookies. The ePrivacy Directive’s consent requirements apply equally to localStorage (Article 5(3)).

Amplitude uses a first-party cookie together with localStorage and IndexedDB on your device, and loads only after you accept analytics cookies. If you withdraw consent, Amplitude stops sending events and stops recording session replays immediately. Amplitude, Inc. is based in the United States; see Section 6.1 for how transfers are protected.

Metricool’s brand tracker does not set cookies on your device per Metricool’s published documentation; the script connects to Metricool’s servers in Spain to record the visit, referrer, and UTM parameters. Loading the script and the resulting transfer of your IP address to Metricool requires your consent. If you withdraw consent, future visits will not load the Metricool script. Metricool Software, S.L. is based in Madrid, Spain (EU). For users in the EEA, your data does not leave the EEA. For users outside the EEA, transfer to an EU recipient is governed by your local data-protection laws; once your data is in the EU, it is subject to the protections of the GDPR.

10. Security

We implement appropriate technical and organizational measures to protect your personal data including:

• Encryption of data in transit (TLS 1.2+) and at rest
• Row-level security policies in our database
• Hashed password storage — we never store plaintext passwords
• Access controls limiting staff access to personal data on a need-to-know basis

In the event of a data breach affecting your rights, we will notify the National Privacy Commission (NPC) within 72 hours and affected users within a reasonable period, as required by law.

11. Children

MyColorPass is not directed at children under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, contact us at admin@mycolorpass.com and we will delete it promptly.

12. Studio Accounts and Facebook and Instagram Data

12.1 Studios as business customers

Color analysis studios use MyColorPass Studio OS (its console, online booking and chat automation) as business customers. This section covers the data we handle for a studio’s Facebook Page and Instagram professional account. When you message a studio, the studio is the business you are writing to, and Chroma Lab Digital OPC processes that data on the studio’s behalf.

12.2 What a studio connects

A studio connects its own Facebook Page, and the Instagram professional account linked to it, through Facebook Login. The studio chooses what to connect and can disconnect at any time from its console.

12.3 Platform data we receive

When you message a connected studio on Instagram or Messenger, or comment on one of its posts, we receive from Meta:

• The content of your message or comment
• Your sender ID for that Page or account and, where Meta provides it, your name and Instagram username
• The ID of the post or comment
• The studio’s Page and account IDs
• Timestamps

12.4 What we use it for

Only to reply to you on the studio’s behalf, for example by answering a booking question or sending the studio’s booking link, and to show the studio its own conversations in its inbox so a person at the studio can take over. To do this we keep, for each studio, a simple record of when and how often you have messaged or commented, so the studio can prioritise its inbox. Replies may be drafted by an AI model provided by Anthropic, using the studio’s own FAQ. Your message is sent to Anthropic only to produce that reply.

12.5 Separation, no sharing, no selling

Each studio’s data is stored under that studio’s account and is visible only to that studio. We never share it with other studios, never sell it, and do not use it for advertising or to build a profile of you across studios.

12.6 Retention and deletion

When a studio disconnects its Facebook Page or Instagram account, we delete its access tokens and all conversations captured for that account within 30 days. You can ask for your conversations with a studio to be deleted at any time by emailing admin@mycolorpass.com or by asking the studio. We complete deletion requests within 30 days, as described in Section 7.

12.7 Your rights

Section 8 applies to this data. For a request about a specific studio, tell us which studio, and the Instagram or Facebook account you wrote from.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email to registered subscribers at least 30 days before they take effect. Continued use of MyColorPass after the effective date constitutes acceptance of the updated policy.

14. Contact and Complaints

Data Protection Officer: Chroma Lab Digital OPC, admin@mycolorpass.com

Email: admin@mycolorpass.com

Address: Bonifacio Global City, Taguig City, Metro Manila, Philippines

If you believe your data privacy rights have been violated, you may file a complaint with the Philippine National Privacy Commission at privacy.gov.ph.

If you are located in the European Economic Area, you also have the right to lodge a complaint with your local supervisory authority. A list of EU/EEA data protection authorities is available at edpb.europa.eu.