Privacy policy

Controller

• PRINTED BY LEMON, S.L. · Spanish tax ID B83838516
• Paseo Imperial 14, Office 201, 28005 Madrid, Spain
• lorena@bylemon.es · +34 91 365 04 54

Data we process

• Identity and contact details: name, email, company and redesign status.
• Product context: brand, category, pack, price, channel, objective and declared messages.
• Packaging image: processed in memory to create the diagnosis and not retained as a file.
• Technical data: non-reversible image hash, dimensions, format, visual metrics, result and request identifiers. IP addresses are used transiently for abuse prevention and are not added to the report.

Purposes and legal bases

• Provide the requested diagnosis, retain its result and deliver the report: performance of the request and pre-contractual steps.
• Answer enquiries or discuss a professional packaging review: pre-contractual relationship and legitimate interest in replying.
• Send Bylemon marketing: only when the separate optional consent box is selected, and until consent is withdrawn.
• Protect the service and prevent misuse: legitimate interest in security and stability.

Providers and transfers

Hostinger provides hosting, database and email services. OpenAI acts as the artificial-intelligence provider for semantic image analysis. Both operate under their processing terms and applicable contractual safeguards.

When vision analysis is enabled, PackaPalo submits an optimized image, product context and a pseudonymous technical identifier created with a keyed hash; OpenAI does not receive the raw IP address. The request uses store: false, so the response is not saved as a retrievable API object. By default, OpenAI may retain content and metadata in abuse-monitoring logs for up to 30 days, except in the circumstances described in its terms or where the account has stricter retention controls. PackaPalo retains only the structured assessment, not the image file. Some providers may operate outside the European Economic Area under legally required safeguards.

Retention

The original image is not retained. Diagnoses that are not linked to a contact are automatically deleted after 30 days. Contact data without marketing consent is deleted after 12 months, once the report has been delivered or exhausted its retry attempts.

Marketing data is retained until consent is withdrawn. Where a professional relationship or legal obligation remains active, the necessary information may be kept for the applicable period and is then deleted or restricted as legally required.

Automated decisions

PackaPalo automatically assesses design, but does not make decisions with legal or similarly significant effects. The report is indicative and a human review can be requested from Bylemon.

Your rights

You may request access, rectification, erasure, objection, restriction and portability, or withdraw consent, by writing to lorena@bylemon.es with the reference “GDPR Rights”. You may also complain to the Spanish Data Protection Agency (aepd.es).