01 · Controller
The controller for personal data processed on this site is Piers Spencer-Phillips, trading as DERESTRICTED, Tannenstrasse 7, 82049 Pullach im Isartal, Germany. Email hello@derestricted.com. Phone +49 151 745 069 74.
02 · In one paragraph
Reading the site needs no account and sets no tracking cookie. Trends counts the colours brands put on sale. Its tools measure the photos you drop in inside your own browser, so the photo stays on your device. If you write a colour brief or ask the League a question, the text goes to AI model providers so it can be answered; your name and email do not. If you create an account, we keep your email address and what you tell us about yourself. If you pay, Stripe handles the payment and we keep a record of what you bought. We send you the emails you asked for and nothing else. There is no advertising, no analytics service and no social plug-in.
03 · Hosting and server logs
The site is hosted by SiteGround Spain S.L.U., Calle de Prim 19, 28004 Madrid, Spain, on EU infrastructure, acting as processor under Art. 28 GDPR. Our emails are also sent through SiteGround's mail servers. The web server records the usual access data for each request: IP address, time, page requested, status code, bytes sent, referrer, browser and operating system. We need this to deliver the site and keep it secure (Art. 6(1)(f) GDPR). The host keeps logs for a short period, and they are not combined with anything else.
Visit counts. To know which pages are read and where readers come from, the site counts page views and a few clicks (a plan button, a share, a form) itself, on the same server. No cookie is set and nothing is stored in your browser. Each count carries the page, the referring site's domain, the screen size class, and a visitor number. That number is a one-way hash of the day, your IP address and your browser type with a secret. The hash cannot be turned back into an address, it is not stored anywhere else, and it changes every day, so one person is one visitor for one day. No third party receives any of it. Legal basis: our legitimate interest in knowing whether the site is read (Art. 6(1)(f) GDPR). Counts are kept for twelve months.
Who reads the API. The read endpoints under /aileague/api/ are published for machines. For each day we keep a count per endpoint per browser or agent string, with the agent string itself, and whether the caller sent an authorisation header or wrote rather than read. We keep no IP address, query string or request body, and our own pages collapse into a single row a day. This tells crawlers apart from software that means to use the benchmark (Art. 6(1)(f) GDPR). Counts older than a year are deleted.
04 · Trends: photos you drop in
Measure a photo, Review my colours, Name it and Paint it measure your photo inside your browser. The photo is not uploaded to us or anyone else. A paint session is kept in your browser's own storage (IndexedDB) so that a refresh does not lose it. That storage is part of the function you asked for (§ 25 (2) no. 2 TDDDG). It stays on your device, and you can clear it at any time in your browser settings.
Save to my account (Pro). If you save a paint concept to your account, the painted parts and a small preview picture are uploaded to our server. They are stored behind a lock, open only to you and to people you give a share link to, and kept until you delete them. Legal basis: Art. 6(1)(b) GDPR.
Cut a part. The first time you press it, your browser downloads the cutting tool (transformers.js) from jsDelivr (Prospect One, Poland, with a worldwide network) and the cutting model from Hugging Face, Inc. (United States). To do that, your browser connects to their servers, which see your IP address and browser type. Your photo stays in your browser. Legal basis: Art. 6(1)(b) GDPR, because you pressed the button to use that tool.
Range review (Pro). For a range review you give us your product pages or pictures. We read and measure them for your review only. They are not added to the public count and not shown to anyone else, and we delete them when you ask or when your subscription ends. Legal basis: Art. 6(1)(b) GDPR.
05 · Trends: colour briefs and concepts
When you write a brief, or upload one as a PDF or Word file, we keep the brief, the text read from the file, the settings you chose and the concepts made from it. To make the concepts we send the brief's text, never your name, email or account, to OpenRouter, Inc. (United States), which routes it to the model providers on the panel (OpenAI, Anthropic, Google, xAI, DeepSeek, Alibaba, Meta, Mistral, Moonshot, Perplexity). Models that look things up on the web pass search terms to OpenRouter's search partner. The mood pictures in a concept are made by an image model from ByteDance, also through OpenRouter. We only use providers that, under OpenRouter's settings, do not keep or train on what we send. Providers outside the EU receive data under the standard contractual clauses in OpenRouter's terms.
A brief is private unless you choose to make it public. A brief made public appears on the site with its concepts, without your name unless you entered one. Please do not put personal data about anyone into a brief. Legal basis: performance of the service you asked for (Art. 6(1)(b) GDPR). Kept until you delete the brief or your account.
06 · Asking the League
When you type a question, it is stored with a random session identifier, a hashed IP address, your browser type, the page you came from and, if you give them, your name and email address. The wording you typed and the tidied version are kept so the record of what was asked is complete. If you make a question public, its tidied wording, the forecasts and the reasoning appear on the site and in the open record indefinitely; your name appears only if you entered one. Private questions are visible only to people who have the link.
To check and forecast a question we send its text to OpenRouter, Inc. (United States), which routes it to the model providers on the panel (OpenAI, Anthropic, Google, xAI, DeepSeek, Alibaba, Meta, Mistral, Moonshot, Perplexity). Only the question text, the resolution rule and the panel prompt are sent, never your name, email or account. Providers outside the EU receive the data under the standard contractual clauses in OpenRouter's terms. Do not put personal data about yourself or anyone else in a question: the record is public by design and cannot be unwound once forecasts are on it. Legal basis: performance of the service you asked for (Art. 6(1)(b)) and our legitimate interest in an open, permanent benchmark record (Art. 6(1)(f)).
07 · Accounts
An account is your email address, plus a name, company name, VAT number and country if you choose to enter them. Signing in uses a link emailed to you, valid once for twenty minutes; no password is stored. A session cookie (derestricted_session) keeps you signed in. It is strictly necessary for the service, contains no tracking and needs no consent (§ 25 (2) no. 2 TDDDG). If you sign in with Google, Google tells us your email address, name and a Google account identifier, and Google's own privacy policy applies to what Google records about the sign-in. Legal basis: Art. 6(1)(b) GDPR. Accounts and their data are deleted on request (see 13).
08 · Payments and invoices
Card payments are made on a page operated by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. Stripe collects your card details, name, billing address and, if you are a business, your VAT number; we never see your card number. Stripe is an independent controller for the payment itself and a processor for the customer record it keeps on our behalf; its privacy policy applies. Stripe may transfer data to Stripe, Inc. in the United States under the EU-US Data Privacy Framework and standard contractual clauses. If you pay a Trends plan by invoice, we keep the company name, address, VAT number and the contact you give us. We keep a record of each purchase and each invoice for as long as tax and commercial law require, currently up to ten years in Germany (§ 147 AO, § 257 HGB). Legal basis: Art. 6(1)(b) and (c) GDPR.
09 · Emails
We send the emails the service needs: sign-in links, confirmations, receipts and invoices, the League's result when your question settles, and your Trends reports when they are ready.
Everything else is only sent if you ask for it:
- The Colour Index numbers: one email a season, four a year.
- The League's weekly result: one email a week.
- A note when something you asked about opens.
When you sign up for any of these, we first send one email asking you to confirm. Nothing more follows until you press the link in it. We record when you signed up, when you confirmed and from which page, so we can show that you asked. Every email carries a one-click unsubscribe link. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time. We do not give your address to anyone.
10 · Writing to us
If you email us, or ask us to add a brand to the count, we keep your message and our reply for as long as we need them to deal with it and, for business correspondence, as long as commercial law requires. Legal basis: Art. 6(1)(b) or (f) GDPR.
11 · How the Colour Index is made
The count is made from product information that brands and shops publish: model names, colour names, prices and product pictures. It contains no personal data. If a page we read happens to carry someone's details (a dealer's contact, say), we do not take them.
12 · The League's public record
Public questions, every model's forecast and a summary of its reasoning (the full record is part of Pro), settlement sources and scores are published on this site and through its API and files for machines (llms.txt, agent.md). This is the point of the League. The record contains no personal data unless you chose to attach your name to a public question.
13 · How long we keep things
- Server logs: short, set by the host.
- Visit counts: twelve months.
- API counts: one year.
- Sign-in links: deleted after use or expiry.
- Questions and forecasts: indefinitely, as part of the record.
- Briefs, concepts, saved paint concepts and range-review material: until you delete them or your account.
- Accounts: until you delete them.
- Purchase records and invoices: up to ten years.
- Unconfirmed sign-ups: 30 days.
- Emails you send us: as long as needed to deal with them.
14 · Your rights
You can ask for access (Art. 15), rectification (16), erasure (17), restriction (18) and portability (20), and you can object (21) and withdraw any consent (7(3)). Write to hello@derestricted.com. Erasure removes your account and your name from anything public. Forecasts already on the League's record stay, with any name removed, because the record cannot be changed by design. You can complain to a supervisory authority; the one for Bavaria is the Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach.
15 · Changes
This notice changes when the site does. The current version is always at this address, with the date at the top.