Privacy policy.

1. Data controller

Owner and data controller

GENÈRIC DISSENY, S.L.

Tax identification number (NIF)

B62215611

Registered address

Carrer Mas Adei, 59, 08221 Terrassa (Barcelona), Spain

Contact

hello@fantonegram.com

Commercial Register

Barcelona, volume 32434, folio 82, sheet 211069.

2. Data we use and why

When you contact us, we receive your name, email address and message. We use them to answer your enquiry and manage the resulting correspondence. These fields are required to send the form. Please do not include identification documents, payment details, health information or other sensitive information in your message.

The form records that you consented to a response under the notice dated 16 October 2026. Newsletter subscription is a separate action through the Brevo form linked on this site. Sending an enquiry does not subscribe you or send your enquiry details to Brevo.

The hosting infrastructure also processes connection information, such as IP address, request time, requested URL and browser information, to deliver and protect the website. The contact form uses a session identifier, a security token and a pseudonymous identifier derived from the connection IP to prevent abuse. It does not save contact messages in a website database.

Newsletter subscriptions

The newsletter link opens the Fantonegram form hosted by Brevo. You enter your email address there to request a confirmation email. Your name and any contact enquiry are not sent to Brevo. Only after you click the confirmation link will you join the Fantonegram newsletter list, for new colors, palettes, wallpapers and project updates. The legal basis is your consent (Article 6(1)(a) GDPR and Article 21 LSSI). Subscription is not required to use the website, download wallpapers or contact us.

Subscription requests and confirmation records are managed by Brevo. You can withdraw consent through the unsubscribe link in each newsletter or by writing to hello@fantonegram.com. We use a dedicated Fantonegram list within the same account as other projects operated by the controller; Fantonegram subscriptions do not authorise marketing for those projects. Email blocking and unsubscribe controls may be shared across that Brevo account.

Optional audience measurement — Google Analytics

If you accept analytics in the cookie banner, we use Google Analytics 4 to understand visits, broad device and geographic information, traffic sources, color selections and download clicks. The legal basis is your consent (Article 6(1)(a) GDPR and Article 22.2 LSSI). Rejecting analytics does not limit the atlas, downloads, newsletter or contact service. The Google tag is not loaded before consent and is not loaded after rejection. Google processes technical connection information to provide the service; Google Analytics 4 does not log or store individual IP addresses.

We do not send contact form contents, email addresses, raw search text, URL query strings, user IDs or payment information to Analytics. Automatic enhanced measurement, Google signals and advertising personalisation are disabled for this implementation. Event-level retention is configured in Analytics; the current setting is two months. Analytics cookies last up to 180 days in this implementation. Aggregated reports may have different retention. You can withdraw consent using Cookie settings in the footer; analytics is disabled, its accessible first-party cookies are deleted and the page reloads without loading the Google tag.

Google Ireland Limited provides Google Analytics for this website and may use Google affiliates, subprocessors and processing outside the EEA, including in the United States, subject to applicable contractual transfer safeguards. See how Google uses information from websites, Google privacy information and Google data processing terms. See the cookie policy for the cookies and consent controls.

3. Legal grounds

For general enquiries, the legal basis is your consent (Article 6(1)(a) GDPR), which you can withdraw by writing to hello@fantonegram.com. Withdrawal does not affect earlier lawful processing. For requests about a service or quotation, processing may also be necessary for pre-contractual steps or a contract (Article 6(1)(b)). Necessary security processing is based on our legitimate interest in keeping the website and mailbox secure (Article 6(1)(f)); it is limited to that purpose. Legal obligations may require retention under Article 6(1)(c).

4. Retention

Enquiries that do not lead to a contractual relationship are kept only as needed to answer and follow up, for no longer than 12 months. Where a contractual relationship results, relevant records are kept for that relationship and subsequently restricted for applicable legal retention and liability periods.

Newsletter subscription data is kept while your subscription remains active. After withdrawal, we stop marketing and retain only the limited suppression and consent records needed to respect your choice and meet applicable legal obligations. Contact and newsletter security tokens expire after 30 minutes. The session cookie lasts until the browser session ends. Rate-limit entries have a one-hour validity and expired entries are removed when another form submission is processed. Hosting security logs and backup copies are managed under the applicable provider retention and recovery arrangements; they are not used for advertising or profiling.

5. Providers and recipients

Our hosting and email service providers, including Ilimit, process the data needed to provide those services on our behalf. Their access is limited to providing these services, subject to the processor obligations under Article 28 GDPR. We do not sell contact data. Data may also be disclosed when required by law.

Contact enquiries are sent through this hosting directly to hello@fantonegram.com. The contact submission does not use an external form platform or a third-party CAPTCHA. Optional audience measurement is described separately below; form field contents are not sent to Analytics. Fonts are hosted locally and no advertising pixels are used. We do not intentionally route the contact form through a service outside the European Economic Area. For newsletter delivery, Brevo (Sendinblue SAS, France) acts as our service provider. Brevo may use subprocessors and international transfers under its data processing terms and applicable safeguards, including European Commission standard contractual clauses where required. See Brevo privacy information and data processing terms. Newsletter links and delivery systems may record delivery, confirmation, opening and click events. We do not load Brevo scripts, fonts, widgets or tracking pixels when you browse this website.

Instagram is a link, not an embedded feed. Instagram receives a connection when you choose to visit it and applies its own privacy policy. Stripe payments are not currently enabled on this website. We will update this notice before adding a payment or other service that changes the processing described here.

6. Your rights

You may request access, correction, erasure, restriction, portability and, where applicable, object to processing, or withdraw consent. Write to hello@fantonegram.com or the registered address above. Tell us which right you wish to exercise; we will request only the additional identification needed if there are reasonable doubts about identity.

You may complain to the Spanish Data Protection Agency: www.aepd.es. We normally answer rights requests within one month, subject to the lawful extension rules.

7. Security and your choices

We use HTTPS, server-side input checks, security tokens, restricted session cookies and anti-spam limits. No system can guarantee absolute security. You may contact us directly by email instead of using the form. We do not make automated decisions with legal or similarly significant effects or create advertising profiles.

8. Updates

This policy reflects the features currently implemented. Material changes will be reflected here before the new processing is introduced. Applicable rules include the GDPR and Spanish Organic Law 3/2018 (LOPDGDD).

Free downloads and abuse prevention

Guests have one color download and one wallpaper download per connection in any rolling 24-hour period. Verified Free accounts have separate 24-hour allowances of 2 color files and 2 wallpaper files, shared across devices. Each tone and mobile/desktop file counts separately. Keyed identifiers and individual download times are stored privately; raw IP addresses are not stored. Download times older than 24 hours are removed on service use. This necessary anti-abuse processing is independent of optional analytics consent. Guest users sharing a public IP share the guest allowance.

The download confirmation uses sessionStorage to remember whether it has been shown during this tab session. It does not change server-side allowances or enable analytics.

Aggregate download counts

We count download responses served by the server by calendar day (Europe/Madrid), color reference, tone and wallpaper format (mobile or desktop). These aggregate counters contain no visitor names, email addresses, IP addresses, cookie identifiers or individual browsing history. They are separate from Google Analytics and from the temporary counters used to apply rolling 24-hour download limits. They count files served, not unique people or confirmation that a file was saved on a device.

Free accounts and saved collections

Creating an account is optional. We use your email address to verify account ownership and provide 2 color downloads and 2 wallpaper downloads in any 24-hour period, with separate allowances, and saved colors, wallpapers and personal palettes. Registration asks for a password of 12 to 128 characters, stored only as a secure hash, and optionally your personal or company details. Email-verification links expire after 48 hours and password-reset links after 30 minutes; both are usable once. Pending registration details and the password hash are held in private server storage until verification. We keep your email, verification, account creation and last sign-in dates, and favorites, named projects and named color palettes until you delete your account in Mi cuenta. This processing is necessary to provide the account you request (Article 6(1)(b) GDPR). Download identifiers use a keyed hash of your account identity, rather than your email. Individual download times older than 24 hours are removed on service use.

The photo color detector is available to signed-in free members, with 2 scans in any rolling 24-hour period. A new photo analysis counts as one scan; changing the number of colors in an open analysis does not. Random scan request identifiers and their use times are saved privately with the account to apply this limit; uses older than 24 hours are removed when the tool is used. Photos are decoded and analyzed locally in your browser; they are not uploaded to or stored on our server. Only the color codes, project names and notes, and palette names you explicitly save are stored with your account. The necessary FGMEMBER session cookie is Secure, HttpOnly, SameSite=Lax, lasts up to 14 days and provides sign-in, form protection and favorites. Guest account forms also use it for security. It is separate from optional analytics; no analytics is loaded on the account page. We process temporary keyed rate-limit identifiers for your connection and email to prevent registration, login and recovery abuse, under our legitimate interest in service security. They expire after one hour and are removed on subsequent requests. Hosting and email providers process these service messages on our behalf. You can ask about your data or exercise your rights at hello@fantonegram.com.

Newsletters are separate and optional. The newsletter link opens a Fantonegram form hosted by Brevo, which asks you to confirm by email. Creating a free account never subscribes you automatically. Deleting an account removes its email, projects, favorites and palettes and revokes its sign-ins; newsletter preferences remain separate and can be changed with the unsubscribe link.

Your download history

When you download while signed in, we keep the file reference, tone or wallpaper format, and the time the server served it, to show your private download library. This is necessary to provide your requested account features. We retain up to the most recent 1,000 entries from the last 366 days, filter older entries from view and remove them when another download is recorded. Deleting your account deletes this history. Guest downloads are not added to a personal history. A served file is not proof that you saved it on your device.

Private subscription testing

Paid memberships are currently tested only with the review account. Stripe handles test checkout, billing details and test invoices. The local account stores the Stripe customer reference, subscription status, plan, paid-through date and renewal status. Test documents are not accounting invoices. General visitors cannot purchase a paid plan yet.

Photo Scan for visitors

Visitors without an account can analyze one photo per connection in any rolling 24-hour period. The photo stays in your browser and is not uploaded or saved by Fantonegram. A temporary keyed identifier derived from the connection IP and individual scan request identifiers and use times are held in private server storage to apply the limit; the raw IP is not saved in that counter. Scan use times older than 24 hours are removed when the service is next used. People sharing a connection share the allowance. Changing the number of colors for the same open photo does not use another scan. No palette is saved unless you register and choose to save it.