Privacy Policy

1. Who we are

DeepFocusLab Tech OÜ (“BrushKit”, “we”, “us”), Narva mnt 7-636, Kesklinna linnaosa, 10117 Tallinn, Harju maakond, Estonia, makes the BrushKit app for iPad and iPhone (the “App”) and runs the BrushKit website (the “Site”). We are the controller of the personal data described here. Questions go to support@deepfocuslab.tech.

2. The short version

• BrushKit doesn't ask you to create an account. We don't ask for your name, and you don't need to give us an email address to use the App.
• We collect how the App is used (which packs are viewed, downloaded and installed) so we can improve it, recommend brushes and decide what to make next.
• Apple processes payments. We never see your card details.
• We only use your device's advertising identifier if you allow tracking when the App asks.
• We don't sell your personal data.

3. What we collect

In the App

On the Site

When you visit the Site we collect standard web data through cookies and similar technologies: pages visited, the link or ad that brought you here, browser and device type, approximate location from your IP address, and clicks on the App Store button.

We don't knowingly collect sensitive data, such as health, religion or biometric data, and you don't need to give us any to use BrushKit.

4. How we use it and our legal bases

If you live in the EU, UK or a country with similar law, we rely on these legal bases:

• To provide the App and Premium (performance of our contract with you): delivering packs, unlocking and restoring purchases, invite rewards, support.
• To improve and secure BrushKit (our legitimate interests): analytics about how the App is used, bug fixing, fraud prevention and deciding what to build.
• To personalise (our legitimate interests): showing packs that fit the styles you pick and use.
• With your consent: push notifications, tracking across other companies' apps and websites (IDFA), marketing emails, and non-essential cookies on the Site where consent is required. You can withdraw consent at any time.
• To meet legal obligations: tax, accounting and responding to lawful requests.

5. Tracking and advertising

On iPad and iPhone, the App asks for permission before it accesses your advertising identifier (IDFA) through Apple's App Tracking Transparency prompt. If you choose Ask App Not to Track, we don't access the IDFA, and attribution relies only on aggregated, privacy-preserving methods such as Apple's SKAdNetwork. You can change this any time in your device's Settings → Privacy & Security → Tracking.

On the Site, we use Google Analytics and Google Tag Manager to understand visits, and advertising pixels (such as Meta's) to measure our ads. You can block or delete cookies in your browser settings.

6. Who we share it with

We use trusted service providers to run BrushKit. They process data on our behalf, under contracts that limit how they can use it:

We may also share data if the law requires it, to protect our rights or our users' safety, or as part of a merger or sale of the business, in which case this policy continues to apply. We don't sell your personal data, and we don't share it for cross-context behavioural advertising unless you've allowed tracking.

7. International transfers

Some of our providers are based in the United States and other countries outside the EU and UK. When we transfer personal data there, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK Addendum, or the EU–US Data Privacy Framework where the provider is certified.

8. How long we keep it

We keep personal data only as long as we need it for the purposes above. Usage and analytics data is kept for up to 24 months, then deleted or anonymised. Purchase records are kept as long as tax and accounting law requires. Support emails are kept for up to 2 years after the conversation ends.

9. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete or get a copy of your personal data; to object to or restrict how we use it; and to withdraw consent. California residents have the right to know, delete and correct personal information, to opt out of its sale or sharing (we don't sell it), and not to be treated differently for using these rights.

To use any of these rights, email support@deepfocuslab.tech. Because BrushKit has no accounts, we may ask for details to find your data, such as the date of a purchase. We'll respond within 30 days.

You can also:

• Turn off notifications in your device's Settings → Notifications → BrushKit.
• Stop tracking in your device's Settings → Privacy & Security → Tracking.
• Unsubscribe from emails with the link in any email.
• Delete the App to stop all data collection from it.

If you're in the EU or UK and think we've mishandled your data, you can complain to your local data protection authority. We'd appreciate the chance to fix it first.

10. Children

BrushKit is not directed at children under 13, and we don't knowingly collect personal data from them. If you believe a child under 13 has given us personal data, email us and we'll delete it.

11. Security

We use encryption in transit, access controls and reputable providers to protect your data. No system is perfectly secure, but we work to keep the data we hold to a minimum and protect it well.

12. Changes to this policy

If we change this policy, we'll update the date at the top of this page. For significant changes, we'll let you know in the App before they take effect.

13. Contact

Email support@deepfocuslab.tech or write to DeepFocusLab Tech OÜ, Narva mnt 7-636, Kesklinna linnaosa, 10117 Tallinn, Harju maakond, Estonia.