Privacy, without the fog.

This Privacy Policy explains how OpenLogo at openlogo.dev collects, uses, shares, and retains information when you visit the site, sign in to the dashboard, use the Logo, Search or Brand APIs, correspond with us, or appear in the public brand catalog.

OpenLogo is the operator of the service described here. Privacy, correction, and removal questions can be sent to hi@openlogo.dev.

• OpenLogo does not sell or rent personal data.
• OpenLogo does not build advertising profiles or intentionally use advertising cookies or behavioral analytics SDKs in the current app.
• Current browser storage is limited to authentication, a seven-day sidebar preference, and temporary Brand Scanner report data.
• Brand owners and individuals have a verified correction and removal channel at hi@openlogo.dev.

The information involved depends on how you interact with OpenLogo:

• directly from you when you sign in, configure a workspace, contact us, or request a public sponsor acknowledgement;
• from Google when you choose Google sign-in;
• from API and HTTP requests, browsers, devices, and related security signals;
• from publicly accessible brand websites requested through the service; and
• from Cloudflare infrastructure used to deliver, protect, store, cache, and observe the service.

Where applicable, OpenLogo relies on the following purposes and legal bases:

• Contract or steps you request: provide, secure, and administer the service, account, workspace, API keys, support, and requested API responses.
• Legitimate interests: protect systems, prevent abuse, meter usage, troubleshoot failures, improve reliability, understand operational demand, and maintain a useful public brand catalog, balanced against affected rights.
• Consent: publish optional sponsor information or send optional communications where consent is required. You may withdraw consent.
• Legal obligations and rights: comply with law, respond to valid legal process, keep required records, and establish, exercise, or defend legal claims.

OpenLogo is intended to index business and brand information, not to build profiles about individuals. Automated tools contact the public website requested through the service and may retrieve public HTML, CSS, metadata, and a small number of brand assets. OpenLogo may store the resulting profile, assets, source URLs, and provenance.

Catalog records are global and are not owned by the requesting workspace. Public pages can include personal information in some circumstances—for example, a sole trader’s name. You can request a correction, brand-record removal, or exercise applicable privacy rights by emailing hi@openlogo.dev.

OpenLogo may share or make information available to:

• Cloudflare for Workers hosting, D1 database services, R2 asset storage, Images processing, caching, rate limiting, security, and observability;
• Google when you choose Google sign-in;
• the public, only for sponsor information a sponsor asks us to acknowledge publicly;
• authorities, courts, and professional advisers when required by law or reasonably necessary to protect rights, users, and systems; and
• a successor involved in a merger, financing, reorganization, or transfer of the service, subject to appropriate protections and this policy.

OpenLogo does not sell or rent personal data and does not share it for cross-context behavioral advertising.

OpenLogo keeps information only as reasonably needed for the purposes described here:

• account and workspace data while the account is active and for a limited period after deletion when needed for security, legal, or recovery purposes;
• sessions until they expire or are revoked;
• API usage, security, and audit data as needed for metering, abuse prevention, troubleshooting, and legal obligations;
• brand data until it is updated, no longer useful, or removed;
• correspondence as needed to resolve and document a request; and
• cache and backup copies until they expire or are overwritten on limited operational cycles.

Retention can be shorter or longer where deletion is requested, security requires preservation, or law requires or permits it.

The current app uses essential authentication cookies so sign-in and the dashboard work, a seven-day cookie that remembers the sidebar preference, and sessionStorage that temporarily carries a Brand Scanner report within the browser session.

Google may set or read its own cookies during Google sign-in under Google’s privacy policy. Blocking essential cookies can prevent sign-in or dashboard features from working. OpenLogo does not intentionally use advertising cookies or a behavioral analytics SDK in the current app.

OpenLogo uses reasonable technical and organizational measures designed to protect information, including access controls and hashes for API tokens and request-IP telemetry where applicable. No internet service, transmission, or storage system can guarantee absolute security. Keep your credentials secure and report suspected incidents to hi@openlogo.dev.

OpenLogo is an internet service. Cloud and sign-in providers may process information in countries other than the one where you live. Where applicable law requires transfer protections, OpenLogo and its providers must use the protections required for that processing.

Depending on where you live and subject to legal conditions and exceptions, you may have rights to access, correct, delete, restrict, or object to processing; receive portable data; withdraw consent; and complain to your local data-protection authority.

Email hi@openlogo.dev to make a request. We may ask for information reasonably necessary to verify identity and authority. Authorized agents may also need to provide proof of authority. OpenLogo will not discriminate against you for exercising applicable privacy rights.

For a logo or brand record: a brand owner or authorized representative should identify the affected domain or asset, state the correction or removal requested, and provide enough information to verify authority. We acknowledge requests promptly and, once reasonably verified, remove or disable the active catalog/API record within 24 hours or offer a suitable correction.

For personal data: we act promptly and aim to remove eligible data from active systems within 24 hours after verification. Applicable statutory response periods, legal retention, security and fraud-prevention records, and backup cycles may require a narrower or longer process. We will explain when an exception affects the request.

Browser, CDN, downstream-user, archival, backup, security, fraud-prevention, or legally required copies may persist for a limited period. Those copies do not justify continuing to serve a removed active brand record. Send either kind of request to hi@openlogo.dev.

OpenLogo is a developer service and is not directed to children under 13. We do not knowingly collect personal data from children under 13. If you believe a child provided personal data, email hi@openlogo.dev so we can investigate and remove eligible information.

We may update this policy as OpenLogo’s service, practices, or legal obligations change. The date at the top will show the latest version, and we will provide reasonable notice of material changes when appropriate.

For privacy questions, rights requests, corrections, or removal, contact OpenLogo at hi@openlogo.dev.