Privacy policy

Effective October 8, 2026. Draft for launch: complete, and still to be reviewed by counsel before the site goes live on its own domain.

The short version: we need your pet's photo to paint it, your email to send the receipt and the sign-in link, and an address to ship to. We remove location data from every photo the moment it arrives, we never send your photo to an advertiser, and we keep your photo in your account so you can use it again, until you ask us to delete it. We measure our Facebook and Instagram ads with Meta's pixel, on every visit (section 9).

1. Who we are

PetPaintings, a trade name of Steel Dragon LLC, a Delaware limited liability company (“we”, “us”), runs classicalpetpaintings.com. We turn a photo of your pet into a painting in a style inspired by a real artist and have it printed, framed, and shipped by a print partner. We are the data controller for the personal data described here. Reach us at hello@classicalpetpaintings.com.

2. What we collect

By source, and only what each step needs:

When you upload: the photo, its size and format, and the crop you chose. Location and camera metadata (EXIF) is removed before the file is stored.
When you preview: the styles you tried, the portraits we generated, and which one you approved. Previews need a verified email (see section 3).
When you order: your name, email, shipping address, what you bought, and the amount. Card details go straight to Stripe; we never see or store the card number.
When you sign in: your email and a session token. Sign-in is by emailed link or with Google; there is no password. With Google we also receive the name and picture on your Google profile.
When you ask for a discount code: your email, the words shown, and the time, browser and approximate IP address of the request and, when you confirm through the link in the email we send, of that confirmation.
When you write to us: your message, your email, and any photos you attach (for a damage claim, the print and the box).
When you use the site: pages viewed, buttons used, browser and device type, an approximate location from your IP address, and error reports if something breaks. See section 9 for how this runs.
If you are an artist: the drawing you send us, your email, and your note.

3. How we use it

To paint the portrait: the photo and crop go to the image model; the result comes back to you as a low-resolution preview.
To make and deliver the print: the approved portrait, your name, and your address go to the print partner. Your original photo never does.
To run your account: sign-in links, order status, shipping emails, and the receipt. These are not marketing and you cannot opt out of them while you have an open order.
To send our newsletter to an address whose owner confirmed it by the link in our email. Every newsletter email carries a link to unsubscribe, which works at once.
To remind you of an order you started and did not pay for: up to three emails, to the address you typed at checkout, when the order would ship to the United States. Each one carries a link to unsubscribe, which works at once. Elsewhere we send these only after you confirm our newsletter.
To email you your painting when you ask for it, and to remind you of a painting you made and did not order: up to three emails in all, to the address you typed beside the painting or signed in with. We keep the country your request came from, and nothing more exact, to decide this: the reminders go to visitors in the United States, and elsewhere only after you confirm our newsletter. The same country goes, hashed, with the event that tells Meta your preview is ready (section 9). The painting you asked for is sent wherever you are. Each email carries a link to unsubscribe, which works at once.
To answer you: support, cancellations, damage claims, refunds.
To keep the site honest: a human check (Cloudflare Turnstile) before an upload, rate limits on previews, and an automated safety check on uploads and on generated portraits.
To improve the site: which styles and sizes people choose, where they stop, and what breaks. In aggregate.
To advertise: we tell Meta (Facebook and Instagram) when a page or a product is viewed, a preview is made, something is added to the cart, a checkout starts, and an order is paid, so that we can measure our ads and Meta can show them to people likely to want a portrait. Section 9 says what is sent and how to turn it off.
To meet the law: tax records for orders, and responding to lawful requests.

We do not share personal data with data brokers, and we do not use your photos or portraits to train any model, ours or anyone else's. The events in section 9 are the only personal data we share for advertising.

4. How photos and portraits are handled

Uploads go from your browser straight to our storage (Cloudflare R2) over an encrypted, single-use link. EXIF metadata, including GPS, is stripped on arrival.
Your photo belongs to your session or account. The site shows it only to you, and it is never shown publicly.
We keep your photo in your account so you can use it for another portrait later. We delete it when you ask (section 10).
To paint a preview or the final, the photo is sent to Google's Gemini image models under Google's paid API terms, which do not use API inputs or outputs to train their models. If Gemini is unavailable we may use a fallback model provider on the same terms; the current provider list is in section 6.
Previews are low-resolution. The full-resolution portrait is only rendered after you pay.
The print partner receives the finished portrait file, your name, and your shipping address, never the original photo.
A portrait you share with the share link is public at that link, without your name, until you ask us to delete it.
Our terms do not allow photos of people. A photo the safety check rejects, or one we cannot read, is refused and deleted; we tell you why on the page.

5. Our legal bases

Where a law such as the GDPR or the UK GDPR applies, we rely on:

Performing our contract with you for the photo, the previews, the order, the shipping, and the account.
Our legitimate interests in running a secure site, preventing abuse, answering support, and understanding how the site is used, in ways that do not override your interests.
Your consent for anything optional: marketing email (off by default), and, in the European Union, the United Kingdom, Iceland, Liechtenstein, Norway and Switzerland, Meta's pixel, its cookies, the events our server sends Meta, and Hotjar (section 9). You can withdraw consent at any time.
Legal obligation for tax and accounting records.

Each processor gets only what its job needs, under a contract that binds it to this policy:

Google (Gemini image models): the photo and crop, to paint the portrait. Fallbacks, when used: OpenAI and fal.ai, on the same no-training API terms.
fal.ai (Topaz image upscaling): the painted portrait, never your photo, to enlarge it for the print and the 4K file.
OpenAI (moderation API), when switched on: the photo and the generated portrait, to check for unsafe content. Not used for training.
Printful and Prodigi (the Fine-art print and the Luxury canvas): the portrait file, your name, and your shipping address, to print, frame, and ship. Their carriers get the address.
Stripe: payment, tax calculation, and fraud prevention. Stripe is an independent controller for the card data it handles.
Supabase: the database and sign-in. Cloudflare: photo and portrait storage, image resizing, and the human check. Vercel: hosting.
Resend: sending our emails. PostHog: product analytics and error reports. Hotjar, only when switched on: session replays, with form fields masked.
Trustpilot: your name, email, and order number, to invite you to review your order.

Meta (Facebook and Instagram) also receives the advertising events in section 9. Meta is not one of our processors: it uses those events under its own terms and privacy policy.

We also disclose data when the law requires it, to protect someone's safety, or, if the business is sold, to the buyer under this policy. We will tell you before a sale changes who holds your data.

7. Where it is stored

Our servers, storage, and processors are in the United States, with some processing in the European Union and the United Kingdom. If you are outside the United States, your data is transferred there. Where the GDPR or UK GDPR applies we rely on the processor's standard contractual clauses or an adequacy decision, and you can ask us for a copy of the safeguards.

8. How long we keep it

What	For how long
Your original photo	Kept in your account so you can use it again, until you ask us to delete it. A photo we refuse at upload is deleted at once.
Previews and the print file	90 days after your order ships, so we can reprint a damaged piece. Previews you never ordered are deleted with the photo when you ask.
Order records	As long as tax and accounting law requires (in the United States, generally 7 years), then deleted or anonymised.
Account (email, sign-in)	Until you ask us to delete it. A guest session with no order and no photo expires on its own.
Newsletter sign-up	Until you ask us to delete it. After you unsubscribe we keep only the record of your consent and send you nothing.
Support email	3 years after the last message, so we can honour a reprint or a refund.
Analytics and error logs	12 months, in aggregate after 90 days.
What Meta's events need from your browser	The two Meta cookies' values, your IP address and browser type, kept with a preview or a checkout until its event is sent to Meta, then deleted. If the event is never sent, after about 7 days.

Backups roll off within 30 days after a deletion.

9. Cookies and analytics

A session cookie keeps you signed in; it is strictly necessary and set even for a guest so your photo stays yours. Your cart lives in your browser's local storage and never leaves it until you check out. Stripe sets its own cookies on the checkout to prevent fraud.

Our analytics (PostHog) run without cookies and without a persistent identifier: nothing is written to your device, and the session is forgotten when the tab closes. Error reports go to PostHog the same way. Hotjar, when it is on, sets cookies to replay sessions; we turn it on for short studies and say so here when we do.

We advertise on Facebook and Instagram and measure those ads with Meta's pixel, a script of Meta's that runs on our pages. The pixel and our own pages set two cookies on this site: _fbp, a random number that tells one browser from another, and _fbc, which holds the id of the Meta ad you clicked, when you arrived by one. Each lasts up to 90 days, and the pixel may renew it when you come back. The pixel tells Meta the address of each page you view, and when you view a product, make a preview, add to the cart, and start checkout, with the product, the amount, and a reference code for the preview or the checkout. It does not run on the order confirmation page; our server tells Meta that the page was viewed. Like any script your browser loads, it also gives Meta your IP address and browser type, and Meta may connect these events to a Facebook or Instagram account you use in the same browser. When you are signed in, or when you give us your email on a page (to become a member or to have your painting emailed to you), we also give the pixel your email address and your account id, each as a SHA-256 hash made in your browser, so the pixel never gets the address itself. An email you give on a page is also kept in a third cookie, pp_meta_em, as that hash only, for up to 90 days, so that the pixel and our server have it on the pages you view after.

Our server sends Meta the same events as well, and the payment event, so that an ad blocker does not hide them, with the address of the page without its query, the values of the two cookies, your IP address and browser type, and your account id as a SHA-256 hash. When you are signed in, when a checkout starts and when an order is paid, it also sends your email address as a SHA-256 hash, and after you give us your email on a page, the SHA-256 hash of that address (from pp_meta_em, or for a preview, from the address kept beside your painting). With a paid order that ships, and when a checkout starts with a shipping address saved in your browser, it also sends the name, city, state or region, postal code and country of that address, each as a SHA-256 hash; for a paid order that does not ship, the same details of the name and billing address given with the payment. With a paid order, it also sends the phone number given with the payment, when one was given, as a SHA-256 hash. Other events carry the country your order ships to (pp_ship, below), and the event of a ready preview the country your request came from, each as a SHA-256 hash. Meta compares these hashes with the details of its own accounts. We keep the cookie values, IP address and browser type with the preview or the checkout only until the event is sent (section 8). None of these events carries a photo, a portrait, or a street address, and no name, email address, phone number or postal detail is sent unhashed. We do this to know which ads lead to previews and orders, and so that Meta shows our ads to people likely to want a portrait.

The pixel, its cookies and our server's events to Meta run on every visit. A Global Privacy Control or “Do Not Track” signal does not stop them, and neither does your answer on the cookie banner.

In the European Union, the United Kingdom, Iceland, Liechtenstein, Norway and Switzerland a cookie banner asks about Hotjar. Until you press “Accept”, Hotjar does not load. “Decline” keeps it that way. One cookie (pp_consent) holds your answer for six months, and a second (pp_consent_zone), for up to 30 days, holds only that you are in one of these countries, not which one. We ask once: your answer is kept for six months, and after that the banner asks again. Meta's pixel is not part of this choice. PostHog is not part of it either, because it writes nothing to your device.

When you arrive by a creator's or an editor's link, or type an editor's code in your cart, one cookie records which link it was, for up to 45 days, so that they are credited, and their code's discount is given, if you order. It holds the link and nothing about you, and it is never read by another site.

When you first arrive, and again each time you arrive by one of our ads, one cookie records how you found us (the campaign tags of the link you followed, the site you came from, and the page you landed on), and a second records which of our own short links you came by, when you came by one. Both last up to 30 days, so that we know which of our own posts lead to orders. They hold nothing about you, they are never read by another site, and neither is set or stored when your browser sends “Do Not Track” or Global Privacy Control.

When you arrive by one of our ads, one cookie (pp_funnel) records that you did, for up to 30 days, so that your order gets the ad's offer. A second (pp_funnel_ui), for the same time, lets the page show that offer. Neither holds anything about you, and neither is read by another site.

One cookie (pp_ship) holds the country your order ships to, for up to a year, so that the shop shows the pieces we can send there and the right currency. It starts as the country your connection comes from, when that is one we ship to, and holds the country you choose under “Ship to” after that. It holds nothing else about you, and it is never read by another site.

One cookie (pp_region) holds whether your connection comes from the United States or the European Union, for up to 30 days, so that a page can say where a piece is made. It holds the region alone, never the country or your address.

Blocking cookies in your browser leaves the site working apart from staying signed in. “Do Not Track” and Global Privacy Control signals stop the two cookies that record how you found us, and nothing else.

10. Your rights and choices

Wherever you live, you can ask us to:

Access the personal data we hold about you, and get a copy in a portable form.
Correct it (an address, an email).
Delete it: your photos, portraits, and account go within 45 days. Order records stay as long as section 8 says, with the personal fields removed where the law allows.
Object to processing based on our legitimate interests, or restrict it while we check a claim.
Withdraw consent for anything you consented to, such as marketing email. For Hotjar (section 9), clear this site's cookies in your browser and the banner asks again.
Not be discriminated against for using these rights.

Email hello@classicalpetpaintings.com from the address on your account, or from your account page. We answer within 30 days, and we may ask you to confirm the request from that email. California residents: sending the events in section 9 to Meta for advertising is “sharing” personal information as the CCPA defines it. A Global Privacy Control signal does not stop it. EU and UK residents can also complain to their data protection authority.

11. Children

The site is for adults. We do not knowingly collect personal data from anyone under 16, and our terms do not allow photos of people, children included. If you think a child has given us data, email us and we delete it.

12. Security

Everything travels over TLS. Your photo is stored under a long random address that no page shows, and the site serves it only to the session or account that uploaded it. Sign-in is by one-time emailed link or with Google, so there is no password to leak. Access to production data is limited to the people who run the service and is logged. No system is perfect; if a breach affects you, we tell you and the regulator as the law requires.

13. Changes to this policy

When we change this policy we update the effective date at the top and, for a change that affects what we do with your data, email the address on your account before it takes effect. The current version always lives at this address.

14. Contact

Steel Dragon LLC, doing business as PetPaintings, 131 Continental Drive, Suite 305, Newark, Delaware 19713, hello@classicalpetpaintings.com.