1. Who this policy covers
This policy describes Paw Portrait Lab at pawportraitlab.com. Contact [email protected] for privacy questions or requests.
2. Information we process
- Uploaded photos, selected portrait templates, optional memorial settings, generated images and task identifiers.
- IP addresses and technical request information processed by our infrastructure. Free-use counters use keyed hashes of IP and browser identifiers; hashing does not make this data necessarily anonymous.
- A browser identifier and recent generated-result references stored in your browser’s local storage. Clearing local storage removes those local references, not server-side records.
- Support emails and information you choose to include.
- Production site analytics through Google Analytics, including page and device/browser usage information; analytics may use cookies or similar identifiers.
Google sign-in provides an account identifier and verified email; we store account and session records. Checkout availability depends on the environment and account permissions. Orders will involve identifiers, products, amounts, payment status and credit records. We do not ask you to send passwords or full card details by email.
3. Why we use it
We process this information to generate and deliver portraits, enforce free-use limits, diagnose failures, secure the service, respond to support and privacy requests, and understand site usage. When accounts and payment are enabled, we will also use it to authenticate users, maintain orders and credits, prevent duplicate charges and handle billing disputes. Where a legal basis is required, the applicable basis depends on the activity and jurisdiction, including providing requested services, legal obligations, legitimate interests and consent where required.
Protected generation stores task records, IP-hash allowances, original images and watermarked previews on our private Railway storage. Google login and guest cookies control access. Prompt Sift receives the final generation prompt for safety review; this does not constitute image-content review.
4. Service providers and sharing
- Supabase: stores uploaded images and free-use records. Time-limited signed image links allow the generation provider to fetch uploads.
- APIMart and its upstream model service: process the selected prompt and input image to generate the result. See AI Technology.
- Railway and Cloudflare: provide hosting, delivery, security and related request processing.
- Google: supplies analytics and externally loaded website fonts; Google sign-in provides your verified email and account identifier.
- Cloudflare Email Routing and our destination email provider: deliver support messages.
- Waffo Pancake: checkout, order processing and related payment/tax services. Its own policies apply to information it collects.
We may disclose information where necessary to comply with law, protect users or investigate abuse. Providers may process information in countries other than yours. We do not guarantee that upstream providers never retain data or use it for model improvement without verifying their applicable terms and configuration.
5. Retention and deletion
Uploads, generation records and technical records may remain in our systems and provider systems after generation. A signed link’s expiry does not delete the underlying file. We do not promise automatic deletion after 30 days. Please contact us to request deletion.
Contact [email protected] to request deletion or ask about retained data. Include a task reference, approximate generation date or account email where available, but do not resend sensitive photos unnecessarily. We may need to verify your relationship to the data. Records needed for security, disputes or legal obligations may be retained, and backups or provider copies may take additional time to be removed.
6. Security and your choices
Uploads use a private storage bucket with signed access links. Treat image and result links as confidential: access links can be shared, and the current legacy result flow is not a fully account-protected private gallery. No online system is perfectly secure.
You may request access, correction or deletion and raise an objection or withdraw consent where applicable. Your rights depend on local law, and you may have a right to complain to a data protection authority. Browser settings can restrict cookies and clear local storage, although this may affect features. The site does not currently offer a built-in analytics preference panel. You can contact us with questions about analytics and available choices.
7. Children and policy updates
This service is intended for pet portraits, not the collection of children’s personal information. Do not submit sensitive information about children. If you believe a child’s data has been provided improperly, contact support so we can investigate. We will update this policy when processing changes, including when account, payment or generation processing changes.