Privacy notice

Effective date: 30 October 2026

Who is responsible

Carl Glaysher, sole trader trading as Portraits with Paws, is responsible for the personal information used to run this service. Contact orders@portraitswithpaws.com or write to 51 Arethusa Road, Rochester, Kent, ME1 2UR, United Kingdom.

Information we use

We receive your uploaded photo, pet names, design choices and any backdrop description you enter. Photos may contain embedded location and other camera metadata. We check whether a location is available; we use it to suggest backdrops only when you choose “Suggest from photo location”. You can enter your own backdrop instead.

When you order, we receive contact and delivery details, your selected product, order/payment references, terms acceptance and payment status. Stripe collects payment details; we do not store full card numbers or security codes. We also keep support correspondence, delivery evidence, service and security logs, and processing-cost records. Please upload photos you are entitled to use and avoid including unnecessary information about other people.

Why we use it

We use photos, design instructions and order details to create your preview, produce and deliver your print, send order updates and handle support. This is processing needed to provide the service you request or perform our contract with you. Providing essential order and delivery information is necessary to fulfil an order.

We use proportionate service/security records to protect the studio from misuse, troubleshoot failures, measure operational costs and resolve disputes. Our legitimate interests are operating a reliable and secure service and maintaining evidence of transactions. We keep accounting information to meet legal obligations. Optional photo-location suggestions are used only at your request; choose manual entry if you do not want that feature.

We do not make decisions about legal rights, credit or eligibility using your photo. The AI creates artwork and checks likeness; its output may contain mistakes and you can review the preview before ordering. We do not use customer artwork in public examples without separate permission.

Service providers

Google Cloud hosts our application, database, queue and private image files. Google Gemini receives relevant photo/design instructions to generate and check artwork; backdrop research can involve search services. Stripe handles checkout and payments. Prodigi and its print/delivery partners receive the print file and details needed to fulfil the order. Resend sends transaction emails, which can contain a small poster thumbnail. Cloudflare provides the website gateway/security and forwards support email. We may also disclose records where the law requires it or to resolve a legal claim.

Our primary database and image storage are configured in Google Cloud’s Belgium region. This does not mean all processing is confined to the UK or Europe. Providers and their subprocessors can process information in other countries, including the US. The providers’ data-processing terms include applicable international-transfer arrangements, such as adequacy decisions and contractual safeguards, including the UK Addendum to standard contractual clauses where required. You can contact us for information about the safeguards relevant to your data.

How long we keep it

Unpurchased uploads without an associated order or unresolved processing are normally eligible for cleanup after 14 days. Active processing, payment reservations and support issues can prevent cleanup until resolved.

Purchased photo and artwork files become eligible for automated deletion 90 days after we confirm that all parcels were delivered. Delivery is initially confirmed by an operator using delivery evidence. Dispatch alone does not start this period. If delivery is not confirmed, the order remains for review. Complaints, replacements or legal issues can pause deletion. Confirmed replacement delivery starts a fresh 90-day period. If several orders use one photo, shared artwork stays until every relevant order is eligible. Deletion includes stored originals, generated previews/print files and image attachments saved in our own email-delivery records.

Deletion from active systems is separate from backup expiry. The image bucket currently has a seven-day recovery period, and database backup copies expire through configured rotation. Restricted deletion records are retained to prevent a backup restore from reintroducing expired files. Provider copies and emails already delivered to your inbox follow separate retention arrangements; deletion here does not remove mail from your inbox.

We keep financial and transaction evidence separately from artwork, including payment/refund/cost records and the terms accepted with an order. For this UK sole-trader business, tax records must generally be kept for at least five years after the relevant 31 January filing deadline; disputes, investigations or other legal requirements can justify longer retention. Support information is reviewed according to the issue and any remaining legal need. We review remaining records against these purposes rather than automatically deleting accounting evidence with the artwork.

Cookies and device storage

The studio uses an essential pp_guest session cookie, valid for up to seven days, to associate your requests and order with your browser. Local storage remembers the active draft, current step, backdrop-entry choice and checkout recovery information. Cloudflare and Stripe may set cookies needed for security and payment functions. Clearing browser storage can remove saved progress. We do not currently use optional advertising tracking in the studio. Saved draft information remains on your device until it is replaced or reset by the studio, or you clear your browser storage.

Your choices and rights

Contact orders@portraitswithpaws.com to ask about access, correction, deletion, restriction, portability or an objection to processing, where those rights apply. We may need to verify identity and retain information where a legal obligation or another valid exception applies. You can complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint/.

Provider information

You can read more in the data-processing terms of Google Cloud, Google’s paid Gemini service, Stripe, Prodigi, Resend and Cloudflare.

We update this notice when our processing changes and explain material changes where appropriate.