Privacy Policy

Last updated: March 2026

1. Controller

We are responsible for the processing of your personal data in accordance with the General Data Protection Regulation (GDPR) as applicable in the EEA/Liechtenstein.

2. What Data We Collect

Data	Purpose	Legal Basis	Retention
Pet photos you upload	AI calendar generation	Contract performance	7 days (free previews), permanent (paid orders)
Email address	Order confirmation, download links	Contract performance	Duration of order + 6 months
Newsletter email	Marketing newsletters	Consent	Until unsubscribe
Shipping address	Physical calendar delivery	Contract performance	Duration of order + legal retention
Payment data	Processing payment	Contract performance	Handled by Stripe (we don't store card details)
IP address	Rate limiting, abuse prevention	Legitimate interest	1 hour

3. Third-Party Processors

We use the following services to operate PetPortrait:

Service	Purpose	Location
Supabase (AWS)	Database, file storage, server functions	EU (Frankfurt)
Google Gemini API	AI image generation	USA
Stripe	Payment processing	USA/EU
Gelato	Calendar printing and shipping	EU/Global
Resend	Transactional and newsletter emails	USA
GitHub Pages	Website hosting	USA

For US-based processors, data transfers are covered by Standard Contractual Clauses (SCCs) or equivalent safeguards.

4. Your Uploaded Photos

Your pet photos are uploaded to our secure storage, processed by Google Gemini AI to generate calendar artwork, and stored for the duration of your order. Free preview images are automatically deleted after 7 days. Photos associated with paid orders are retained until fulfillment is complete.

We do not use your photos for any purpose other than generating your calendar. We do not train AI models on your images.

5. Cookies & Local Storage

We use browser localStorage (not cookies) to store:

• Your anonymous session ID (to track your generation progress)
• Your calendar preview data (to display results)

We do not use tracking cookies, analytics, or third-party advertising. No cookie consent banner is needed as we only use technically necessary storage.

6. Newsletter

If you subscribe to our newsletter, we store your email address and send periodic updates. You can unsubscribe at any time using the unsubscribe link in every email. Upon unsubscription, your email is immediately deleted from our database.

7. Your Rights (GDPR)

You have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure — request deletion of your data ("right to be forgotten")
• Restriction — limit how we process your data
• Portability — receive your data in a machine-readable format
• Objection — object to processing based on legitimate interest
• Withdraw consent — for newsletter subscription, at any time

To exercise these rights, contact us at:

8. Data Protection Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Liechtenstein Data Protection Office (Datenschutzstelle):

Datenschutzstelle Liechtenstein
Stadtle 38, Postfach 684
9490 Vaduz, Liechtenstein
info.dss@llv.li

9. Changes to This Policy

We may update this privacy policy from time to time. The current version is always available on this page with the "last updated" date above.