Privacy Policy

1. What we collect

Only what the service cannot work without:

• The photograph you upload, and the portraits or restoration produced from it.
• Your email address. We ask for it before your preview is shown, and we use it to send you the private link to it and one notice before the link closes. If you buy something, Stripe collects an address for the receipt as well.
• A delivery address, only when you order a print, and only so it can be printed and posted.
• Your IP address, reduced to its network block (an IPv6 address is kept only as its /64) and stored for 48 hours, for rate limiting. An hourly sweep clears it after that — along with the device identifier below — whether or not the upload survives.
• A first-party cookie holding a random device identifier, so the free daily preview is counted per browser rather than per household. It contains nothing about you and is not shared.

There is no account, no password and no profile.

If you tick the optional box on the reveal screen, we may send one print reminder and, after delivery, one request for a review. The box is unticked by default. Optional mail includes an unsubscribe link. Requested preview links, purchase receipts and delivery updates do not depend on this choice. We retain a hashed address to honor an unsubscribe across later previews.

Analytics. After you allow it, Google Analytics measures public page visits and receives usage data. Private preview and checkout pages send no page views, only anonymous funnel steps (which size was chosen, that a checkout began); query strings, private access IDs and email addresses are never sent. Declining does not affect purchases or previews. Use Privacy settings to change your choice or withdraw consent at any time.

2. Why we are allowed to (GDPR Art. 6)

Processing your photograph and delivering what you bought is performance of a contract (Art. 6(1)(b)) — as is emailing you the link to your own preview and telling you before it is deleted. Rate limiting and fraud prevention rest on our legitimate interests (Art. 6(1)(f)) in keeping the service available and not being defrauded. Tax and accounting records for a purchase are a legal obligation (Art. 6(1)(c)). The email about prints and the analytics cookie both rest on your consent (Art. 6(1)(a)), given by ticking the box or accepting the banner, and withdrawable at any time — one click in the email, or Privacy settings — with no effect on anything processed before you withdrew it.

3. Your photographs

Your uploads are not training data. They are not used to train, fine-tune or evaluate any model — not by us, and not by the generation provider, which is contractually held to the same.

Nobody browses them. Files are stored under long, unguessable addresses that are never listed, indexed or linked from anywhere public; the only way to reach one is through the private preview link. Watermark-free files are additionally released only against a paid order.

4. Who else processes it

Each of these does one job. All but Replicate are bound by a data-processing agreement that forms part of the terms we accepted with them:

• Vercel — hosting and file storage.
• Neon — the database.
• Google — the image model and, with your consent, analytics.
• Stripe — payments. Card details never reach this site.
• Replicate — enlarges the file for printing, for print orders only.
• Gelato — printing and delivery, for print orders only.
• Resend — the email carrying your link or receipt.
• Upstash — rate limits using network blocks, creation identifiers and hashed email addresses.

Replicate is the exception, and we would rather say so than imply otherwise. It publishes no data-processing agreement and no process for requesting one; we have asked for one. What it receives is narrow: on a print order, the finished portrait or restored image only — never your email address, your payment details or anything else on this page. Its published retention rule for requests made through its programming interface, which is the only way we use it, is that inputs, outputs and logs are removed one hour afterwards. If we cannot obtain an agreement, we will replace it.

We do not sell your data, and we do not share it with anyone whose job is not on that list.

5. How long it is kept

Unpurchased preview links close 48 hours after upload. The daily cleanup queues their originals, thumbnails and generated files for deletion after a one-hour grace period. Normally deletion completes by the following day; storage failures remain queued for retry. Open or delayed payments retain the files until payment status can be resolved.

Purchased files remain available for repeat downloads. The original upload and its thumbnail are queued for deletion 30 days after the latest completed purchase, unless another payment is pending. If all purchases for the same preview are refunded, files are queued 14 days after the latest refund. Refunding one order does not remove another paid order's files. Shared originals remain until the last creation that requires them releases them.

The email address you gave for a preview is deleted with that preview when it expires unpurchased. If you bought something, the address belongs to the order: it is kept alongside the payment record for the accounting retention period, because it is how the purchase is identified and how the files are reissued to you. Erasure on request removes it earlier where the law does not require it to be kept.

Payment records remain for the applicable accounting retention period. An erasure request can remove image data sooner while preserving required transaction records. Failed file deletions remain in a durable retry queue until resolved. We retain an address hash for unsubscribe suppression; it is not used for marketing.

6. Your rights (GDPR Art. 15–22)

You can ask for a copy of what we hold, ask us to correct it, ask us to erase it, object to processing, or ask for it in portable form. Write to hello@portraitunion.com and we will answer within thirty days.

One practical point: because there is no account, we cannot look you up by name. Include the preview link you were given, or the email address you used at checkout — otherwise there is nothing we can match you to, which is itself a fair description of how little we hold.

You also have the right to complain to your national data protection authority.

7. Where it goes

Some processors operate outside the EEA. Those transfers rely on the European Commission’s Standard Contractual Clauses or an adequacy decision. Print production is routed to the facility nearest your delivery address, so an EU order is normally produced inside the EU.

8. Cookies

A necessary first-party device cookie supports the preview allowance. Session storage can retain a random recovery key for an interrupted upload. Local storage remembers your analytics choice. Google Analytics cookies are used only after you allow them; Privacy settings lets you withdraw that choice. Stripe uses its own storage on the checkout page it hosts.

9. Children

The service is not directed at children under 16. If a photograph of a child is uploaded, it is the responsibility of the adult uploading it, and the retention rules in section 5 apply.

10. Changes

If this policy changes materially, the date at the top changes with it. There is no announcement list — the only emails this site sends are the ones described in section 1.

11. Controller and contact

The controller of everything described on this page — the party that decides why and how it is processed, in the sense of Art. 4(7) — is Portrait Union, the trading name of the one-person studio that operates this site from Slovenia and is reached at hello@portraitunion.com. That address is the controller’s contact point for every right in section 6, and it is read by the person who runs the studio rather than by a support desk. Portrait Union does not yet publish a registered company name, a registered office or a company registration number; the day those exist they will be named here and in the footer of every page. No data protection officer has been appointed, and the address above is the contact for the processing described here.

hello@portraitunion.com — for privacy questions, erasure requests, or anything on this page. See also our Terms and Refund Policy.