Privacy Policy

This Privacy Policy describes how PaintedApp, LLC, which operates Stately Vows ("we," "us," or "our") collects, uses, retains, and discloses information when you use our website and AI portrait generation services. For details specific to biometric data, see our Biometric Data Policy.

1. Information We Collect

Information you provide

• Account information: email address, password (hashed), display name, year of birth. If you sign in with Google or Apple, we receive your name and email address from them, and nothing else.
• Reference photographs you upload for portrait generation (processed transiently to generate your portraits and not stored on our servers — see Section 4 and our Biometric Data Policy)
• Order and shipping information: name, address, phone number, payment data (processed by Stripe; we do not store full card numbers)
• Communications, support emails, marketing preferences
• Consent records: version, timestamp, IP address, and user agent at each consent moment

Information collected automatically

• Device and browser information
• Usage data: pages viewed, generation timestamps, feature interactions
• IP address (for security, fraud prevention, and approximate region inference)
• Cookies (see Section 9 and our Cookie Policy)

2. Sensitive Personal Information

Photographs depicting facial features are classified as sensitive personal information under the California Consumer Privacy Act (as amended by CPRA) and as special-category data under the European General Data Protection Regulation. We process this information only with your explicit consent and solely to generate the AI portraits you have requested. We never sell or share this information for cross-context behavioral advertising. To limit our processing of your sensitive personal information, visit our Privacy Choices page.

3. How We Use Your Information

• Generate, deliver, and fulfill the portraits you request
• Maintain your account and provide customer support
• Process payments and fulfill physical orders through our print partners
• Detect, prevent, and respond to fraud, abuse, and violations of our Terms
• Comply with legal obligations and respond to lawful requests
• Send transactional communications; with separate opt-in, occasional marketing emails (unsubscribe anytime)

We do not use your reference photographs to train AI models, sell them to third parties, or use them for any purpose other than fulfilling your portrait request.

4. Data Retention

• Reference photographs: not stored on our systems. They are re-encoded in your browser (which strips EXIF metadata), processed in memory for your generation request, transmitted directly to our AI processing partner, and not retained by us after the request completes. Our AI processing partner applies its own limited retention window (up to 30 days, abuse-monitoring only) outside our control. See our Biometric Data Policy.
• Generated portraits: kept in private storage in your account until you delete them or ask us to delete your account.
• Guest accounts: if you create portraits without signing up and never place an order, the guest account and its portraits are deleted automatically after 30 days.
• Download links: the links in your order email stop working after 30 days. Signed-in customers can download paid files again from their account.
• Account information: an inactive account with no orders becomes eligible for deletion 24 months after its last sign-in. An order, unfinished fulfilment, an open privacy request or consent proof still within its retention period holds the account. When deletion completes, its saved portraits and sign-in are removed.
• Order and transaction records: kept for 7 years from the order date, including the name, address, items and amounts needed for tax records. Completed, cancelled or refunded orders are then deleted; an unfinished delivery, a held commission or a legal hold postpones deletion. Stripe retains its own transaction records under its policy.
• Marketing permission: retired after 36 months without a sign-in or purchase, or when you withdraw it. The versioned consent act is kept for 3 years after retirement. Historical records without the original words are not treated as proof of permission to send a promotion.
• Consent records: acceptance dates and document versions remain with the account and artwork they cover. Marketing consent also records the words shown, their source and a keyed IP hash. Raw IP addresses and browser strings are removed after 30 days. Consent proof and completed privacy requests may be held for 3 years.
• Operational records: generation access logs are removed after 30 days. Processed webhook payloads are cleared after 30 days while their event identifiers remain for payment deduplication. Ad click identifiers, when present, are removed from local order metadata after 90 days; order attribution without those identifiers follows the order's retention period.

The extended retention sweep currently reports records due for expiry. Automatic deletion under that sweep is held while its first report is reviewed. Existing guest-account and temporary-file cleanup continues. You can request deletion through support during this review.

5. How We Share Information

We do not sell your personal information. We share information only as follows:

• Our processors, by name. Each receives only what it needs for its job:
  • OpenAI: paints the portraits from your photos (gpt-image-1.5) and describes the subjects (gpt-4o).
  • Anthropic: compares each portrait with your photos to check the likeness (Claude).
  • Stripe: takes payment; we never see your full card number.
  • Prodigi: prints and ships prints and canvas.
  • Printful: prints and ships apparel, blankets and phone cases.
  • Resend: sends order and download emails.
  • Supabase: stores your account, saved portraits and orders.
  • Vercel: hosts the website.
• AI processing. Your reference photographs go to OpenAI to paint your portraits and to Anthropic to check the likeness. Under their API data policies, as represented to us, API inputs are not used to train their models and are kept for up to 30 days for abuse monitoring.
• Printing. If you order prints or merchandise, your shipping address and the final image file go to Prodigi or Printful solely to make and ship your order.
• Legal compliance. We may disclose information when legally required (subpoena, court order, government request) or to protect our rights, property, or safety.

6. Your Rights & Choices

• Access & Portability: request a copy of the personal information we hold about you
• Correction: request that we correct inaccurate information
• Deletion: request that we delete your personal information, subject to legal retention requirements
• Opt-out of sale or sharing: we do not sell or share personal information, but you may file a formal opt-out via Privacy Choices
• Limit use of sensitive personal information: California residents may request limited processing of sensitive personal information
• Withdraw consent: revoke any consent (does not affect prior processing)
• Non-discrimination: we will not deny service or charge different prices for exercising your privacy rights

Exercise these rights via your account settings or by emailing support@painted.app. We respond within 45 days (or longer where permitted by law).

7. Children

The Service is intended only for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18. If we learn we have collected information from a person under 18, we will promptly delete it. Parents or guardians may contact us to request deletion.

8. International Visitors

The Service is operated in the United States. If you access the Service from outside the United States, you consent to transfer and processing of your information in the United States. For visitors from the EEA or UK, we rely on your explicit consent (GDPR Article 6(1)(a) and Article 9(2)(a)) as the lawful basis for processing.

9. Cookies & Tracking

We use first-party cookies that keep you signed in and remember a guest session. We load no analytics or advertising tags today. If we add advertising pixels later, they will load only after you accept them in the cookie notice, and never while your browser sends the Global Privacy Control (GPC) signal, which we treat as a request not to sell or share your personal information. The full list is in our Cookie Policy.

10. Security

We use industry-standard security measures including TLS encryption in transit, encryption at rest for the data we store (your saved portraits and account information), role-based access controls, and short-lived signed URLs for image access. Our strongest protection for your reference photographs is that we do not store them at all (Section 4). No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The updated policy will be posted on this page with a revised version and effective date. Material changes will be notified to registered users by email; renewed consent will be obtained where required.

12. Contact

For privacy questions or to exercise your rights, contact PaintedApp, LLC at support@painted.app or by mail at 1327 SE Tacoma St #394, Portland, OR 97202.