PawForge Art ("we," "us," "our") respects your privacy. This Privacy Policy explains what information we collect when you visit pawforgeart.com or commission a portrait, how we use it, who we share it with, and the choices you have. By using the Service, you consent to the practices described here.
1. Information we collect
Information you provide directly
- Photographs of your pet — uploaded as input to the portrait generation. Stored on our backend (Convex, U.S.-based) for the lifetime of the commission, plus a retention period (see Section 4).
- Optional notes about your pet — name, coat colour, temperament, anything you'd like the painter to know. Used as prompt context for generation.
- Patron details — your name and email address, used for order confirmation, the proof-ready notification, and dispatch updates.
- Shipping address and (optional) phone — used to quote shipping, dispatch the canvas, and provide delivery updates from the carrier.
- Gift recipient details (if applicable) — if you commission a portrait as a gift, we collect the recipient's name and (optionally) email address to dispatch the canvas and, if you provide their email, send them a notification with your gift message.
- Marketing preferences — if you subscribe to our newsletter, your email address and the source of the subscription.
Information collected automatically
- Device and browser information — type, operating system, viewport size, language preferences. Used for compatibility and analytics.
- Usage data — pages visited, features interacted with, time on page, referral source. Collected only with your consent, via privacy-respecting analytics tooling. Form contents are never collected — your email, address, and payment details are not transmitted to our analytics provider.
- Approximate location — derived from IP address. Used for shipping pre-fills and aggregate analytics.
- Cookies and similar technologies — see Section 6 below.
Information collected through Stripe
Payment is processed by Stripe, our PCI-DSS-compliant payment processor. PawForge Art does not see, store, or have access to your full payment card details. We receive only metadata from Stripe (such as the last four digits of your card, your billing country, and the payment status) sufficient to associate the payment with your order. Stripe's own privacy practices apply to the card information you provide them — see stripe.com/privacy.
2. How we use your information
- To produce, fulfil, and dispatch the portrait you commissioned
- To communicate with you about your order — confirmations, proof-ready notifications, dispatch updates, support replies
- To process payments and prevent fraud
- To send marketing emails about new collections and patron-only previews only if you've opted in; you can unsubscribe at any time via the link in every marketing email
- To analyse aggregate Site usage and improve the Service
- To comply with our legal obligations (tax, accounting, dispute resolution)
- To enforce our Terms of Service and detect violations
Featured portraits (optional)
At checkout, you may grant PawForge Art explicit permission to feature your commissioned portrait on our marketing channels — the public gallery page, Instagram, X (Twitter), other social platforms, landing pages, and email previews. This consent is OPTIONAL and never a condition of placing or fulfilling an order. We provide a small discount as our thanks for letting us share your portrait.
If you opt in, you may also tell us how you'd like to be named in the post — a social handle, your first name, or anonymously (leave the name field blank). The name you choose is the ONLY identifying information we'll publish alongside the portrait; your full name, email, and shipping address never appear in any public asset.
Your opt-in is revocable. Email curator@pawforgeart.com with "Revoke image rights" in the subject line. We'll remove the portrait from active marketing within 30 days, clear the associated credit name from our records at the same time, and stop featuring it in any new asset immediately. Already-published posts on third-party platforms (Instagram, X) will be deleted on a best-effort basis; we cannot guarantee third-party caches and archives are also purged.
3. Service providers we share information with
We work with carefully-chosen service providers to operate the Service. Each receives only the minimum information necessary for the function they perform.
- Convex (backend-as-a-service, U.S.) — stores orders, generations, subscriber records, and uploaded photographs.
- OpenRouter / Google (Gemini) — receives your uploaded photograph and the generation prompt as input to the AI portrait model. Per OpenRouter's and Google's policies, data submitted to the Gemini API is not used to train their models.
- Replicate (image upscaling) — receives the generated portrait for resolution upscaling before print. Image is not retained by Replicate after the upscale completes.
- Printify (print fulfilment) — receives your shipping address and the approved portrait file to print and dispatch your canvas.
- Stripe (payments) — see Section 1 above.
- Resend (transactional email) — receives your email address and the email content (order confirmations, proof notifications, gift messages, marketing).
- Cloudflare (hosting, DNS, DDoS protection) — receives request metadata for every page view.
- PostHog (product analytics, U.S. cloud) — receives pseudonymous usage events (page views and interactions), collected only with your consent. These events never include form contents — your email, address, and payment details are not transmitted to PostHog — and we do not record sessions.
We do not sell your personal information to third parties. We may disclose information when required by law (e.g. subpoena, court order), to protect our rights or the safety of others, or in connection with a corporate transaction such as a merger or sale of assets — in which case we will notify you in advance via email.
4. Data retention
- Photographs and generated portraits — retained for the lifetime of your order plus 12 months thereafter, to support reorders and customer service. You may request earlier deletion (see Section 7).
- Order records (purchase amount, shipping address, order metadata) — retained for 7 years after the order date for tax and accounting compliance.
- Marketing email subscribers — retained until you unsubscribe; the unsubscribe action removes your address from future sends and your record from our active list within 30 days.
- Site usage analytics — pseudonymous usage events, collected only with your consent and retained no longer than needed for the analyses described above; you may request deletion at any time (see Section 7).
5. How we protect your information
We use industry-standard security measures to protect your information, including TLS encryption for data in transit, at- rest encryption on our backend storage, scoped access controls, and regular security reviews. However, no internet transmission or storage system is perfectly secure, and we cannot guarantee absolute security.
Payment information is processed exclusively by Stripe under their PCI-DSS Level 1 compliance — we never see your full card number.
6. Cookies and tracking technologies
The Site uses three categories of cookies:
- Strictly-necessary cookies — required for the Site to function (session management, security tokens, cart state). Cannot be disabled.
- Analytics cookies — used to understand aggregate site usage and improve the Service. Used only with your consent where required by law.
- No advertising cookies — we do not use advertising or cross-site tracking cookies.
All visitors see a consent banner on first visit before any non-essential cookies are set. You can withdraw or change your consent at any time via the “Cookie preferences” link in the site footer.
7. Your rights
Depending on your jurisdiction, you may have one or more of the following rights regarding your personal information:
- Right to access — request a copy of the personal information we hold about you.
- Right to correction — ask us to correct inaccurate or incomplete information.
- Right to deletion ("right to be forgotten") — request deletion of your information, subject to our retention obligations under tax, accounting, and other applicable laws.
- Right to portability — request your information in a structured, machine-readable format.
- Right to object — object to certain processing, including direct marketing.
- Right to withdraw consent — for processing based on consent (e.g. marketing emails, non-essential cookies).
- Right to lodge a complaint — with your local data protection authority. EU residents may contact their national supervisory authority; UK residents the Information Commissioner's Office; California residents the California Privacy Protection Agency.
To exercise any of these rights, email curator@pawforgeart.com with the subject "Privacy Request" and a brief description. We will respond within 30 days (or sooner where required by law).
8. California Consumer Privacy Act (CCPA) disclosures
California residents have specific rights under the California Consumer Privacy Act ("CCPA") and California Privacy Rights Act ("CPRA"), in addition to those listed in Section 7:
- The right to know what personal information we collect, use, disclose, and sell about you
- The right to delete personal information collected from you
- The right to correct inaccurate personal information
- The right to opt out of the sale or sharing of personal information (we do not sell or share for cross-context behavioural advertising)
- The right to limit use of sensitive personal information (we do not use sensitive personal information beyond what is necessary to provide the Service)
- The right to non-discrimination for exercising any of these rights
9. European Economic Area, UK, and Swiss residents (GDPR)
If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process your information on the following legal bases:
- Performance of a contract — to fulfil orders you place
- Legitimate interests — to improve the Service, prevent fraud, and communicate with patrons
- Consent — for marketing emails and non-essential cookies
- Legal obligation — for tax, accounting, and dispute records
You have the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
10. Children's privacy
The Service is not directed to children under the age of 13 (or 16 in the European Economic Area and the United Kingdom). We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided information to us, please contact curator@pawforgeart.com and we will delete it promptly.
11. International data transfers
Our service providers are primarily located in the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S. and other countries that may have data-protection laws different from those in your country. Where required, we rely on appropriate transfer safeguards, including the Standard Contractual Clauses approved by the European Commission, with our service providers.
12. Changes to this policy
We may update this Privacy Policy from time to time. The "last updated" date at the top of this page reflects the most recent revision. Material changes will be communicated via email to active patrons before they take effect.
13. Contact
Questions, requests, or complaints about this Privacy Policy? Reach the studio at curator@pawforgeart.com. For privacy-specific requests, please use the subject line "Privacy Request" so it routes to the right person.