Privacy Notice

Who controls your information

Paul Lewis, sole trader trading as Paws & Portraits, is the controller. Contact hello@paws-and-portraits.co.uk for privacy enquiries or support@paws-and-portraits.co.uk for order support.

What we use and why

We use contact and delivery details, order choices, pet details, uploaded photographs, proof feedback, consent choices, communications and payment-status/reference information to answer enquiries, form and perform the customer contract, create and deliver portraits and prints, provide proofs and revisions, keep business records, secure the service and resolve disputes. After true final completion, we may send one service review request. Review text, rating and display name are optional except for the rating; publication requires separate explicit consent and moderation. Stripe handles card details; we do not store them.

Optional showcase permissions

Website and Gallery permission is optional. Social media and marketing permission is separate and optional. Refusing either does not prevent an order. You may withdraw either permission for future use by contacting support. If photographs identify another person, you must have authority to provide them; we record an additional confirmation when public use is requested.

Service providers and international processing

We share only what is needed with Stripe for payment; Resend and Google Workspace for operational email; our hosting, database and object-storage infrastructure; OpenAI or other approved artwork tooling used under controlled production workflows where relevant; and selected print-fulfilment suppliers for physical orders. We do not sell personal information.

Some providers may process information outside the UK. Where this is an international restricted transfer, we take reasonable steps to use an applicable lawful transfer mechanism and appropriate safeguards, considering current provider terms, locations and sub-processors.

Retention

Device-local basket drafts expire after 30 days. Unpaid or abandoned uploaded photographs are retained for up to 30 days.

Source photographs, proofs and completed artwork are retained for up to 12 months after final delivery for support and quality purposes. Support correspondence is retained for up to two years.

Review-request delivery, suppression and consent records are retained as reasonably needed to prevent duplicate contact and evidence the customer’s choice. A published review may remain visible until consent is withdrawn or removal is requested.

Order, payment-reference, accounting and tax records may be retained for up to six years. Consent and withdrawal records are retained as reasonably needed to evidence and honour the choice.

We may retain information longer where a legal obligation, dispute or claim requires it.

Browser storage and tracking

Necessary browser storage, including the paws-portrait-basket-v2 localStorage entry, keeps unfinished and ready basket drafts on your device for up to 30 days. It is not used for advertising or behavioural profiling.

We use lightweight first-party aggregate analytics to understand visits, portrait-builder starts, baskets, checkout starts and paid orders. This does not use analytics cookies, advertising pixels or third-party analytics. We do not store raw visitor IP addresses: a one-way identifier is created for daily duplicate protection and changes each day. Analytics events are automatically removed after 180 days.

For first-touch order attribution, this device may keep a short-lived first-party record for up to 30 days containing a random acquisition ID, first landing path, referring website hostname, standard UTM campaign values and broad device category. We do not retain a full referring URL or unrelated query parameters. If you place an order, that attribution record is linked once to the order so we can understand which sources and campaigns lead to sales. Any answer you voluntarily give to “How did you hear about us?” is stored separately and is never replaced by automatic attribution.

We do not configure Google Analytics, Meta Pixel or equivalent behavioural tracking at launch.

Your rights

You may ask for access, correction, deletion or restriction, object where applicable, request portability where applicable, or withdraw optional public-use permission. Some information must be retained for legal or contractual reasons. You may complain to the UK Information Commissioner’s Office; we welcome the opportunity to resolve your concern first.