Privacy notice

This notice explains what personal data Kin & Paws collects, why, and your rights under the UK GDPR and the Data Protection Act 2018. We've tried to keep it short and in plain English.

Who we are

Kin & Paws is the “controller” of your personal data. Contact us any time at hello@kinandpaws.org.

What we collect

• Your email address — to send your previews, purchases and sign-in links.
• The photos you upload — one of a person and one of a pet.
• Names and gift details you choose to give us, including a gift recipient's name, email address and your note.
• Your portraits and order history, including discount codes used.
• Payment confirmation from Stripe. We never see or store your card details.
• Basic technical data: a one-way scrambled (hashed) version of your IP address, used only to prevent abuse. We don't keep your IP address itself.

Why we use it, and our legal basis

• To make and deliver your portraits (including free previews, re-dos and gifts) — performance of a contract with you.
• To prevent fraud and abuse of free previews, and keep the service secure — our legitimate interests.
• To keep financial records — legal obligation (tax law).

We don't send marketing emails unless you've opted in, and we don't sell or share your data for advertising.

Your photos and AI

Your photos are sent to Google's Gemini service to check they're usable and to create your portraits. We use Google's paid service, under terms which say Google does not use this content to train its models. We do not use facial recognition to identify anyone, and we never use your photos for marketing, to train AI, or for anything other than making your portraits.

If you upload a photo of someone else (for example, for a gift), please make sure they're happy for you to do so. Photos of children should only be uploaded by, or with the permission of, a parent or guardian.

How long we keep it

• Uploaded photos: deleted automatically 30 days after upload.
• Finished portraits and order details: kept so you can download them again, until you ask us to delete them. Purchase records are kept for 6 years for tax purposes.
• Sign-in links: expire after 1 hour.
• Abuse-prevention records (hashed IP address): deleted after 7 days.

Who we share it with

Only the service providers we need to run Kin & Paws, each under a contract that protects your data:

• Google (Gemini) — photo checks and portrait creation
• Stripe — payments
• Resend — sending emails
• Vercel and Supabase — website hosting, database and file storage
• Meta and TikTok — advertising measurement, only if you accept advertising cookies

Some of these providers process data in the USA. Where that happens, transfers are protected by the UK's adequacy regulations (the UK–US “data bridge”) or the UK International Data Transfer Addendum.

Cookies

We use one strictly necessary cookie to keep our admin team signed in, and your browser remembers your cookie choice. If you say yes in our cookie banner, we also use advertising cookies from Meta (Facebook and Instagram) and TikTok to measure which of our ads help people find us — for example, that someone who saw an ad later ordered a portrait. They're off unless you accept, and you can change your mind any time with “Cookie settings” at the bottom of every page.

Your rights

You can ask us to access, correct, delete or export your data, or object to or restrict how we use it. Email hello@kinandpaws.org and we'll reply within one month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Age

You must be 18 or over to buy from us.