Privacy policy

What we collect

• The photos you upload and the portraits we create from them.
• Site use: to see where people get stuck, we count, without cookies, which steps of the site are used (for example opening the studio, choosing a style, seeing the preview or paying), with a random number that only lasts while the page is open, the language, whether you use a phone or a computer and which site you came from. If you're signed in, the event is linked to your account. It never includes your photos, name or email.
• Your account: when you sign in with Google we receive your name, email address and profile picture, and keep your name and email so you can see your portraits and purchases again.
• Your marketing choice: whether you asked to receive offers by email, and when.
• Order details: style, language, date, your confirmation that you have permission to use the photos, and payment status, amount and transaction number.
• Technical data that our hosting providers record for security, such as IP address and browser type.

Payment details (name, email, country, card) are collected by Paddle, not by us. We only receive the confirmation that you paid.

Why, and on what legal basis

• To create and deliver your portrait: performance of the contract you ask for (GDPR art. 6(1)(b)).
• To prevent abuse, such as limiting free previews per day, and to keep the service secure: our legitimate interest (art. 6(1)(f)).
• To keep records of sales: legal obligations (art. 6(1)(c)).
• To send you offers and news by email, only if you tick the box in My portraits: your consent (art. 6(1)(a)). You can withdraw it at any time by unticking the box or with the link in every email.

We don't use your photos to train AI models, and we don't use them for advertising.

Photo checks (whether a face or pet is visible) run in your browser; the photos don't leave your device for that step.

Who receives your data

• Supabase: database and file storage, hosted in Zurich, Switzerland.
• Google (Gemini API): paints the portrait from your photos. Under Google's paid API terms, the data is not used to train their models.
• Amazon Web Services (Rekognition, Frankfurt): checks your photos (whether the eyes are visible, the angle and the sharpness, to warn you about sunglasses and pick your best photo) and compares the face in each painted portrait with your photos, so we only show portraits that look like you. It's a one-off comparison; Amazon doesn't keep your photos or face data, and doesn't use them to train its models.
• Vercel: hosts the website.
• Google: sign-in. They confirm who you are; we don't send them your photos for this.
• Paddle.com: our reseller and Merchant of Record, which processes payments, taxes and invoices as an independent controller under its own privacy policy.
• Professional advisers and authorities, only where the law requires it.

Some of these providers are outside the EU. Transfers rely on an adequacy decision (Switzerland, the United Kingdom, and the EU–US Data Privacy Framework) or on the European Commission's standard contractual clauses.

How long we keep it

The photos you upload, the previews and any portrait you don't buy are deleted automatically 30 days after the order. A portrait you buy is kept for 12 months after payment so you can download it again, and then deleted automatically. You can ask us to delete it sooner. Order records without images are kept for as long as accounting and tax law requires. Your account (name and email) is kept until you ask us to delete it, or deleted after 2 years without any sign-in.

Cookies and browser storage

We don't use advertising or tracking cookies. Your browser stores your sign-in session so you stay signed in. Paddle's checkout may set cookies needed for payment and fraud prevention.

Your rights

You can ask to access, correct, delete or export your data, to restrict or object to its use, or to withdraw your consent, by writing to support@galapaw.com. You can also complain to your data protection authority; in Italy it is the Garante per la protezione dei dati personali (garanteprivacy.it).

Security

Photos and portraits are kept in private storage that only your session and our server can reach, and all connections are encrypted (HTTPS).

Changes

If we change this policy we will publish the new version here with its date.