The short version
We collect the minimum data we need to make and ship your art, to improve the product, and to comply with the law. We don't sell your data. We don't use your prompts to train any publicly released model. You can ask us to delete everything we have on you at any time, and we'll do it within 30 days.
1. Who we are
portraits.com (“portraits,” “we,” “us”) is a US-based direct-to-consumer art company operating at portraits.com. Our registered address is in Portland, Oregon. Questions about this policy go to privacy@portraits.com.
2. What we collect
We collect three buckets of data:
- Information you give us. Your email address, shipping address, payment details (which are handled by our payment processor — we never see your full card number), and the text prompts, preset selections, and uploaded reference images you use to generate art.
- Information we observe.Pages you visit on portraits.com, items you view, how you got to us (referrer), your approximate location derived from your IP address, device type, browser type, and language. This is collected via cookies and analytics (see §4).
- Information from partners. If you sign in through a third party (for example, a federated account) we receive your name and email from that provider. If you buy through a retail partner we receive your order details from them so we can fulfill and support the order.
3. How we use it
- To generate, print, and ship your artwork.
- To respond to your questions and provide customer support.
- To send order confirmations, shipping updates, and (if you opt in) marketing.
- To improve the product — understanding what people make helps us design better tools.
- To prevent fraud, abuse, and illegal use of the service.
- To comply with legal obligations (tax, subpoenas, etc.).
4. Cookies and analytics
We use a small number of cookies. Strictly-necessary cookies run the cart and keep you logged in. Analytics cookies, operated via PostHog, help us understand which parts of the site work and which don't; PostHog is configured to mask keystrokes in sensitive fields and to respect Do Not Track signals. We don't use third-party advertising trackers. You can opt out of analytics in the cookie banner at any time.
5. Payment processing
Checkout is handled by Shopify, which is PCI-DSS compliant and handles card data on our behalf. portraits.com never stores, processes, or transmits your full payment card number. For details on Shopify's data handling, see their privacy policy.
6. AI generation
The prompts you write, the reference images you upload, and the images we generate for you are stored for a rolling 30 days so you can return to them, regenerate variants, and initiate the free-redo process. After 30 days, prompts and references are deleted; generated images you've purchased are retained indefinitely so we can reprint them if needed.
We do not use your prompts or uploads to train any publicly released model. We may use aggregated, de-identified usage patterns (e.g., “12% of users ask for landscapes”) to improve the wizard, but we will never use your personal content as training data for a model that serves anyone other than you.
7. Email marketing
If you opt into our newsletter, we manage it via Klaviyo. You can unsubscribe from any email and Klaviyo will remove you from future sends. Transactional emails (order confirmation, shipping notification) are sent regardless of marketing preference because you need them to track your order.
8. Who we share with
We share personal data only with vendors who help us run the business:
- Shopify (checkout and payments).
- Our print-on-demand fulfillment partner (shipping address and order details).
- PostHog (anonymized product analytics).
- Klaviyo (email marketing, only if you've opted in).
- Our cloud host (AWS, to run the service).
- Law enforcement, if compelled by a valid legal order.
We never sell personal data, and we don't share it for third-party advertising.
9. Your rights
Depending on where you live you may have the right to access, correct, export, or delete your personal data (GDPR in the EU/UK; CCPA/CPRA in California; similar laws elsewhere). You exercise these rights by emailing privacy@portraits.com. We'll verify your identity and respond within 30 days. We will never charge you for a rights request, and we will never retaliate against you for making one.
10. Retention
Account data is kept as long as your account is active. Order records are kept for 7 years for tax and accounting purposes. Prompts and references are deleted after 30 days (see §6). Analytics data is retained for 12 months in identifiable form and then aggregated.
11. Security
We use TLS everywhere, store sensitive data encrypted at rest, and use short-lived, least-privilege credentials for internal systems. No system is perfectly secure, but we work hard to be worthy of the data you share with us. If we ever discover a breach affecting you, we will notify you as required by law — and often sooner.
12. Children
portraits.com is not directed to children under 13, and we do not knowingly collect data from children under 13. If you believe a child has given us data, email privacy@portraits.com and we will delete it.
13. International transfers
portraits.com operates from the United States. If you're accessing us from outside the US, your data will be transferred to and stored in the US. We rely on standard contractual clauses and appropriate safeguards for transfers from the EU/UK.
14. Changes to this policy
We'll update this policy as the product evolves. Material changes trigger a notification — either an email to your account email or a banner at the top of the site, 30 days before the change takes effect.
15. Contact
For anything privacy-related, write to privacy@portraits.com. For anything else, see our contact page.