Privacy policy
What we collect, why, and how we handle it. In plain English first; legal details below.
Last updated · 2026-06-01
The short version
Fancy Pet is an AI pet-portrait service operated from the United Kingdom. To paint a portrait we need three photos of your pet and your email address (so we can send you the high-resolution file). To ship a product we also need your name and shipping address, and Stripe needs your payment details.
We never sell your data. We don't use it to train any AI model. We share it only with the vendors we depend on to actually run the service (Stripe, Printify, fal.ai, Supabase, Vercel, Resend, Upstash) — all listed below with what we share with each.
You can ask us to delete everything we hold about you at any time by emailing privacy@fancy.pet.
Who we are
Fancy Pet (“Fancy Pet”, “we”, “us”) is the trading name of the business operating fancy.pet. We are the data controller for any personal information you provide through this site.
For privacy questions or requests: privacy@fancy.pet. For everything else: hello@fancy.pet.
What we collect, why, and for how long
We try to collect as little as possible to get the job done. Here's the full list:
Pet reference photos
The three photos of your pet you upload to start a gallery.
Purpose: Used by our AI image-generation pipeline to produce the painted portrait. Sent transiently to fal.ai for processing; not used to train any model.
Lawful basis: Performance of contract (Art. 6(1)(b) GDPR)
Retention: Stored for 90 days after the gallery was created so you can return and order products. Deleted on request at any time.
Generated portraits
The painted images Fancy Pet generates from your reference photos.
Purpose: Displayed in your gallery, included in download emails, used to print products you order.
Lawful basis: Performance of contract (Art. 6(1)(b) GDPR)
Retention: Stored for 90 days after the gallery was created. Indefinitely if you place an order (so we can reprint or re-fulfil).
Pet name
The name you type for your pet.
Purpose: Used in the gallery caption, the share link, and the subject line of the download email.
Lawful basis: Performance of contract (Art. 6(1)(b) GDPR)
Retention: Same as the gallery it belongs to.
Email address
The address you enter to receive your download link.
Purpose: Sending the download email, order confirmations, and (only if you opted in) marketing emails about new costumes or products.
Lawful basis: Performance of contract (Art. 6(1)(b) GDPR)
Retention: Until you ask us to delete it or unsubscribe. Marketing opt-ins can be withdrawn at any time.
Order and shipping details
Your name, shipping address, contact email, and the products you ordered.
Purpose: Processing payment via Stripe, fulfilling the order via Printify, and contacting you about it.
Lawful basis: Performance of contract (Art. 6(1)(b) GDPR)
Retention: Seven years for tax-record compliance, then deleted unless we're legally required to keep it longer.
Payment information
Card details, payment method, billing address.
Purpose: Processing your order.
Lawful basis: Performance of contract (Art. 6(1)(b) GDPR)
Retention: Never stored on our systems. Handled entirely by Stripe; we only receive a token that lets Stripe match the payment to the order.
Technical data
IP address, browser type, device type, the pages you visited, error logs.
Purpose: Security, fraud detection, rate limiting, basic operational debugging.
Lawful basis: Legitimate interests (Art. 6(1)(f) GDPR)
Retention: Server logs auto-expire after 30 days. Rate-limit counters expire within hours.
Who we share data with (sub-processors)
Running Fancy Pet requires a small set of trusted vendors. Each processes some part of your data on our behalf under a data-processing agreement. The complete current list is at /sub-processors. In summary:
- Stripe, Inc. — Payment processing and fraud detection (United States).
- Printify, Inc. — Production and fulfilment of physical products (United States / Latvia).
- fal.ai (Features and Labels, Inc.) — AI image generation, image analysis, and background removal (United States).
- Supabase, Inc. — Database hosting, file storage, and authentication infrastructure (United States).
- Vercel, Inc. — Website hosting, edge functions, and content delivery (United States).
- Resend, Inc. — Transactional email delivery (download links, order confirmations) (United States).
- Upstash, Inc. — Redis cache used for rate limiting on API endpoints (United States).
We never sell your data, and we never share it with advertisers or data brokers.
International transfers
Most of our sub-processors are based in the United States. When we transfer personal data from the UK or EEA to a non-adequate country, we rely on appropriate safeguards under Articles 45–49 GDPR — typically the EU-US Data Privacy Framework (where the vendor self-certifies) or Standard Contractual Clauses. You can request a copy of the relevant transfer mechanism for any sub-processor by emailing us.
Your rights
You have the right to:
- Know what personal data we hold about you and request a copy.
- Have inaccurate data corrected or incomplete data completed.
- Have your data deleted (the “right to be forgotten”).
- Restrict or object to how we process your data.
- Receive your data in a portable, machine-readable format.
- Withdraw consent for any processing based on consent.
- Lodge a complaint with your local data-protection authority — in the UK that's the Information Commissioner's Office (ico.org.uk).
To exercise any of these rights, email privacy@fancy.pet. We respond within 30 days.
For California residents (CCPA / CPRA)
You have the right to know what personal information we collect, the purposes we collect it for, the categories of third parties we share it with, and to request deletion. You also have the right to opt out of any “sale” or “sharing” of your personal information for cross-context behavioural advertising — though Fancy Pet does not sell or share personal information for advertising purposes, and never has.
To exercise any of these rights, email privacy@fancy.pet and we'll verify your identity before responding.
Children (COPPA)
Fancy Pet is intended for adults. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please email privacy@fancy.pet and we will delete it promptly.
Uploaded reference photos may incidentally include people in the background. We do not perform facial recognition on uploaded photos. We ask that you only upload photos of pets and avoid pictures prominently featuring children.
How AI generation works (and what we don't do)
Your three reference photos are sent to fal.ai (our AI provider) along with a text prompt describing the costume style. fal.ai returns a painted image, which we store and show you. The reference photos and generated images are not used to train any AI model — neither ours nor fal.ai's. fal.ai's privacy policy confirms this.
Cookies and tracking
We use a small number of strictly-necessary browser storage entries (zustand session persistence, currency-detection flag). We do not use third-party analytics or advertising cookies. Stripe and Printify may set their own cookies on pages where their iframes load — those are explained in their respective privacy policies. Details on /cookies.
Security
We use TLS in transit, encrypted storage at rest (Supabase & Vercel), parametrised database queries, rate-limited public endpoints, and least-privilege access controls for our own team. If a breach affects your personal data and is likely to result in a risk to your rights, we will notify you and the relevant supervisory authority within 72 hours where required by law.
Changes to this policy
We may update this policy when we add features, change vendors, or for legal reasons. The “Last updated” date at the top reflects the most recent meaningful change. If a change is material we will notify customers who have given us their email.
Contact
Privacy questions or requests: privacy@fancy.pet. Everything else: hello@fancy.pet.