Paint my pet

Privacy policy

What we collect, why, and how we handle it. In plain English first; legal details below.

Last updated · 2026-10-02

The short version

Fancy Pet is an AI pet-portrait service operated from the United Kingdom. To paint a portrait we need 1 to 3 photos of your pet. If you want the full-quality file emailed to you, we need your email address. To ship a product we also need your name and shipping address, and Stripe needs your payment details.

We never sell your data. We don't use it to train any AI model. We share it only with the vendors we depend on to actually run the service, all listed below with what we share with each.

We only send news, offers or checkout reminders if you ticked a box to say yes, and every one of those emails has an unsubscribe link.

You can ask us to delete everything we hold about you at any time by emailing privacy@fancy.pet.

Who we are

Fancy Pet (“Fancy Pet”, “we”, “us”) is the trading name of the business operating fancy.pet. We are the data controller for any personal information you provide through this site.

For privacy questions or requests: privacy@fancy.pet. For everything else: hello@fancy.pet.

What we collect, why, and for how long

We try to collect as little as possible to get the job done. Here's the full list:

Pet reference photos

The photos of your pet you upload to start a gallery (1 to 3 photos).

Purpose: Used by our AI image-generation pipeline to produce the painted portrait. Sent to fal.ai for processing; not used to train any model.

Lawful basis: Performance of contract (Art. 6(1)(b) GDPR)

Retention: Kept with your gallery so you can come back and order. We don't delete galleries automatically at the moment, so they stay until you ask us to delete them, which you can do at any time.

Generated portraits

The painted images Fancy Pet generates from your reference photos.

Purpose: Displayed in your gallery, included in download emails, and used to print products you order. As our terms (section 4) explain, we may also show some paintings as examples on our website, never with your photos, name or email. Ask us and we'll take yours down.

Lawful basis: Performance of contract (Art. 6(1)(b) GDPR)

Retention: Kept with your gallery, the same as your photos: until you ask us to delete them. If you've ordered, we keep the painting and its print files so we can reprint or replace under our guarantee.

Pet name

The name you type for your pet.

Purpose: Used in the gallery caption, the share link, on products if you add the name, and in the subject line of our emails to you.

Lawful basis: Performance of contract (Art. 6(1)(b) GDPR)

Retention: Same as the gallery it belongs to.

Email address

The address you give us for your download link, for an "Email me when it's ready" note on the painting screen, or at checkout.

Purpose: Sending what you asked for: the download link (which may include a one-off discount code for your gallery), one email when your painting is ready (or a note if it couldn't be painted), and your order confirmation and delivery updates.

Lawful basis: Performance of contract (Art. 6(1)(b) GDPR)

Retention: Kept with your gallery or order until you ask us to delete it. An "Email me when it's ready" address is used for that one email and nothing else, unless you also tick the news and offers box.

Review request after delivery

Your order email and delivery date.

Purpose: A few days after your order arrives, one email asking how it went, with a link to leave a review. You get at most one of these every 30 days, and every one has an unsubscribe link.

Lawful basis: Legitimate interests (Art. 6(1)(f) GDPR)

Retention: We note the date we asked on your order, so we never ask twice for the same order.

News, offers and checkout reminders (only if you agree)

Whether you ticked a box agreeing to hear from us: on the download form, under "Email me when it's ready", or on Stripe's checkout page.

Purpose: Occasional emails about new looks and products. If you ticked the box on Stripe's checkout page and then didn't finish paying, one reminder with a link back to your bag (never more than one a week). No box ticked, no emails like these.

Lawful basis: Consent (Art. 6(1)(a) GDPR)

Retention: Until you unsubscribe (one tap, from a link in every one of these emails) or ask us to delete it. We keep a note of when we sent a reminder so we never send more than one a week.

Unsubscribe list

The email addresses of people who have unsubscribed or asked us to stop emailing them.

Purpose: Checked before we send any email, so we never email you again once you've said no.

Lawful basis: Legitimate interests (Art. 6(1)(f) GDPR)

Retention: Kept for as long as we send email, so your choice keeps working. If you ask us to delete your data, we keep just your email address on this list (unless you tell us not to) so we can't email you by mistake.

Order and shipping details

Your name, shipping address, contact email, and the products you ordered.

Purpose: Processing payment via Stripe, fulfilling the order via our print partners (Printify, Printful), and contacting you about it.

Lawful basis: Performance of contract (Art. 6(1)(b) GDPR)

Retention: Kept for seven years, for tax records.

Gift cards: the person receiving one

When someone buys you a gift card, they give us your name and email address, along with their own name, their message to you and the day to send it.

Purpose: Used only to email you the gift card on the day they chose, and to help if the code goes missing. We never add you to our news and offers emails or send you anything else because of it. Stripe keeps a copy with the buyer's payment record, and our email provider delivers the card.

Lawful basis: Legitimate interests (Art. 6(1)(f) GDPR)

Retention: Kept with the gift card while it can be used (2 years from when it was bought), then with our sales records for tax, like orders (seven years). Would you rather we didn't keep your details? Ask us and we'll delete them once the card has been used or has run out.

Payment information

Card details, payment method, billing address.

Purpose: Processing your order.

Lawful basis: Performance of contract (Art. 6(1)(b) GDPR)

Retention: Never stored on our systems. Handled entirely by Stripe; we only receive a token that lets Stripe match the payment to the order.

Technical data

IP address, browser type, device type, the pages you visited, error logs.

Purpose: Security, fraud detection, rate limiting, basic operational debugging.

Lawful basis: Legitimate interests (Art. 6(1)(f) GDPR)

Retention: Our hosting provider's logs expire on their own within 30 days. Rate-limit counters and cached photo checks expire within a day or two.

The emails we send

  • Ones you ask for: your download link, your order confirmation and delivery updates, and, if you used “Email me when it's ready”, one email when your painting is ready (or a note if it couldn't be painted).
  • After your order arrives: one email asking how it went, with a link to leave a review. At most one every 30 days, and you can unsubscribe from these.
  • Only if you ticked a box to agree: occasional news and offers. If you ticked the box on Stripe's checkout page and didn't finish paying, we may send one reminder with a link back to your bag (never more than one a week).

When you unsubscribe, we put your address on our unsubscribe list and check that list before sending anything, so you won't hear from us again. That's why we keep the list even after other data is deleted.

Who we share data with (sub-processors)

Running Fancy Pet requires a small set of trusted vendors. Each processes some part of your data on our behalf under a data-processing agreement. The complete current list is at /sub-processors. In summary:

  • Stripe, Inc. · Payment processing and fraud detection (United States).
  • Printify, Inc. · Production and fulfilment of physical products (United States / Latvia).
  • Printful, Inc. · Production and fulfilment of physical products (United States / Latvia / other production countries).
  • fal.ai (Features and Labels, Inc.) · AI image generation, image analysis, and background removal (United States).
  • Supabase, Inc. · Database hosting, file storage, and authentication infrastructure (United States).
  • Vercel, Inc. · Website hosting, edge functions, and content delivery (United States).
  • Resend, Inc. · Email delivery: download links, order updates, "your painting is ready" notes, one review request after delivery, and (only if you ticked a box to agree) news, offers and checkout reminders (United States).
  • Upstash, Inc. · Short-lived cache: rate limiting, the phone-to-computer photo hand-off, and photo-check results (United States).
  • Cloudflare, Inc. (Turnstile) · Bot protection when you start a painting (only when switched on), so scripts can't run up our costs (United States).
  • PostHog Inc. · Product analytics: page views, conversion funnel events (gen-started, add-to-cart, checkout, order placed), and session replays. We use this to understand where customers drop off in the flow and to debug issues. (European Union (Frankfurt region)).

We never sell your data and never share it with data brokers. The only advertising-related sharing is the consent-gated Meta ad measurement described under “Advertising measurement” below, and only if you accepted marketing cookies.

International transfers

Most of our sub-processors are based in the United States. When we transfer personal data from the UK or EEA to a non-adequate country, we rely on appropriate safeguards under Articles 45–49 GDPR, typically the EU-US Data Privacy Framework (where the vendor self-certifies) or Standard Contractual Clauses. You can request a copy of the relevant transfer mechanism for any sub-processor by emailing us.

Your rights

You have the right to:

  • Know what personal data we hold about you and request a copy.
  • Have inaccurate data corrected or incomplete data completed.
  • Have your data deleted (the “right to be forgotten”).
  • Restrict or object to how we process your data.
  • Receive your data in a portable, machine-readable format.
  • Withdraw consent for any processing based on consent.
  • Lodge a complaint with your local data-protection authority. In the UK that's the Information Commissioner's Office (ico.org.uk).

To exercise any of these rights, email privacy@fancy.pet. We respond within 30 days.

For California residents (CCPA / CPRA)

You have the right to know what personal information we collect, the purposes we collect it for, the categories of third parties we share it with, and to request deletion. You also have the right to opt out of any “sale” or “sharing” of your personal information for cross-context behavioural advertising, though Fancy Pet does not sell or share personal information for advertising purposes, and never has.

To exercise any of these rights, email privacy@fancy.pet and we'll verify your identity before responding.

Children (COPPA)

Fancy Pet is intended for adults. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please email privacy@fancy.pet and we will delete it promptly.

Uploaded reference photos may incidentally include people in the background. We do not perform facial recognition on uploaded photos. We ask that you only upload photos of pets and avoid pictures prominently featuring children.

How AI generation works (and what we don't do)

Your reference photos (1 to 3) are sent to fal.ai (our AI provider) along with a text prompt describing the style. Before painting, a vision model checks the photos (what kind of animal, which way it faces, eye colour); fal.ai passes them through OpenRouter to a model run by Anthropic or Google for this. fal.ai returns a painted image, which we store and show you. The reference photos and generated images are not used to train any AI model. Neither ours nor fal.ai's. fal.ai's privacy policy confirms this.

Cookies and tracking

Strictly-necessary browser storage (session persistence, currency flag, your consent choice) always runs. Beyond that, and only with your consent via the cookie banner: PostHog product analytics (cookieless until you accept; a first-party cookie after) and the Meta (Facebook) Pixel for measuring our advertising. In GDPR/PECR regions neither sets a cookie nor loads before you choose “Accept all”. Stripe and Printify may set their own cookies on pages where their iframes load. Those are explained in their respective privacy policies. Details on /cookies.

Advertising measurement

When you consent to marketing cookies, we share purchase and site-event data with Meta Platforms to measure whether our ads work: the browser pixel sends events directly, and our server sends matching events (Conversions API) that can include your email address and IP: the email is SHA-256 hashed before it leaves our server. Meta acts as an independent controller for this data under its own privacy policy. Without marketing consent, none of this happens.

Security

We use TLS in transit, encrypted storage at rest (Supabase & Vercel), parametrised database queries, rate-limited public endpoints, and least-privilege access controls for our own team. If a breach affects your personal data and is likely to result in a risk to your rights, we will notify you and the relevant supervisory authority within 72 hours where required by law.

Changes to this policy

We may update this policy when we add features, change vendors, or for legal reasons. The “Last updated” date at the top reflects the most recent meaningful change. If a change is material we will notify customers who have given us their email.

Contact

Privacy questions or requests: privacy@fancy.pet. Everything else: hello@fancy.pet.