Privacy Policy
Last updated:
1. Who we are
PawPainted sells custom hand-painted pet figurines. This policy explains what personal information we collect, why we need it, and what rights you have. If anything here is unclear, contact us — see section 10.
2. What we collect
Order information: your email address, the name you give us, your shipping address and phone number if provided, and what you ordered.
Photos you upload: photographs of your pet, plus any notes you write about markings, colours or features.
Payment information: we use PayPal. We receive confirmation that a payment succeeded, the amount, a transaction identifier, and the email address associated with the PayPal account. We never receive or store your card number, CVV, or PayPal password.
Approval records: whether you approved a finished figurine, when, what changes you asked for, and the version of the photos involved.
Technical information: limited data needed to run the site securely — for example an approximate request count for rate limiting, and security-relevant logs. We do not build advertising profiles from this.
3. Why we use it
- To make and paint your figurine from your photos
- To email you order updates, approval requests and tracking
- To take payment and handle refunds
- To ship your order and handle delivery issues
- To handle support requests and revision claims
- To keep the site secure and prevent fraud or abuse
- To meet our legal and tax obligations
We do not sell your personal information. We do not use your pet photos in advertising, on our site, or on social media without asking you first and getting your explicit agreement.
4. Pet photos — special handling
Your pet photos are stored in private storage. They are not publicly addressable, not indexed by search engines, and are only accessible to staff who need them to produce your order. Access requires authentication; there is no public link that exposes them.
We do not send your photos to third-party AI image services. They go to the people painting your figurine, and nowhere else.
If you abandon an order before paying, temporary uploads are automatically purged.
5. Who we share with
Only what's necessary, only with:
- PayPal — to process your payment and refunds
- Our email provider — to deliver order notifications
- Our production partner — the people who hand-paint your figurine, who receive your photos and notes
- Shipping carriers — name, address and phone number, to deliver your parcel
- Our hosting and database providers — who store data on our behalf under contract
We may also disclose information where legally required, or to protect our rights in a dispute.
If we ever use advertising measurement tools (for example Meta Pixel), we configure them to receive only aggregate conversion events — not your email address, and never your pet photos.
6. Cookies and tracking
We use a small number of strictly necessary cookies to keep the site secure and to keep you signed in to our admin area (which is staff-only). If we add advertising or analytics measurement, we will disclose it here and give you a way to decline where required by law.
7. How long we keep it
- Order records: kept for as long as needed for warranty, accounting and tax purposes
- Pet photos: kept while your order is active and for a limited period afterwards for support and any reprint, then deleted
- Approval evidence: kept with the order record, since it documents what you agreed to
- Abandoned uploads: purged automatically within about 24 hours
8. Your rights
Depending on where you live, you may have the right to:
- Ask what personal information we hold about you
- Correct inaccurate information
- Ask us to delete your information, including pet photos
- Object to or restrict certain processing
- Receive a copy of your data in a portable format
To exercise any of these, contact us. We may need to verify your identity first — we won't hand order data to someone who merely claims an email address. Some information we must retain for legal, tax or fraud-prevention reasons even after a deletion request; we'll tell you if that applies.
9. Security
The site runs over HTTPS. Photos are stored privately and served only to authenticated requests. Payment credentials never touch our servers. Administrative access is protected by password hashing and session controls, and sensitive actions are logged in an append-only audit trail.
No system is perfect. If we ever suffer a breach affecting your data, we will notify you and the relevant authorities as required by law.
10. Contact
Privacy questions and deletion requests: use the contact page. Please include your order number if you have one. We respond to privacy requests as quickly as we can, and within any deadline set by applicable law.
11. Changes
If we change this policy materially, we'll update the date at the top and, where appropriate, tell you by email. Continued use of the site after an update means you accept the revised policy.