1. Who is responsible
chen xianjie, the individual operator of PawPlusMe at https://portraits.pawplusme.com/, is the data controller responsible for the personal information described in this Policy. Contact contact@pawplusme.com for privacy questions, access or deletion requests.
This Policy covers our website, digital portrait orders, optional physical keepsake requests and support. Payment providers may also process information for their own legal and payment obligations under their own notices. This Policy explains processing; it does not request blanket consent to unrelated activities.
2. Information you provide
- Portrait content: the person and pet photographs you select and upload, generated portraits, and your selected scene and style preferences. Photos can contain faces and other identifiable details; avoid unnecessary sensitive information.
- Order information: email address, order references, order status and dates, price, currency, PayPal transaction references and payment or refund status.
- Physical keepsake requests: selected products, recipient name, delivery address, postal code, artwork and print-review records, quotes, separate payment references and fulfilment or support history.
- Support: your messages, attachments you choose to send and information needed to resolve a request. Do not send card security codes, passwords or unnecessary identity documents.
There is no customer registration in the current purchase flow, and we do not collect a customer account password. Full payment-card numbers and security codes are handled by the payment provider, not stored on our servers.
3. Browser, network and usage information
Our hosting and delivery providers process IP addresses, request times, requested resources, browser or device information, errors and security events as needed to serve and protect the site. IP-derived country or region is not precise GPS location.
Your browser stores recent orders, private order access and your current photo draft, email and selections on your device. Browser caches may also retain site resources and the local photo-check model. Clearing site data removes these local records but does not delete orders stored by us, support correspondence or a copy you downloaded.
Cloudflare processes technical information to host, deliver and protect the site. The security check before a new order uses Cloudflare Turnstile, which processes browser and device signals to distinguish people from automated requests. The site also loads Google Fonts. PayPal checkout connects your browser to PayPal when you open it. We do not send your photos or private order-access tokens as analytics event fields.
4. How portrait processing works
Initial person/pet checks run in your browser using a model served by the site. That local check does not send your photos to a remote photo-check service. When you submit an order, however, both photos are uploaded to our server before payment.
After payment is verified, we send the photos, a scene reference and creative instructions to Cloudflare Workers AI to generate the portrait. We keep the result for private delivery and support. This processing combines images; we do not use it to verify your legal identity or maintain an identity-recognition database.
We do not train our own AI models on your uploads or portraits. Cloudflare's published Workers AI policy states that customer content is not used to train models. That policy does not mean our order system retains no images. We do not publish your photos or portraits or use them in marketing without a separate, explicit permission. Authorised operators may review content to resolve an order issue.
5. Purposes and legal bases
Where a legal basis is required, we use the following bases as applicable:
| Purpose | Information used | Basis |
|---|---|---|
| Create, deliver and support a requested portrait | Photos, preferences, email and order data | Steps requested before a contract and performance of the contract |
| Process payment and refunds | Order and transaction data | Contract performance and legal obligations |
| Send relevant order and support messages | Contact details and order references | Contract performance; legitimate interests in reliable communication |
| Protect access, investigate abuse and diagnose failures | Technical logs, order references and necessary content | Legitimate interests in security and reliability; legal obligations where applicable |
| Understand site traffic and performance | Limited technical and usage data | Legitimate interests where permitted; consent where legally required |
| Meet accounting, legal and dispute obligations | Necessary transaction and support records | Legal obligations and legitimate interests in legal claims |
| Any optional public showcase or promotional use | Only separately authorised content | Separate consent, which you can withdraw prospectively |
Where processing relies on consent, refusal or withdrawal does not remove unrelated rights. If data essential to producing the portrait is not provided, we may be unable to fulfil that request.
6. Providers and disclosures
We share information only as needed for the purposes described here:
| Recipient | Purpose and relevant information |
|---|---|
| Cloudflare | Website delivery, AI image generation, security checks, and routing messages sent to our contact address |
| PayPal | Digital portrait and separate physical keepsake checkout, payment confirmation, refunds and payment-security obligations; receives order references, amounts and payment information, not your uploaded photos or generated portrait through our checkout integration |
| Printful | Delivery availability and cost estimates for a requested keepsake; approved print artwork and recipient delivery information when a physical order is submitted for fulfilment |
| Resend, when configured | Transactional keepsake request, studio review and payment-link emails; receives the recipient email and necessary order message content |
| Google Cloud hosting of our order backend, private storage of order records, uploaded photos and portraits, image processing, fonts requested by your browser, and email handling for correspondence forwarded to our support mailbox |
We may also disclose necessary information to professional advisers or authorities when legally required, to address legal claims, or in a business transfer subject to continuing protections and required notices. We do not sell your personal information or share it for cross-context behavioural advertising. We do not operate a public customer-photo gallery.
Provider information: Cloudflare privacy, Workers AI data use and Google privacy. Review the PayPal notice presented when using its checkout.
7. Retention and deletion
Photos and generated portraits for a paid order are kept for 30 days after payment. An unpaid draft that has not entered payment processing expires after 24 hours. If a payment is still processing or its result is unclear, we may keep the associated photos for up to 30 days from the start of payment processing to confirm payment and deliver the portrait. Files are automatically deleted after these retention periods. Download and keep a copy of your completed portrait before its retention period ends.
A physical keepsake request has a separate private order record and a copy of the artwork needed for quotation, studio review and fulfilment. The digital order’s 30-day file deletion does not delete that separate artwork or physical order. We retain physical-order artwork and recipient details only as needed for the requested order, support, accounting, legal obligations or a dispute; contact us to request deletion when no longer needed.
Order, payment and support records may be kept longer where needed for support, accounting, legal obligations or a dispute. Keeping a transaction record does not require keeping the associated photos or portrait.
You can request deletion of uploaded photographs, generated images or other personal information by emailing contact@pawplusme.com. We verify that the request relates to your order and delete information we are not required to retain. Information retained for a legal obligation or dispute is restricted to that purpose; retaining a transaction record does not by itself require keeping all photo content.
Browser drafts and local order history remain until you clear the site's data or the browser removes it. Clearing local data does not delete server records. Deleting a stored file cannot remove copies already downloaded by you or another authorised recipient. Our providers keep their own payment, security and correspondence records under their retention rules.
8. International processing
Cloudflare, PayPal, Printful, Resend and Google may process information internationally. Your location may therefore differ from the processing location.
International processing is subject to applicable data-protection law and the contractual terms governing our service providers. Contact contact@pawplusme.com for information about the providers, processing locations and protections applicable to your information.
9. Security
We use HTTPS, private cloud storage, restricted administrative access and private order-access tokens. Payment confirmations are checked with PayPal before a portrait is created.
Keep private links secure, especially on shared devices. Report suspected exposure to contact@pawplusme.com. If a personal-data breach occurs, we will assess it and notify affected people and authorities when and within the periods required by applicable law.
10. Your choices and rights
Depending on applicable law, you may request information, access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent for a separate optional purpose without affecting earlier lawful processing. You may complain to the relevant data-protection authority and exercise applicable appeal or non-discrimination rights.
Email contact@pawplusme.com with sufficient order information for us to locate the record. We may verify identity in a proportionate way; do not send a full card number or unnecessary identity document. We aim to respond within 30 days and will follow any different applicable legal deadline, including requirements for explaining an extension. We will explain a lawful reason if we cannot fulfil all of a request.
You can clear browser site data and manage browser tracking protections. This can remove local drafts and private order access. Since we do not sell data or use cross-context advertising, there is no separate sale-based advertising programme to join or opt out of.
11. Messages and marketing
We send messages relevant to your order, support, security or required policy changes. The current flow does not enrol you in a marketing newsletter. Any future marketing subscription will require the appropriate separate choice and a working unsubscribe route; declining it will not prevent necessary service messages.
12. Children
The service is for customers aged 18 or older and accepts photographs of adults only. Do not upload a child's photo or submit information as an under-18 user. If we learn that such information was submitted, we will restrict processing and take appropriate steps to delete it, except where a limited record must be retained by law.
13. Changes and other services
We will update this Policy's version and date when practices change. Material changes will normally be explained on the website or by email to affected customers at least 14 days in advance, subject to urgent legal or security needs. We will seek new consent where legally necessary; continued browsing is not a substitute for it. Other websites and payment-provider pages have their own applicable notices.
14. Contact
Privacy, support and security: contact@pawplusme.com.
Operator: chen xianjie (individual operator). Website: https://portraits.pawplusme.com/.