Privacy Policy

This Privacy Policy explains how PetCanvas (“we”, “us”, or “our”) collects, uses, and shares information about you when you use our website, upload pet photos, or place an order. We’re a small studio and we take your privacy seriously — we collect only what we need to fulfill your order and delete it on a regular schedule.

By using the Service, you agree to the practices described in this policy.

Important: PetCanvas is a pet-portrait service only. We do not accept or process photos of people. The information below describes only what we collect from pet photos and related order activity.

We collect the following categories of information:

• Pet photos you upload— used to generate your AI portrait, then hosted on a third-party image service (ImgBB) with an expiration setting of up to 30 days, after which the image URL becomes inaccessible and the file is permanently deleted from ImgBB’s servers. We verify deletion through periodic manual checks.
• Generated portraits — saved in your account gallery (if signed in) so you can re-download or reorder.
• Order information — name, shipping address, billing address, email, phone number (if provided), order total, and tracking number. This data is processed and stored by Shopify, our e-commerce platform.
• Account information — if you create an account, we store your email and a hashed password.
• Anonymous usage analytics — page views, browser type, and country (via Vercel Analytics). No personally identifiable information is collected, and data is not sold to third parties.

We use the information we collect to:

• Generate, print, and ship your custom portrait.
• Send order confirmations, shipping updates, and customer support replies.
• Prevent fraud and abuse of our Service.
• Improve our website and the quality of our generated artwork.

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

To operate the Service, we share limited data with the following trusted third parties:

• Shopify — e-commerce platform. Processes orders, payments, and stores order history. Shopify Privacy Policy.
• ImgBB — temporary image hosting. Your uploaded photos and generated portraits are hosted here for up to 30 days, then automatically deleted. We do not share photo URLs publicly.
• Vercel — website hosting and anonymous analytics. Vercel Privacy Policy.
• Shipping carriers — third-party couriers selected at shipping time based on your destination, package size, and operational factors. We share only your name and shipping address with the carrier fulfilling your order.

Your uploaded pet photos and generated portraits are hosted on ImgBB with an expiration of 30 days. After that, the image URL becomes inaccessible and the file is permanently deleted from ImgBB’s servers.

If you have a PetCanvas account, we keep a longer-lived copy of your generated portraits in your private gallery so you can re-download or reorder. You can delete these at any time from your My Gallery page.

To request deletion of all your data, email support@petcanvas.cc with your order number. We will process your request within 30 days.

We use a small number of essential cookies to keep you signed in and remember your shopping cart. We do not use advertising or cross-site tracking cookies.

• Essential cookies — keep you signed in, remember cart contents. These cannot be disabled while using the Service.
• Analytics — Vercel Analytics is cookieless and collects only anonymous page views.

If you are a California resident, you have the right to:

• Request a copy of the personal information we hold about you.
• Request that we delete your personal information.
• Opt out of the “sale” of your personal information (we do not sell data, but you have the right to confirm this).
• Non-discrimination for exercising your privacy rights.

To exercise any of these rights, email support@petcanvas.cc with your request. We will respond within 45 days.

The Service is not directed to children under 13, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

We use industry-standard security measures to protect your information: HTTPS/TLS encryption in transit, hashed passwords at rest, and access controls on internal systems. No method of transmission over the Internet, however, is 100% secure.

We may update this Privacy Policy from time to time. The “Last updated” date at the top will reflect the most recent changes. Continued use of the Service after changes constitutes acceptance of the new policy.

In the event of a data breach affecting your personal information, we will:

• Notify affected users by email within the time period required by applicable state law (typically within 45–60 days of discovery).
• Describe the nature of the breach, the categories of information involved, and the steps we are taking in response.
• Offer guidance on protective steps you can take (such as changing your password).

Some web browsers offer a “Do Not Track” (DNT) feature that signals to websites that you do not want your online activity tracked. PetCanvas does not respond to DNT signals at this time.

We use Vercel Analytics, which is cookieless and collects only anonymous, aggregated page view data. We do not use advertising cookies, third-party tracking pixels, or cross-site tracking technologies. If we change this practice in the future, we will update this Privacy Policy.

PetCanvas does not collect, store, or process your credit or debit card information. All payment processing is handled entirely by Shopify Payments over an encrypted connection. Card data never passes through, touches, or is stored on our servers.

This means PetCanvas operates outside the scope of PCI-DSS (Payment Card Industry Data Security Standard) compliance requirements, as those obligations are handled by our PCI-DSS–certified payment processor. For questions about how your payment data is handled, please refer to Shopify’s Privacy Policy.

Under the California Consumer Privacy Act (CCPA/CPRA), “sale” of personal information is defined broadly to include sharing personal information for “monetary or other valuable consideration”.

PetCanvas shares limited personal information with the third-party service providers listed in Section 4 solely to operate the Service (payment processing, image hosting, website hosting, and shipping). These providers act as our service providers / processors, not as independent third-party buyers of your data. This sharing does not constitute a “sale” of your personal information under CCPA/CPRA.

We do not sell, rent, or trade your personal information to any third party for their own independent commercial or marketing purposes. See Section 13 (No Marketing Use) for our complete policy.

For privacy-related questions or to exercise your data rights, email support@petcanvas.cc. We typically reply within 1 business day.

PetCanvas is designed exclusively for pet portraits. Our service generates custom artwork from photos of animals (dogs, cats, and other pets) only.

We do not accept photos that depict people— whether alone, in groups, or alongside pets. Photos containing recognizable human faces, bodies, or other identifying features of people are not supported and should not be uploaded to the Service.

Our service does notperform automated face detection on uploaded photos — you are responsible for ensuring your photo contains only pets before uploading. Photos that we become aware contain recognizable people will be rejected; in such cases, we will delete the photo and any generated image associated with the order, and issue a full refund. The deletion timeline follows the rules described in Section 5 above. If a delivered portrait contains recognizable people that our manual review missed, we will work with the customer on a case-by-case basis (see our Refund Policy).

This restriction exists for several reasons, including:

• Privacy and publicity rights— we cannot verify that every person depicted in a photo has consented to having their likeness processed and transformed into AI-generated artwork.
• Service scope— PetCanvas’s style, framing, and quality controls are optimized for animal subjects, not human portraits.
• Legal compliance— processing biometric or facial data of people may trigger additional obligations under laws such as the Illinois Biometric Information Privacy Act (BIPA), GDPR, and similar regulations. Limiting our service to pets keeps us out of these high-risk categories.

By uploading a photo, you confirm that the image depicts only pets (animals) and does not contain recognizable people. If a human subject is incidentally present (for example, a hand holding a leash), please crop the photo before uploading.

We do not use your uploaded photos or generated artwork for marketing, advertising, or any third-party display. This includes our website gallery, social media channels, paid advertising, email newsletters, case studies, blog posts, and any other public-facing material.

Limited exception:we may retain and display artwork as necessary to comply with legal obligations, resolve disputes, or enforce our Terms of Service — for example, retaining records of fraudulent orders or responding to a subpoena.

Marketing materials on our website and channels are created entirely from our own AI-generated sample imagery — not from your pet’s photo or your custom portrait. We never reuse, repost, or resell customer artwork.

The only exceptionis if you give us separate, explicit written permission (for example, replying to our email request with “yes, you can feature my pet’s portrait”). You can withdraw that permission at any time by emailing support@petcanvas.cc, and we will remove the content within 30 days.

California Civil Code §1798.83 (the “Shine the Light” law) permits California residents to request information about the categories of personal information disclosed to third parties for those third parties’ direct marketing purposes. As stated in Section 17, PetCanvas does not share your personal information with third parties for their direct marketing purposes, and we do not sell your personal information.

Nevertheless, California residents may submit a Shine the Light request by emailing support@petcanvas.cc. We will respond within the time period required by California law.

While uploaded photos and generated portraits are automatically deleted from our systems within 30 days (see Section 5), certain business records are retained for longer periods as required by law:

• Order and transaction records: retained for 7 years for tax and accounting purposes (IRS requires minimum 3 years; we retain longer as a matter of policy).
• Account information: retained while your account is active and for up to 90 days after account deletion, to allow for account recovery.
• Support correspondence: retained for 3 years to support dispute resolution and improve customer service.
• Legal hold records: if a legal proceeding is reasonably anticipated, related records may be retained beyond the standard period until the matter is resolved.

Retention of business records does not include uploaded photos or generated portraits, which remain subject to the 30-day deletion policy in Section 5.