Privacy Policy

Your photos are personal. We treat them that way.

This policy explains what information PicaToi collects, why we need it, how long we keep it, and the choices you have.

Last updated [CONFIRM: date] · Version 1.0
At a glance
You choose when to upload
Your photo is uploaded only after you tick the consent box and ask for a preview.
Used only for your kit
We use it to make your preview and your kit. We never sell it, publish it or use it in advertising.
Deleted on a schedule
Our systems delete photos and artwork automatically: within 30 days if you don't order, 7 days after fulfilment if you do. See section 5 for our print partner.
Your choice, any time
Ask to see, correct or delete your data at privacy@picatoi.com.
01

Who we are

PicaToi is operated by [CONFIRM: legal entity name], [CONFIRM: registered address], company number [CONFIRM: company number]. We are the data controller for the personal information described in this policy.

For any privacy question or request, contact privacy@picatoi.com.

02

Information we collect

We collect only what we need to make and deliver your kit and to run our shop.

Your photo The image you upload in the Atelier to create your artwork.
Your artwork The previews, numbered canvas, color guide and painting guide we make from your photo.
Contact details Name and email address, used for order confirmations, updates and replies.
Delivery details Shipping address and phone number, for your print partner and the carrier.
Order details Art style, canvas size and orientation, kit format and artwork title.
Payment Handled by Shopify's payment processing. We never see your full card number.
Technical data Your IP address, used briefly to limit repeated preview requests and prevent abuse.
03

How we use your photo

When you tick the consent box and ask for a preview, your photo is uploaded to our secure storage, checked by an automated content-safety service, and sent to our AI provider, which creates your artwork.

If you order, your artwork becomes your numbered canvas, color guide and painting guide, and is shared with our print partner so they can make your kit.

We never sell your photo, publish it or use it in advertising, and we do not use it to train AI models. [CONFIRM: that our AI provider's terms also exclude training on your images.] We only feature a finished painting if you tag us or give us separate permission.

04

Why we process your data

Data protection law requires a lawful basis for each use.

Making your preview Your consent, given with the checkbox in the Atelier. You can withdraw it at any time.
Fulfilling your order Contract: we need your artwork, contact and delivery details to make and send your kit.
Legal obligations Keeping invoices and tax records.
Legitimate interests Preventing abuse and fraud, keeping the service secure, and screening uploads for unsafe content.
05

How long we keep it

Photo and artwork, no order Deleted automatically from our systems within 30 days of upload.
Photo, with an order Deleted automatically 7 days after your order is fulfilled, and never kept more than 180 days for an order that stays open.
Artwork, with an order Your finished artwork (never your photo) is kept for 90 days after delivery, and at most 104 days after we ship it, so you can reorder or return it. Then it is deleted automatically. Ask us and we delete it sooner.
Painting guide link If we send you a private link to your painting guide (it shows your artwork), the link works for 30 days and the guide is then deleted. Anyone who has the link can open it until then, so please do not share it. Ask us and we switch it off sooner.
Print partner copies Our print partner currently keeps order files, including your artwork and delivery details, for as long as we work together. [CONFIRM: retention period being agreed in our data processing agreement.]
Content-safety records The results of the automated check (labels only, never your image) for 2 years.
Order and invoice records [CONFIRM: number of years] to meet tax and accounting rules.
Messages to us [CONFIRM: retention period] after your question is resolved.
06

Who we share it with

We share only what each provider needs to do its job, and we do not sell personal data. [CONFIRM: data processing agreements in place with each provider; not yet signed with our print partner.]

Shopify Our store, checkout, payments and order emails.
Amazon Web Services Stores your photo and artwork, and runs the automated content-safety check.
Replicate Runs the AI model that creates your artwork.
Railway Hosts the service that processes your photo.
Google Google Drive, used to hand your artwork file to our print partner.
Print partner Makes and ships your kit. Receives your artwork, name, delivery address, phone number and email.
Shipping carriers Deliver your kit. Receive your name, address and phone number.
07

International transfers

Some of this processing happens outside the European Economic Area: in the United States (our storage, AI and hosting providers) and in China (our print partner). [CONFIRM: the safeguards relied on for each transfer, such as the EU-US Data Privacy Framework or Standard Contractual Clauses.]

08

Cookies and your browser

Shopify sets essential cookies so your cart and checkout work. The Atelier also keeps your recent previews in your browser's own storage, so they are still there if you come back; clearing your browser data removes them. [CONFIRM: whether any analytics or marketing cookies are used, and how consent is collected.]

09

Your rights

You can ask us at any time to:

Access Receive a copy of the personal data we hold about you.
Correct Fix anything inaccurate or incomplete.
Delete Erase your data, including your photo and artwork, unless we must keep it by law. [CONFIRM: that our print partner will delete its copy on request.]
Restrict or object Limit or stop certain uses of your data.
Portability Receive your data in a common, machine-readable format.
Withdraw consent Stop us using your photo for previews, at any time.
Complain Contact your data protection authority, such as [CONFIRM: supervisory authority].
10

Children

Our shop is for adults. If you upload a photo of a child, you confirm that you are their parent or guardian, or have their guardian's permission. We use it only to make your kit, like any other photo.

11

Changes to this policy

If we make a meaningful change, we will update the date at the top of this page and, for existing customers, tell you by email before it takes effect.

Questions about your data?
Write to privacy@picatoi.com. We reply within one month, as the law requires, and usually much sooner.
Contact us