Privacy Policy

1. Information We Collect

We collect several types of information depending on how you interact with our Site:

1.1 Photos You Upload

When you use our AI portrait generation service, you upload one or more photographs. As part of generating your portrait, an automated system analyses your photograph to decide what to produce — for example, how many subjects are in it, whether they are how many people are present, whether a person appears to be a man or a woman, and roughly how old they appear. This is used only to select and compose your portrait. These photos are transmitted to our servers and processed by our AI system to generate stylised portraits. We store uploaded photos securely and use them solely for the purpose of generating your portrait(s). Photos are not shared with third parties except as necessary for AI processing (see Section 4).

1.2 Order Information

When you make a purchase, we collect information necessary to process your order, including:

• Email address (collected during Stripe checkout)
• Billing information (processed and stored by Stripe; we do not store full payment card details)
• Shipping address (for physical orders — posters, canvases and frames)
• Order details (product type, size, amount paid)

1.3 Device and Usage Information

When you visit the Site, we automatically collect certain information about your device and browsing activity, including:

• IP address and approximate geographic location
• Browser type and version, operating system
• Device type (desktop, mobile, tablet) and screen resolution
• Referring website or source
• Pages visited, time spent on pages, click behavior
• Session recordings and heatmap data (via Hotjar and Sentry)

1.4 Session Information

We use anonymous sessions to allow you to use the Site without creating an account. A unique session identifier is stored in a cookie on your browser and linked to your uploads, generations, and orders. No personal information is required to start a session.

1.5 Order Access and Download Logs

To confirm delivery of digital goods and to protect against fraud and payment disputes, we keep server-side records of order-related access events. For each event we store the date and time, your IP address, and your browser/device information. Logged events include:

• Viewing an order confirmation (“thank you”) page
• Opening your account page
• Opening a download link (including links sent by email)
• Downloading your purchased portrait file

We retain these logs as evidence that purchased content was made available to and accessed by the buyer. Our legal basis is our legitimate interest in preventing fraud and resolving chargebacks and disputes (see Section 2).

1.6 Information We Infer

To produce the right portrait, our automated system infers basic characteristics from your photograph — the number of subjects, how many people are present, their apparent gender, and their approximate age range. These inferences are used only to generate your portrait. They are not used to identify anyone, are not used for advertising, and are not shared with anyone other than the AI provider that generates your portrait.

2. How We Use Your Information

We use the information we collect to:

• Provide the service: Process your uploaded photos through our AI system to generate portraits, deliver digital downloads, and fulfil physical orders (posters, canvases and frames).
• Process payments: Complete transactions securely through Stripe and maintain order records.
• Communicate with you: Send order confirmations, download links, shipping updates, and respond to support inquiries via email (powered by Klaviyo).
• Improve the service: Analyze usage patterns, identify issues, and optimize the user experience using analytics tools.
• Marketing: With your consent, send promotional emails about new features, templates, or offers. You can unsubscribe at any time.
• Prevent fraud and abuse: Monitor for unauthorized access, automated abuse, or attempts to circumvent our security measures.
• Resolve disputes and chargebacks: Maintain access and download logs (Section 1.5) as evidence that purchased digital content was delivered to and accessed by the buyer, and use them to respond to payment disputes.

2.1 Our legal bases for processing

Where the GDPR or a similar law applies, we rely on:

• Performance of a contract — to process your photographs, generate your portrait, take payment, and fulfil and deliver your order.
• Legitimate interests — to prevent fraud and abuse, keep order access and download logs for dispute resolution, secure the Site, and analyse usage to improve the service. We balance these against your rights and interests.
• Consent — for marketing emails, and for advertising and analytics cookies where a consent choice is presented to you. You can withdraw consent at any time.
• Legal obligation — to keep accounting and tax records.

3. Photo Data Handling

We take the handling of your uploaded photos seriously. Here is how we treat your photo data:

• Purpose limitation: Uploaded photos are used solely for generating AI portraits. We do not use your photos for training AI models, selling to third parties, or any purpose other than fulfilling your portrait request.
• AI processing: Your photos are sent to our AI provider (Google) for portrait generation. The AI provider processes the images in real time and does not retain them after generation is complete.
• Storage: Uploaded photos are stored securely in our cloud infrastructure (Supabase Storage) with encryption at rest (AES-256), encrypted transport (TLS), and access controls. Only your session can access your uploads.
• No biometric templates: We do not create or store a faceprint, a face template, or any numerical representation of facial features that could be used to identify or recognise a person, and we never use your photograph to identify anyone. Any automated processing is carried out solely to produce your portrait and exists only transiently during generation.
• Early deletion: You may request immediate deletion of your photos and generated portraits at any time by contacting us at help@artstories.ai.

3.1 Retention Schedule for Uploaded Photos

• Failed or abandoned generation attempts: original photo uploads are automatically deleted within 90 days of the failed or abandoned attempt.
• Successful generations you have purchased: retained for as long as you maintain access to your account, so that you can re-download your portraits at any time.
• Successful generations you have not purchased: automatically deleted after a short period (currently around 2 months from the generation date, and in any case within 12 months).
• Immediate deletion on request: contact help@artstories.ai to request deletion at any time.

4. Third-Party Services

We share your information with the following third-party service providers, each for a specific purpose:

Payment Processing

• Stripe — Processes all payments. Stripe receives your email, billing details, and payment card information. Stripe's privacy policy: stripe.com/privacy

Order Fulfilment

• Print production partner — We use a third-party print-on-demand provider to print, package, and ship physical orders. They receive your finished portrait file, your name, email address, postal address and order details, solely to produce and deliver your order. They never receive your uploaded photographs. Our print partner is established in the European Economic Area and produces orders through a network of production facilities, usually in or near your own country. We will identify them by name on request.
• Shipping carriers — Carriers receive your name and delivery address to deliver your order and provide tracking.

Data Storage

• Supabase — Hosts our database and file storage (uploaded photos, generated images, session data, order records). Data is stored in secure cloud infrastructure with encryption at rest.
• Vercel — Hosts our website application. Processes web requests and may log IP addresses and request metadata.

AI Processing

• Google — Primary AI provider. Processes your uploaded photos to generate AI portraits. Photos are transmitted securely and processed in real time. Google does not retain your images after processing per Google's API terms.
• OpenRouter — A routing service we use to reach Google's models. Depending on our current configuration, your photograph may pass through OpenRouter for the step that classifies it, for portrait generation, or both. Requests are routed only to Google's models; no other AI provider ever receives your photographs. Images are not retained after processing.

Email Communications

• Klaviyo — Sends transactional emails (order confirmations, download links) and marketing emails (with your consent). Klaviyo receives your email address and order information. Klaviyo's privacy policy: klaviyo.com/legal/privacy

Analytics and Tracking

• Google Tag Manager (GTM) — Manages analytics and marketing tags on our Site. GTM may load additional scripts from Google Analytics and other providers.
• Google Analytics 4 — Loaded through Google Tag Manager. Measures how the Site is used — pages viewed, actions taken, and how visitors arrive — so we can understand and improve the service.
• Meta Pixel (Facebook) — Tracks conversions and enables retargeting advertising on Meta platforms (Facebook, Instagram). Collects browsing behavior and purchase events.
• Hotjar — Records session replays and generates heatmaps to help us understand how users interact with our Site. Hotjar does not capture the contents of form fields.
• TikTok Pixel — Tracks conversions and enables retargeting advertising on TikTok. Collects browsing behavior and purchase events, and receives a hashed identifier where available. We do not transmit uploaded photos.
• Pinterest Tag — Tracks conversions and enables retargeting advertising on Pinterest. Collects browsing behavior and purchase events. We do not transmit uploaded photos.
• NewsBreak Pixel — Tracks conversions and enables retargeting advertising on NewsBreak. Collects browsing behavior and purchase events. We do not transmit uploaded photos.
• TikTok Events API — In addition to the TikTok Pixel, we transmit purchase confirmation and key conversion events to TikTok server-side. We transmit hashed email addresses, the TikTok click identifier where present, and order details for ad-attribution purposes. We do not transmit uploaded photos.
• Meta Conversions API (CAPI) — In addition to the Meta Pixel, we transmit purchase confirmation and key conversion events to Meta server-side. We transmit hashed email addresses and order details for ad-attribution purposes. We do not transmit uploaded photos.

Error Monitoring

• Sentry — Captures application error events and crash data, which may include IP addresses, request URLs, browser/device metadata, and error stack traces. Sentry also records session replays: a video-like reconstruction of your visit. We may record any session, from the first page you open, to diagnose problems and improve the service. These replays capture page structure, on-screen text, and click behavior, but images (including your uploaded photos and generated portraits) are blocked and anything you type into form fields (email, address, payment details) is masked before it leaves your browser.

5. Cookies and Tracking Technologies

We use cookies and similar technologies for the following purposes:

• Essential cookies: Session identifier cookie (as_session) that allows you to use the Site without creating an account. This cookie is necessary for the service to function.
• Analytics cookies: Placed by Google Analytics and Hotjar to collect usage data and improve the service.
• Marketing cookies: Placed by Meta Pixel, Google, TikTok, Pinterest, and NewsBreak to enable targeted advertising and measure ad campaign effectiveness.
• Attribution and identifier cookies: as_eid holds a copy of your session identifier and is shared with our advertising partners so they can recognise your device across visits. as_utm, as_ref and as_landing record how you arrived at the Site, so we can measure which campaigns work. These last for up to 30 days.
• Your privacy choice: as_privacy_optout records that you have opted out of sharing for advertising, so we can honour it on future visits.

You can control cookie preferences through your browser settings. Disabling essential cookies may prevent the Site from functioning properly. Disabling analytics and marketing cookies will not affect core functionality but will limit our ability to improve the service and show you relevant advertisements.

6. Behavioral Advertising

We use your personal information to provide you with targeted advertisements or marketing communications that we believe may be of interest to you. This is done through the following mechanisms:

• Meta (Facebook/Instagram): We use Meta Pixel to track actions on our Site (such as viewing a preview or completing a purchase) and create custom audiences for advertising on Meta platforms.
• Google Ads: We may use Google advertising services via GTM to display retargeting ads to visitors who have interacted with our Site.
• TikTok: We use the TikTok Pixel and the TikTok Events API to track actions on our Site and to build audiences for advertising on TikTok.
• Pinterest: We use the Pinterest Tag to track actions on our Site and to build audiences for advertising on Pinterest.
• NewsBreak: We use the NewsBreak Pixel to track actions on our Site and to build audiences for advertising on NewsBreak.

The simplest way to switch this off is the Your Privacy Choices link in our footer, which disables the advertising and analytics tools that run in your browser. You can also opt out with each platform directly, or through the industry opt-out tools below:

• Meta: accountscenter.facebook.com → Ad preferences
• Google: myadcenter.google.com
• Digital Advertising Alliance: optout.aboutads.info
• Network Advertising Initiative: optout.networkadvertising.org

7. Data Retention

We retain your data for the following periods:

• Order records: Retained for as long as necessary for accounting, tax, and legal compliance purposes (typically 7 years).
• Session data: Anonymous session records are retained for 12 months, after which they are purged.
• Email and marketing data: Retained until you unsubscribe or request deletion.
• Analytics data: Retained according to each analytics provider's retention policies (typically 14–26 months).

8. Your Rights

We provide these rights to every user worldwide, regardless of which country or U.S. state you live in. These commitments meet or exceed the requirements of the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and comparable general privacy laws in Colorado, Connecticut, Montana, Oregon, Texas, Utah, Virginia, Washington, the UK, Canada, and other jurisdictions. Illinois residents also have specific rights under the Biometric Information Privacy Act, described in the biometric data notice below:

• Right to know / access: Request information about what personal data we hold about you, including a copy of that data.
• Right to delete / erasure: Request deletion of your personal data, including uploaded photographs and generated portraits.
• Right to correct / rectification: Request correction of inaccurate personal data we hold.
• Right to data portability: Request your data in a structured, commonly used, machine-readable format.
• Right to object / restrict processing: Object to or request that we limit how we process your data, including for direct marketing.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time.
• Your photos are never sold, and never used for marketing or AI training: We do not sell, lease, trade, or share your uploaded photographs or generated portraits with any third party for marketing, AI training, or commercial purposes. Your uploaded photographs are never shared with anyone except the AI provider that classifies and generates your portrait (Google, reached either directly or through the OpenRouter routing service), strictly for transient processing as described in Section 4 — and that provider does not retain your images after processing. Your finished portrait, together with your name, contact details, and shipping address, is shared with our print production partner where you have ordered a physical print, solely to make and deliver it.
• We do not sell your personal information: We do not exchange your personal information for money.
• We do share information for advertising, and you can turn it off: To measure advertising effectiveness and show relevant ads, we transmit non-photo events — such as pageviews, purchase confirmations, hashed email addresses, and a durable identifier stored in your browser that lets these partners recognise your device across visits — to Meta, Google, TikTok, Pinterest, and NewsBreak. Under California law this is “sharing for cross-context behavioral advertising.” You can opt out at any time using the Your Privacy Choices link in our footer, which switches off the advertising and analytics tools that run in your browser, and we honor Global Privacy Control (GPC) browser signals automatically. Confirmation of a completed purchase is also sent to these partners directly from our servers, and that transmission is not controlled by this setting.
• Non-discrimination: We will not deny service, change pricing, or otherwise penalize you for exercising any of these rights.
• Unsubscribe: Opt out of marketing emails using the link in any email we send, or by emailing us.

To exercise any of these rights, email help@artstories.ai. We respond to verifiable requests within 30 days. Our lead supervisory authority is the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija, VDAI), L. Sapiegos g. 17, Vilnius, ada@ada.lt. Residents of the EU, EEA, and UK may also lodge a complaint with their own local data protection authority.

Biometric data notice (Illinois BIPA and similar state laws):

Our AI transforms your uploaded photograph into a stylised portrait. We do not create or store a faceprint, a face template, or any numerical representation of facial features that could be used to identify or recognise a person, and we never use your photograph to identify anyone. Any automated processing of your photograph is carried out solely to produce the artwork you have ordered, and exists only transiently during generation. We do not sell, lease, trade, or otherwise profit from biometric information. Uploaded photographs are stored only for the purposes and retention periods stated in Section 3 above.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption in transit (TLS/SSL), encryption at rest for stored data, access controls on file storage, and secure handling of payment information through Stripe (PCI DSS compliant). However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

10. Children's Privacy

Our service is not directed to anyone under the age of 18. Per Section 4.1 of our Terms of Service, users must be at least 18 years of age (or the age of majority in their jurisdiction, if higher) to upload photographs or otherwise use the service. We do not knowingly collect personal information from individuals under 18. If you become aware that someone under 18 has provided us with personal data, please contact us at help@artstories.ai and we will take steps to delete such information. This commitment is at least as protective as the United States Children's Online Privacy Protection Act (COPPA, under 13) and Article 8 of the EU General Data Protection Regulation (GDPR, under 16).

Note that uploading photographs that depict children is separately governed by Section 4 of our Terms of Service — adult uploaders must be the parent or legal guardian of every child depicted, or have written consent from each such parent or legal guardian.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States (where some of our service providers are located). We ensure that appropriate safeguards are in place for such transfers, including Standard Contractual Clauses (SCCs) where required under GDPR.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will post the updated policy on this page with a revised “Last updated” date. We encourage you to review this page periodically. Your continued use of the Site after any changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

• Company: UAB “Madcom”
• Company code: 307029363
• VAT number: LT100018828719
• Email: help@artstories.ai
• Website: artstories.ai