Privacy policy · Last updated 29 October 2026

Your photos, kept with care

This policy explains what we keep when you use Petclip, why, who else handles it, how long we keep it, and how you can delete it.

Who is responsible for your data

Marfa Tarkhova, trading as Petclip (sole trader, United Kingdom), is the controller of your personal data: the one who decides how it is used and is responsible for it. Contact: support@petclip.io.

What we keep

• Your pet’s photos (up to three) and, if you choose a portrait together, photos of you (up to two). When you upload a photo, we remove its location and other hidden information (EXIF metadata).
• Your pet’s name, only if you add it on your order page for the file names (optional). If you made previews before 18 October 2026, we may also hold the pronoun you chose then.
• A short description of your pet’s look (ears, coat, markings and so on), written by our AI from your photos and checked or edited by you.
• The previews, portraits and moving portraits we make for you, and the results of our automatic checks of each photo and portrait.
• Your email address, if you give it to us for your link or a reminder. When you pay, Stripe also passes us the email address you enter at checkout, so we can send you your order.
• Order details: what you bought, when, the amount and currency, and the payment and refund status. We never see your card details.
• Your confirmation at checkout: when you ticked the box next to the pay button asking us to deliver right away, and which wording it showed.
• Technical data that keeps the service fair and safe: your IP address, a random device code your browser keeps for this site (we store only a keyed, one-way hash of it), and counts of how many previews were made. We look up the country and, in the US, the state of your IP address in a database on our own server, to show you the right privacy choices and to offer portraits with a person only where the law allows it. Your address never leaves our server for this. We don’t keep the result, except that our server sends the country and, in the US, the state with the events it tells our analytics provider about, and keeps them only until they are sent (see Analytics and session recordings). The database is IP Geolocation by DB-IP, licensed under CC BY 4.0.
• How you use our pages, with our analytics provider PostHog: the pages you view, the buttons you press and the steps you take, your browser and device type, and your country and region worked out from your IP address; and, where the rules below allow it, recordings of your visit in which your photos, previews and portraits and anything you type are hidden (see Analytics and session recordings).

What we don’t do

• We don’t create face templates or measure faces to recognize anyone, and we don’t identify anyone. The only automatic checks we run on the people in photos are for children and nudity, to keep them out.
• We don’t rent your data, and we never share your photos, answers or private links for advertising. The only ad tracker is Meta’s: outside the US only if you choose Accept in the banner; in the US unless you opt out, which US state laws may call a “sale” or “sharing” of personal information (see Cookies and If you live in the US).
• We don’t use your photos, previews or portraits to train AI, and OpenAI and Google, which make them, don’t either (see below).
• We don’t show your portraits anywhere unless you separately agree.

Why we use it, and our legal bases

• To make and deliver your previews, portraits and moving portraits, and to email you about them (your link, your order, refunds). This is needed for the service you ask for: our contract with you, including the free previews you request before buying.
• To send the one reminder you ticked. This is based on your consent. You can unsubscribe at any time with the link in that email.
• To prevent abuse, keep free previews fair, keep the service secure, and keep photos of children and nudity out. This is based on our legitimate interests, and yours, in a safe and fair service.
• To measure, improve and target our ads on Facebook and Instagram. Outside the US, only if you choose Accept in the cookie banner: this is based on your consent, which you can change at any time with “Your Privacy Choices” at the bottom of any page. In the US, unless you opt out: this is based on our legitimate interests in advertising our service, and your opt-out is your right to object, which we always honor.
• To understand how people use our pages and fix what gets in their way (analytics and recordings of visits, with PostHog). Outside the US, its cookie and the recordings only if you choose Accept: this is based on your consent, which you can change at any time with “Your Privacy Choices” at the bottom of any page; until then, and after Decline, our pages only count visits without cookies and our server reports previews, purchases and refunds under a random code of your previews, which is based on our legitimate interests. In the US, unless you turn it off: this is based on our legitimate interests in improving our service, and turning it off is your right to object, which we always honor.
• To keep order records for tax and accounting, and your confirmation at checkout to show what was agreed. This is a legal obligation and our legitimate interest.

Automatic checks

We check each photo to tell a pet from a person and to look for children or nudity. This is classification only; we don’t identify anyone. If none of your looks has you in it, we delete your photo when the previews start. If a photo shows you and your pet together, we crop each of you from it when we can, and we delete the full photo when your previews start.

When you upload a photo, an automatic check looks for children and nudity, and for basic problems such as no pet in the picture or a very blurry photo. A photo that fails is not stored: it is deleted straight away, and only the reason is noted. Before you see a portrait, our AI also compares the pet in it with your pet’s photos to catch obvious mistakes, and checks that a person in it looks natural, keeps the glasses, hair and clothes from your photo and doesn’t look older than in it. This compares appearance only: it doesn’t recognize faces, never compares anyone with another person and never identifies anyone. These checks don’t identify anyone and have no legal or similarly significant effect on you. If you think a photo was rejected by mistake, write to us and a person will look at it.

Who else handles your data

• OpenAI, United States, which makes your previews and portraits. Your photos, the description of your pet and our instructions are sent to OpenAI to make your previews, the fixes you ask for, and the first frame of a moving portrait. We use OpenAI’s paid API: OpenAI processes this data on our behalf, doesn’t use it to train its models, and keeps requests for up to 30 days only to detect abuse. OpenAI automatically screens the photos it receives for child sexual abuse material; a photo flagged by that screening may be kept longer for review.
• Google (Gemini), United States, our other AI provider. Your photos, the description of your pet and our instructions are sent to Google to run the checks above, to make moving portraits, and to make a preview or portrait when OpenAI can’t. We use Google’s paid API: Google processes this data on our behalf, doesn’t use it to train or improve its models, and keeps requests for up to 55 days only to detect abuse. We delete moving portraits from Google’s servers as soon as we have downloaded them.
• fal.ai, United States, which enlarges a portrait you buy to its full print size. It receives only that portrait, never your original photos or your details. fal keeps no history of the request, and we ask it to delete the copy we send within an hour.
• Bria AI, Israel, whose enlarging model fal runs for painted styles, or when fal’s first enlarging model fails. It receives the same portrait through fal and nothing else.
• Our server host, in Germany (EU), where the service runs and your photos and files are stored.
• Resend, United States, which delivers our emails.
• Stripe and Onelink, which handle payments and tax. They are independent controllers of your payment details, under their own privacy policy.
• Meta Platforms Ireland Ltd and Meta Platforms, Inc., outside the US only if you choose Accept in the banner, and in the US unless you opt out. We and Meta are joint controllers for collecting this data and sending it to Meta; Meta is an independent controller of what it does with it afterwards (see Cookies).
• PostHog Inc., United States (2261 Market Street #4008, San Francisco, CA 94114), our analytics provider. It processes what our pages and our server send it on our behalf, under its data processing agreement, and never receives your photos, previews or portraits, your pet’s name, your email address or your private links (see Analytics and session recordings).
• The developer who builds and maintains the service for us, who can access the server to keep it running.

We don’t share your data with anyone else unless the law requires it.

International transfers

Your photos and files are stored in Germany, in the EU, which the UK recognizes as giving adequate protection. OpenAI, Google, fal.ai and Resend process data in the United States; those transfers rely on the safeguards in their data processing terms, such as standard contractual clauses and the UK addendum to them. Bria AI is in Israel, which the UK also recognizes as giving adequate protection. The people who maintain the service may sometimes access the server from other countries; that access is protected by secure, key-based logins. Meta may transfer the data it receives (after you choose Accept, or in the US unless you opt out) to the United States, under the safeguards in its own terms. PostHog processes our analytics data in the United States; it is certified under the EU-US Data Privacy Framework and its UK Extension, and its data processing agreement also includes the standard contractual clauses with the UK addendum.

How long we keep it

• Photos and previews you don’t buy: kept for up to 7 days after your last visit, then deleted. Once, from your link, you can ask us to keep them longer.
• After you buy: your uploaded photos, and the previews you didn’t buy, are kept for up to 30 days after your portrait is delivered, then deleted.
• Portraits and moving portraits you buy: kept for up to 12 months after payment so you can download them again, then deleted.
• Photos rejected by our checks: not stored; deleted immediately.
• Your email address: deleted with your previews if you don’t buy. If you buy, kept until your portrait files are deleted, or until you delete everything yourself.
• Order records (what was bought, the amount, dates, status and your confirmation at checkout; no photos): kept as long as tax and accounting law requires, usually 6 years.
• IP addresses: up to 30 days.
• Records of payment events from Stripe: up to 90 days. Our log of sent emails keeps the address for up to 7 days after sending.
• At OpenAI: requests for up to 30 days, only to detect abuse (longer only for a photo its child-safety screening flags).
• At Google: request logs for up to 55 days; moving portraits are deleted there as soon as we download them.
• At fal.ai: we ask fal to delete the portrait we send to be enlarged within an hour; no request history is kept. Bria AI receives only that portrait.
• At PostHog: recordings of visits for up to 30 days, and analytics events for up to 1 year. Our server keeps its own record of the events it sent PostHog (which step, when, the order and the amount; no names, email addresses, photos or links) for up to 13 months. PostHog’s visitor and visit codes, the country, the US state and the campaign tags that go with an event are kept only until it is sent.
• After you delete: we keep a minimal record without photos, names or email addresses (when previews were made, a hashed device code, and a keyed one-way hash of your email address), so free previews stay fair and repeated refunds can be spotted.

Deleting your data

You can delete everything at any time. Use “Delete these photos and previews” on your previews page, or “Delete my photos and portraits” on your order page: your photos, previews and portraits are deleted from our server straight away, and their links stop working. We keep only the order record described above. You can also write to support@petclip.io and we will do it for you.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time. Write to support@petclip.io; we reply within one month, as the law requires.

If you live in the US, see also If you live in the US for your right to opt out and how to appeal.

If you are unhappy with how we have handled your data, please tell us first at support@petclip.io. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. If you live in the EU, you can complain to the data protection authority where you live.

Children

Petclip is only for adults, 18 and over. Photos of children aren’t allowed: our checks reject them and we don’t keep them.

Cookies and local storage

Meta’s pixel (Meta Platforms Ireland Ltd), on our home page only, sets a cookie so that Facebook and Instagram can measure, improve and target our ads. With it, the pixel and our server (Meta’s Conversions API) tell Meta about these steps: a page was viewed, previews were asked for, previews were ready, checkout was started and a purchase was made, with the amount and currency, the cookie ids, your IP address and browser. Meta never receives your photos, your pet’s name, the looks you chose, your email address or your private links. We and Meta are joint controllers for collecting this data and sending it to Meta (Meta’s Controller Addendum applies). Meta is an independent controller of what it does with it afterwards, which includes using it for its own purposes, and it may transfer it to the United States.

Outside the US (the UK, the EEA, Switzerland and every other country), and whenever we can’t tell where you are, this happens only if you choose Accept in the banner on our pages. This is based on your consent. To change your choice, use “Your Privacy Choices” at the bottom of any page: Decline stops the pixel, deletes Meta’s cookies and stops the events of your previews that haven’t been sent yet, and of the other previews made in this browser. If you choose Decline, or don’t choose, nothing is loaded and nothing is sent.

In the US, this happens unless you opt out, with “Do Not Sell or Share My Personal Information” at the bottom of any page or with your browser’s Global Privacy Control (see If you live in the US). After an opt-out, nothing more is loaded or sent.

When you opt out or choose Decline, we set a small cookie of our own, together_privacy, for 13 months, so that our server knows to send Meta nothing about you either.

PostHog’s cookie (ph_ followed by our project’s key and _posthog, for up to a year) keeps a random visitor code, so PostHog can tell a returning visit from a new one: in the US unless you turn analytics off, elsewhere only if you choose Accept (see Analytics and session recordings).

To make the site work, your browser keeps a few small items for this site in its local storage: the link to the previews you are working on, so you can pick up where you left off; a random device code, to keep free previews fair; and the campaign tags of the link you arrived from, if any (for example, which ad), which we save with your previews and order to learn which ads work. It also keeps your privacy choice (your answer to the banner, or your opt-out), so we don’t ask again. It keeps your analytics choice too, and, while PostHog may use its cookie, the same visitor code as the cookie. They stay on your device, and you can clear them in your browser settings at any time.

Analytics and session recordings

We use PostHog (PostHog Inc., United States) to understand how people use our pages, so we can make them easier. Our pages send it the pages you view, the buttons you press and how far you get (for example, that previews were asked for or a checkout was started), how long pages take, your browser and device type, and the campaign tags of the link you arrived from; PostHog works out your country and region from your IP address. Our server also tells PostHog when previews were asked for and were ready, when a checkout was started and when a purchase or a refund was made, with the amount and currency, the country or US state and the campaign tags of your previews: while PostHog may use its cookie, with your browser’s PostHog code; otherwise under a random code of your previews. PostHog never receives your photos, previews or portraits, your pet’s name, your email address or your private links: the private part of every address is removed before anything is sent, and only a random code of your previews goes with them. We never use any of this for ads.

Recordings of visits. Where the rules below allow it, PostHog records how you move through our pages: their layout, our own text and pictures, where you tap or click and how you scroll, so we can see what gets in the way. Your photos, previews and portraits are never recorded (they show as empty boxes), nor is anything you type (such as your email address or your pet’s name), nor the details we noticed about your pet. Only we look at the recordings, to improve the site.

In the US, analytics with PostHog’s cookie run unless you turn them off with the switch in “Your Privacy Choices” (in the US, “Do Not Sell or Share My Personal Information”) at the bottom of any page: then our pages send nothing more from this browser and nothing is recorded, but our server still tells PostHog about your previews, purchases and refunds as described above, under the random code of your previews instead of your browser’s PostHog code; events sent from this browser before carry that code too, so PostHog can still connect them. In most states PostHog may also record your visit, as described above, unless you turn analytics off. We don’t record visits from US states whose laws ask for everyone’s agreement first, such as California, Florida, Illinois, Massachusetts, Pennsylvania and Washington, and a few more where the law is unclear, nor when we can’t tell your state. Global Privacy Control opts you out of Meta, not of our analytics, which you can turn off yourself at any time.

Everywhere else (the UK, the EEA, Switzerland and every other country), and whenever we can’t tell where you are: until you choose, and if you choose Decline, our pages only count visits without cookies and nothing is recorded. Nothing is stored on your device, and PostHog recognizes a visit for one day from a one-way hash of your IP address and browser with a secret that changes every day and is then deleted. Our server still tells PostHog about your previews, purchases and refunds as described above, under the random code of your previews instead of your browser’s PostHog code; events sent from this browser before carry that code too, so PostHog can still connect them. Only if you choose Accept does PostHog use its cookie and may it record your visit as described above. You can change your choice at any time with “Your Privacy Choices” at the bottom of any page.

PostHog keeps recordings for up to 30 days and events for up to 1 year, and processes them on our behalf in the United States (see International transfers).

If you live in the US

This part adds to the rest of this policy for visitors and customers in the US, under the state privacy laws that apply to us and California’s Online Privacy Protection Act.

Notice at Collection

On our home page, we and Meta collect identifiers (your IP address, browser and device data, and Meta’s cookie ids) and your activity on our site (the pages you view and the steps listed under Cookies), and share them with Meta Platforms, Inc. and Meta Platforms Ireland Ltd to measure and target our ads. Our server sends Meta the same kind of information about your previews and orders, with the amount of a purchase. US state laws may call this “sharing” for cross-context behavioral advertising, “targeted advertising” or a “sale” of personal information. Meta’s cookie lasts about 90 days. On our server, the cookie ids and browser details are kept with your previews for up to 30 days. Once an event is sent to Meta, we remove the identifiers in it (your IP address, browser details and cookie ids) from our copy, and keep a record of the event itself (which step, when, and the amount) for up to 30 days. Meta keeps what it receives under its own terms. The other personal information we collect, why we use it and how long we keep it are described above, under What we keep, Why we use it and How long we keep it; we don’t sell or share it. To opt out, see below.

Your right to opt out

You can opt out of the sale or sharing of your personal information and of targeted advertising at any time, without an account:

• with “Do Not Sell or Share My Personal Information” at the bottom of any page. It is one switch: it stops Meta’s pixel in this browser, deletes Meta’s cookies, and stops our server from sending Meta anything more about the previews and orders made in this browser. The choices panel then shows “Opt-Out Request Honored”.
• with “Your Privacy Choices” at the bottom of any page, where our pages show it instead: when we can’t tell that you are in the US, Meta’s pixel and our server’s events run only if you choose Accept, and Decline there stops them in the same way.
• with your browser’s Global Privacy Control signal. We treat it as an opt-out for this browser and for the previews and orders made in it, without you doing anything else, and the choices panel shows “Opt-Out Request Honored”.
• by email to support@petclip.io.

We keep an opt-out in this browser for 13 months, or until you turn sharing back on yourself or delete this site’s data from your browser; we don’t ask you to opt back in. What was sent to Meta before you opted out stays with Meta.

Do Not Track: browsers’ Do Not Track signal has no agreed meaning, so we don’t treat it as an opt-out, from Meta or from our analytics. We do treat Global Privacy Control as an opt-out from Meta.

Meta, a third party, may use its pixel and cookie on our home page to collect information about your activity over time and across different websites and apps. To stop this on our site, use “Do Not Sell or Share My Personal Information” or “Your Privacy Choices” at the bottom of any page or your browser’s Global Privacy Control. For other sites and apps, see aboutads.info/choices.

We don’t use or share sensitive personal information to infer anything about you: your photos never go to Meta or any ad service. We don’t knowingly sell or share the personal information of anyone under 16; Petclip is only for adults, 18 and over.

Your other rights

Depending on where you live, you can ask us what personal information we hold about you and for a copy of it, to correct it, or to delete it. Write to support@petclip.io; we may ask you to confirm the request from the email address you used with us. Someone you authorize may ask for you. We reply within 45 days, and we won’t treat you differently for using these rights. If we turn down your request, you can appeal by replying to our answer with “Appeal” in the subject; we answer within 60 days. If you disagree with our answer to an appeal, you can contact your state’s attorney general.

Changes to this policy

If we change this policy, we update the date at the top of this page. Questions: support@petclip.io. See also our terms of sale.