Legal

Privacy Statement

last updated: 2026-05-26

This is a courtesy translation. The Dutch privacy statement is the legally binding version; in the event of any discrepancy, the Dutch text prevails.

We are Pawtrait Atelier (hereafter: we). We consider your privacy important and handle your personal data with care. This statement explains which data we collect, why, and which rights you hold under the General Data Protection Regulation (GDPR).

1. Who are we?

Pawtrait Atelier — Chamber of Commerce (KvK) 00000000, VAT NL000000000B01, established in Nederland. Contact: hallo@pawtraitatelier.com.

2. Which data do we process?

A photograph of your cat that you upload for the making of a preview and final product.
Order details: name, email address, billing and delivery address, payment information (processed by Shopify Payments).
Session data: a temporary cookie ID and a hashed IP for abuse prevention.
Visitor statistics via Plausible Analytics (cookieless, anonymised).

3. Purposes and legal basis

Performance of your order — legal basis: contract.
The making of your AI preview and final work — legal basis: explicit consent, which you may withdraw before your order goes into production.
Abuse prevention and fraud detection — legal basis: legitimate interest.
Anonymous statistics — legal basis: legitimate interest.

4. Sub-processors

We share your data with the following processors, all under a data processing agreement:

Shopify International (Ireland) — checkout, payments and orders.
OpenAI Ireland (Ireland) — image generation via gpt-image-2. Your photograph is sent encrypted; under the current API policy OpenAI does not retain it for training.
Supabase (EU-Frankfurt region) — storage of your photograph and preview.
Resend (EU) — sending of transactional emails.
Cloudflare — CDN and DDoS protection.
Vercel (EU region) — hosting of our preview app.
Plausible Analytics (Germany) — cookieless web statistics.
PostNL — parcel delivery.

5. Retention periods

Uploads without an order: a maximum of 7 days, after which they are deleted automatically.
Photographs and previews tied to a placed order: a maximum of 90 days after delivery, after which they are deleted automatically from our storage.
Order information (administration): 7 years, in accordance with the fiscal retention obligation.

6. Your rights

You have the right of access, rectification, erasure, restriction, objection and portability of your data. Email us at privacy@pawtraitatelier.com. Do we fail to respond within four weeks? Then you may lodge a complaint with the Dutch Data Protection Authority.

7. Changes

We may amend this statement. The latest version is always at pawtraitatelier.com/privacy. In the event of significant changes we will inform you by email.