Privacy policy

Last updated September 22, 2026

This policy covers Umber Portrait. It is written to be read rather than to be complete in a legal sense; where it matters, the specifics are exact.

The short version

• Your uploaded photos are stored privately and deleted after 30 days.
• We never sell personal data, and we never publish your photos or portraits.
• Analytics do not load at all for UK and EU visitors until you agree.
• We do not use Meta/Facebook tracking pixels anywhere on this site.

What we collect

Photos you upload

Stored in a private bucket that is not publicly readable. They are used only to generate your portrait. They are automatically deleted 30 days after upload. They are not used to train any model, sold, or shown to anyone outside the small team that reviews orders.

Generated portraits

Kept so you can come back to them, and so you can re-download something you have paid for. Tell us and we will delete yours.

Your email address

Collected if you ask us to save a preview, or when you buy something. Used for transactional email about your own portraits and orders. Marketing email is opt-in and separate.

Order and payment information

Handled by Stripe. We never see or store your card number. We store the order amount, currency, email, and — for prints — the delivery address Stripe collected.

Technical data

An anonymous visitor id in a cookie (to count free previews), your approximate country from your IP address (to show the right currency and apply the right consent rules), and standard server logs.

Analytics and cookies

We use Google Analytics 4 and PostHog to understand which pages help people find a portrait, and Cloudflare Web Analytics, which sets no cookies.

If you are in the UK or the EU/EEA, none of these load until you press Accept. Elsewhere they load by default and you can turn them off with the same banner or by writing to us. Your email address is never sent to an analytics tool as a plain-text property.

The only cookie we set without consent is the visitor id that counts your free previews.

Who processes your data

• Supabase — database, private file storage and server functions.
• Google (Gemini API) — image generation from your uploaded photo.
• Stripe — payments. They are the data controller for card data.
• Prodigi (or an equivalent print partner) — printing and delivery. They receive the artwork and your delivery address, nothing else.
• Resend — transactional email delivery.
• Cloudflare — hosting, bot protection and privacy-preserving analytics.
• Google Analytics / PostHog — usage analytics, subject to consent as above.

Your rights

You can ask us for a copy of your data, ask us to correct it, or ask us to delete it. Write to JaydenHall1962@hotmail.com. We will respond within 30 days. If you are in the UK or EU you also have the right to complain to your data protection authority.

How the portraits are actually made, including what happens to an upload at each step, is set out on the about page. The Terms of Service cover the commercial side, and you can upload a photo without an account at all.

Children

This site is not intended for anyone under 16, and we do not knowingly collect their data. We do not generate portraits of children in any suggestive context, at any time, for any reason.

Changes

If this policy changes materially we will say so on this page and update the date at the top.