Privacy Policy

1. Information We Collect

We collect several types of information depending on how you interact with our Site:

1.1 Photos You Upload

When you use our AI portrait generation service, you upload one or more photographs. As part of generating your portrait, an automated system analyses your photograph to decide what to produce — for example, how many subjects are in it, whether they are how many people are present, whether a person appears to be a man or a woman, and roughly how old they appear. This is used only to select and compose your portrait. These photos are transmitted to our servers and processed by our AI system to generate stylised portraits. We store uploaded photos securely and use them solely for the purpose of generating your portrait(s). Photos are not shared with third parties except as necessary for AI processing (see Section 4).

1.2 Order Information

When you make a purchase, we collect information necessary to process your order, including:

• Email address (collected during Stripe checkout)
• Billing information (processed and stored by Stripe; we do not store full payment card details)
• Shipping address (for physical orders — posters, canvases and frames)
• Order details (product type, size, amount paid)

1.3 Device and Usage Information

When you visit the Site, we automatically collect certain information about your device and browsing activity, including:

• IP address and approximate geographic location
• Browser type and version, operating system
• Device type (desktop, mobile, tablet) and screen resolution
• Referring website or source
• Pages visited, time spent on pages, click behavior
• Session recordings and heatmap data (via Hotjar and Sentry)

1.4 Session Information

We use anonymous sessions to allow you to use the Site without creating an account. A unique session identifier is stored in a cookie on your browser and linked to your uploads, generations, and orders. No personal information is required to start a session.

1.5 Order Access and Download Logs

To confirm delivery of digital goods and to protect against fraud and payment disputes, we keep server-side records of order-related access events. For each event we store the date and time, your IP address, and your browser/device information. Logged events include:

• Viewing an order confirmation (“thank you”) page
• Opening your account page
• Opening a download link (including links sent by email)
• Downloading your purchased portrait file

We retain these logs as evidence that purchased content was made available to and accessed by the buyer. Our legal basis is our legitimate interest in preventing fraud and resolving chargebacks and disputes (see Section 2).

1.6 Information We Infer

To produce the right portrait, our automated system infers basic characteristics from your photograph — the number of subjects, how many people are present, their apparent gender, and their approximate age range. These inferences are used only to generate your portrait. They are not used to identify anyone, are not used for advertising, and are not shared with anyone other than the AI provider that generates your portrait.

1.7 Contact Details You Give Us Directly

Separately from checkout, we may ask for your contact details through a signup form on the Site. Those forms collect your email address and, where you choose to give it, your mobile phone number.

If you give us a mobile phone number through one of those forms, you are agreeing to receive informational texts from us (for example, order updates) and marketing texts (for example, cart reminders), including texts sent by autodialer. Agreeing to receive texts is never a condition of any purchase. Message frequency varies, and message and data rates may apply. You can stop the texts at any time by replying STOP to any message we send, and you can reply HELP to any message for help.

2. How We Use Your Information

We use the information we collect to:

• Provide the service: Process your uploaded photos through our AI system to generate portraits, deliver digital downloads, and fulfil physical orders (posters, canvases and frames).
• Process payments: Complete transactions securely through Stripe and maintain order records.
• Communicate with you: Send order confirmations, download links, shipping updates, and respond to support inquiries via email (powered by Klaviyo).
• Improve the service: Analyze usage patterns, identify issues, and optimize the user experience using analytics tools.
• Marketing: With your consent, send promotional emails about new features, templates, or offers. You can unsubscribe at any time.
• Text messages (SMS): Send informational texts such as order updates and marketing texts such as cart reminders to people who gave us a mobile phone number through a signup form, including texts sent by autodialer. Agreeing to texts is not a condition of purchase, message frequency varies, and message and data rates may apply. Reply STOP to any message to opt out, or HELP for help.
• Prevent fraud and abuse: Monitor for unauthorized access, automated abuse, or attempts to circumvent our security measures.
• Resolve disputes and chargebacks: Maintain access and download logs (Section 1.5) as evidence that purchased digital content was delivered to and accessed by the buyer, and use them to respond to payment disputes.

2.1 Our legal bases for processing

Where the GDPR or a similar law applies, we rely on:

• Performance of a contract — to process your photographs, generate your portrait, take payment, and fulfil and deliver your order.
• Legitimate interests — to prevent fraud and abuse, keep order access and download logs for dispute resolution, secure the Site, and analyse usage to improve the service. We balance these against your rights and interests.
• Consent — for marketing emails, for marketing text messages to anyone who gave us a mobile phone number, and for advertising and analytics cookies where a consent choice is presented to you. You can withdraw consent at any time.
• Legal obligation — to keep accounting and tax records.

3. Photo Data Handling

We take the handling of your uploaded photos seriously. Here is how we treat your photo data:

• Purpose limitation: Uploaded photos are used solely for generating AI portraits. We do not use your photos for training AI models, selling to third parties, or any purpose other than fulfilling your portrait request.
• AI processing: Your photos are sent to our AI provider (Google) for portrait generation. The AI provider processes the images in real time and does not retain them after generation is complete.
• Storage: Uploaded photos are stored securely in our cloud infrastructure (Supabase Storage) with encryption at rest (AES-256), encrypted transport (TLS), and access controls. Only your session can access your uploads.
• Face measurements: Finding the people in your photos records where each face is and how old each person appears — not who they are. We never store a faceprint or face template. If, and only if, you ask us to improve the likeness of a finished portrait, a face geometry scan is computed while that request runs, solely to match each person to their own painted face, and is destroyed when it finishes. We never use it to identify you. See our Biometric Data Policy.
• Early deletion: You may request immediate deletion of your photos and generated portraits at any time by contacting us at help@artstories.ai.

3.1 Retention Schedule for Uploaded Photos

• Failed or abandoned generation attempts: original photo uploads are automatically deleted within 90 days of the failed or abandoned attempt.
• Successful generations you have purchased: retained for as long as you maintain access to your account, so that you can re-download your portraits at any time.
• Successful generations you have not purchased: automatically deleted after a short period (currently around 2 months from the generation date, and in any case within 12 months).
• Immediate deletion on request: contact help@artstories.ai to request deletion at any time.

4. Third-Party Services

We share your information with the following third-party service providers, each for a specific purpose:

Payment Processing

• Stripe — Processes all payments. Stripe receives your email, billing details, and payment card information. Stripe's privacy policy: stripe.com/privacy

Order Fulfilment

• Print production partner — We use a third-party print-on-demand provider to print, package, and ship physical orders. They receive your finished portrait file, your name, email address, postal address and order details, solely to produce and deliver your order. They never receive your uploaded photographs. Our print partner is established in the European Economic Area and produces orders through a network of production facilities, usually in or near your own country. We will identify them by name on request.
• Shipping carriers — Carriers receive your name and delivery address to deliver your order and provide tracking.

Data Storage

• Supabase — Hosts our database and file storage (uploaded photos, generated images, session data, order records). Data is stored in secure cloud infrastructure with encryption at rest.
• Vercel — Hosts our website application. Processes web requests and may log IP addresses and request metadata.

AI Processing

• Google — Primary AI provider. Processes your uploaded photos to generate AI portraits. Photos are transmitted securely and processed in real time. Google does not retain your images after processing per Google's API terms.
• OpenRouter — A routing service we use to reach Google's models. Depending on our current configuration, your photograph may pass through OpenRouter for the step that classifies it, for portrait generation, or both. Requests are routed only to Google's models; no other AI provider ever receives your photographs. Images are not retained after processing.

Email Communications

• Klaviyo — Sends transactional emails (order confirmations, download links) and marketing emails (with your consent). Klaviyo receives your email address and order information. Klaviyo's privacy policy: klaviyo.com/legal/privacy

Analytics and Tracking

• Google Tag Manager (GTM) — Manages analytics and marketing tags on our Site. GTM may load additional scripts from Google Analytics and other providers.
• Google Analytics 4 — Loaded through Google Tag Manager. Measures how the Site is used — pages viewed, actions taken, and how visitors arrive — so we can understand and improve the service.
• Meta Pixel (Facebook) — Tracks conversions and enables retargeting advertising on Meta platforms (Facebook, Instagram). Collects browsing behavior and purchase events.
• Hotjar — Records session replays and generates heatmaps to help us understand how users interact with our Site. Hotjar does not capture the contents of form fields.
• TikTok Pixel — Tracks conversions and enables retargeting advertising on TikTok. Collects browsing behavior and purchase events, and receives a hashed identifier where available. We do not transmit uploaded photos.
• Pinterest Tag — Tracks conversions and enables retargeting advertising on Pinterest. Collects browsing behavior and purchase events. We do not transmit uploaded photos.
• NewsBreak Pixel — Tracks conversions and enables retargeting advertising on NewsBreak. Collects browsing behavior and purchase events. We do not transmit uploaded photos.
• TikTok Events API — In addition to the TikTok Pixel, we transmit purchase confirmation and key conversion events to TikTok server-side. We transmit hashed email addresses, the TikTok click identifier where present, and order details for ad-attribution purposes. We do not transmit uploaded photos.
• Meta Conversions API (CAPI) — In addition to the Meta Pixel, we transmit purchase confirmation and key conversion events to Meta server-side. We transmit hashed email addresses and order details for ad-attribution purposes. We do not transmit uploaded photos.

Error Monitoring

• Sentry — Captures application error events and crash data, which may include IP addresses, request URLs, browser/device metadata, and error stack traces. Sentry also records session replays: a video-like reconstruction of your visit. We may record any session, from the first page you open, to diagnose problems and improve the service. These replays capture page structure, on-screen text, and click behavior, and anything you type into form fields (email, address, payment details) is masked before it leaves your browser. Images (including your uploaded photos and generated portraits) are blocked.

5. Cookies and Tracking Technologies

We use cookies and similar technologies for the following purposes:

• Essential cookies: Session identifier cookie (as_session) that allows you to use the Site without creating an account. This cookie is necessary for the service to function.
• Analytics cookies: Placed by Google Analytics and Hotjar to collect usage data and improve the service.
• Marketing cookies: Placed by Meta Pixel, Google, TikTok, Pinterest, and NewsBreak to enable targeted advertising and measure ad campaign effectiveness.
• Attribution and identifier cookies: as_eid holds a copy of your session identifier and is shared with our advertising partners so they can recognise your device across visits. as_utm, as_ref and as_landing record how you arrived at the Site, so we can measure which campaigns work. These last for up to 30 days.
• Your privacy choice: as_privacy_optout records that you have opted out of sharing for advertising, so we can honour it on future visits.

You can control cookie preferences through your browser settings. Disabling essential cookies may prevent the Site from functioning properly. Disabling analytics and marketing cookies will not affect core functionality but will limit our ability to improve the service and show you relevant advertisements.

6. Behavioral Advertising

We use your personal information to provide you with targeted advertisements or marketing communications that we believe may be of interest to you. This is done through the following mechanisms:

• Meta (Facebook/Instagram): We use Meta Pixel to track actions on our Site (such as viewing a preview or completing a purchase) and create custom audiences for advertising on Meta platforms.
• Google Ads: We may use Google advertising services via GTM to display retargeting ads to visitors who have interacted with our Site.
• TikTok: We use the TikTok Pixel and the TikTok Events API to track actions on our Site and to build audiences for advertising on TikTok.
• Pinterest: We use the Pinterest Tag to track actions on our Site and to build audiences for advertising on Pinterest.
• NewsBreak: We use the NewsBreak Pixel to track actions on our Site and to build audiences for advertising on NewsBreak.

The simplest way to switch this off is the Your Privacy Choices link in our footer. Turning it on stops the following from loading or running in your browser, on this and every later visit:

• Meta Pixel
• TikTok Pixel
• Pinterest Tag
• NewsBreak Pixel
• Google Tag Manager, and the Google Analytics and Google advertising tags it loads
• Hotjar session recording and heatmaps
• Sentry session replay

We apply the same result automatically, without you having to visit that page, if your browser sends a Global Privacy Control (GPC) signal. Your choice is remembered in the as_privacy_optout cookie, so clearing your cookies will also clear it.

You can also opt out with each platform directly, or through the industry opt-out tools below:

• Meta: accountscenter.facebook.com → Ad preferences
• Google: myadcenter.google.com
• Digital Advertising Alliance: optout.aboutads.info
• Network Advertising Initiative: optout.networkadvertising.org

7. Data Retention

We retain your data for the following periods:

• Order records: Retained for as long as necessary for accounting, tax, and legal compliance purposes (typically 7 years).
• Session data: Anonymous session records are retained for 12 months, after which they are purged.
• Email and marketing data: Retained until you unsubscribe or request deletion.
• Phone numbers and text-message consent: Retained until you opt out or ask us to delete your number. We keep a record of an opt-out afterwards so that we do not text you again.
• Analytics data: Retained according to each analytics provider's retention policies (typically 14–26 months).

8. Your Rights

We provide these rights to every user worldwide, regardless of which country or U.S. state you live in. These commitments meet or exceed the requirements of the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and comparable general privacy laws in Colorado, Connecticut, Montana, Oregon, Texas, Utah, Virginia, Washington, the UK, Canada, and other jurisdictions. Illinois residents also have specific rights under the Biometric Information Privacy Act, described in the biometric data notice below:

• Right to know / access: Request information about what personal data we hold about you, including a copy of that data.
• Right to delete / erasure: Request deletion of your personal data, including uploaded photographs and generated portraits.
• Right to correct / rectification: Request correction of inaccurate personal data we hold.
• Right to data portability: Request your data in a structured, commonly used, machine-readable format.
• Right to object / restrict processing: Object to or request that we limit how we process your data, including for direct marketing.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time.
• Your photos are never sold, and never used for marketing or AI training: We do not sell, lease, trade, or share your uploaded photographs or generated portraits with any third party for marketing, AI training, or commercial purposes. Your uploaded photographs are never shared with anyone except the AI provider that classifies and generates your portrait (Google, reached either directly or through the OpenRouter routing service), strictly for transient processing as described in Section 4 — and that provider does not retain your images after processing. If you separately ask us to improve the likeness of a portrait, a close crop of each face — never the full photograph — is also sent to our face-refinement processor in Hong Kong, which may use it only for that refinement and does not keep it once it has returned the result; this happens only with your separate consent and is described in Section 11 and in our Biometric Data Policy. Your finished portrait, together with your name, contact details, and shipping address, is shared with our print production partner where you have ordered a physical print, solely to make and deliver it.
• We do not sell your personal information: We do not exchange your personal information for money.
• We do share information for advertising, and you can turn it off: To measure advertising effectiveness and show relevant ads, we transmit non-photo events — such as pageviews, purchase confirmations, hashed email addresses, and a durable identifier stored in your browser that lets these partners recognise your device across visits — to Meta, Google, TikTok, Pinterest, and NewsBreak. Under California law this is “sharing for cross-context behavioral advertising.” You can opt out at any time using the Your Privacy Choices link in our footer, and we honor Global Privacy Control (GPC) browser signals automatically. Opting out stops all of this sharing: the advertising and analytics tools that run in your browser (listed in Section 6), and also the purchase confirmations we would otherwise send to these partners directly from our servers after your order completes.
• Non-discrimination: We will not deny service, change pricing, or otherwise penalize you for exercising any of these rights.
• Unsubscribe: Opt out of marketing emails using the link in any email we send, or by emailing us. Opt out of marketing texts by replying STOP to any text we send.

To exercise any of these rights, email help@artstories.ai. We respond to verifiable requests within 30 days. Our lead supervisory authority is the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija, VDAI), L. Sapiegos g. 17, Vilnius, ada@ada.lt. Residents of the EU, EEA, and UK may also lodge a complaint with their own local data protection authority.

Face data:

Our AI transforms your uploaded photograph into a stylised portrait. Making the portrait does not require identifying anyone, and we never do: we do not store a faceprint or face template, and we never match your photograph against any database of people. One optional step does involve a biometric measurement. If you ask us to improve the likeness of a finished portrait, we compute a scan of the face geometry of each person in your photos and in the painting, for the sole purpose of working out which painted face belongs to which person, and a crop of each matched pair of faces is sent to our face-refinement processor, InsightFace AI Technology Limited, in Hong Kong (Section 11). That scan exists only while the request runs, is never written to storage, is never sent to the processor or anyone else, and is destroyed when it finishes. It happens only after you have given separate, specific consent, which you may withhold or withdraw at any time without affecting the rest of the service. We do not sell, lease, trade, or otherwise profit from biometric information. The likeness improvement is not offered in every US state, and is withheld entirely from some; the current list is published in that policy, which also explains what happens if it is unavailable to you. Our written retention schedule and destruction guidelines for biometric data, as required by 740 ILCS 14/15(a), are published at Biometric Data Policy. Uploaded photographs are stored only for the purposes and retention periods stated in Section 3 above.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption in transit (TLS/SSL), encryption at rest for stored data, access controls on file storage, and secure handling of payment information through Stripe (PCI DSS compliant). However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

10. Children's Privacy

Our service is not directed to anyone under the age of 18. Per Section 4.1 of our Terms of Service, users must be at least 18 years of age (or the age of majority in their jurisdiction, if higher) to upload photographs or otherwise use the service. We do not knowingly collect personal information from individuals under 18. If you become aware that someone under 18 has provided us with personal data, please contact us at help@artstories.ai and we will take steps to delete such information. This commitment is at least as protective as the United States Children's Online Privacy Protection Act (COPPA, under 13) and Article 8 of the EU General Data Protection Regulation (GDPR, under 16).

Note that uploading photographs that depict children is separately governed by Section 4 of our Terms of Service — adult uploaders must be the parent or legal guardian of every child depicted, or have written consent from each such parent or legal guardian.

11. International Data Transfers

We are established in Lithuania. Your information may be transferred to and processed in countries other than your country of residence. The two destinations outside the European Economic Area are:

• The United States — where several of our service providers operate, including our hosting, storage, payment, email and analytics providers.
• Hong Kong — and only for one optional step. If you ask us to improve the likeness of a finished portrait, a close crop of each face is sent to our face-refinement processor, InsightFace AI Technology Limited, a company established in Hong Kong operating on Amazon Web Services infrastructure. Personnel in Hong Kong may access that infrastructure to operate, secure, support and troubleshoot the service. Nothing else we hold is sent there: not your full photographs, not your name, email, address or order, and not the face geometry scans, which never leave our own servers.

Hong Kong is not covered by a European Commission adequacy decision. The United States is covered only in part: the EU–US Data Privacy Framework covers providers that have self-certified under it, and does not cover those that have not. Where a transfer is not covered by an adequacy decision, we make it under the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), together with the technical and organisational measures required of each processor by contract. For the Hong Kong transfer we use Module Two (controller to processor), governed by Lithuanian law, with the State Data Protection Inspectorate of Lithuania as the competent supervisory authority. You may obtain a copy of the clauses that apply to you, with commercial terms redacted, by emailing help@artstories.ai.

The likeness improvement is optional and off by default: it happens only if you press the button and give the separate consent described in our Biometric Data Policy. If you never ask for it, no data about you is ever transferred to Hong Kong.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will post the updated policy on this page with a revised “Last updated” date. We encourage you to review this page periodically. Your continued use of the Site after any changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

• Company: UAB “Madcom”
• Registered address: Laisvės al. 18-41, LT-44238 Kaunas, Lithuania
• Company code: 307029363
• VAT number: LT100018828719
• Email: help@artstories.ai
• Website: artstories.ai