Privacy policy

Who we are

PortraitMix is run by PortraitMix Corp, a company in Alberta, Canada. We are responsible for the personal information described here. For questions or requests, use our contact page.

What we collect

• The photos you upload, and any text you add to a portrait (such as names or dates).
• The portraits we make from them.
• Your email address, if you give it to us: to be told when a portrait is ready, to sign in, with an order or with a message.
• For a canvas order: your name and delivery address.
• Messages you send us.
• How you use the site: pages and buttons, device and browser, the page that sent you, and your country (worked out from your connection).
• Your IP address, to limit abuse such as endless free previews. It’s deleted within two days.

Payments are handled by Stripe, which is certified to PCI DSS Level 1, the highest security standard in the payments industry. Your card details go straight from your browser to Stripe: they never reach our servers, and we never see or store your card number.

Faces in your photos

To make your portrait look like the people in your photo, our software finds the faces in it and measures facial features to match each person to a figure in the portrait and to place their face. Finding faces to show you “who’s who” happens in your own browser.

Those face measurements exist only while your portrait is being made, and are never saved. We don’t use them to recognise anyone, and we don’t guess anyone’s age, gender or anything else from a photo.

When you upload a photo of someone else, you confirm they agreed to it (for a child, their parent or guardian).

How we use it

• To make your previews and portraits, and to deliver what you buy.
• To let you sign in and get back to your portraits.
• To answer you when you write to us.
• To keep the service safe: checking that uploads come from people, not bots, and limiting free previews.
• To understand which pages and styles work, from usage counts.

Where privacy law asks for a legal basis: we make portraits and deliver orders to perform our contract with you, analyse faces with your consent (given when you upload), keep order records because the law requires it, and run usage counts and abuse limits in our legitimate interest in a working, safe service.

Neither we nor our AI providers use your photos or portraits to train AI models. We never put them in advertising or on our site without your permission. A share link shows your portrait only to the people you send it to, and you can turn it off.

Who helps us

We use service providers who process your information only to run PortraitMix for us:

• BytePlus and Runpod: AI image generation (your photos and the portrait being made).
• Backblaze: storing photos and portraits.
• Hetzner: our servers and database.
• Cloudflare: delivering the site, protecting it, and the bot check on uploads.
• Stripe: payments (PCI DSS Level 1).
• Mailgun: sending our emails.
• Our print partners: your name, delivery address and portrait, for a canvas order.

We don’t sell your personal information, or share it for advertising. That includes “selling” and “sharing” as California law defines them.

Where it’s processed

We are in Canada, and our providers process information in other countries, including the United States and Singapore. Where the law asks for it, we use contractual protections for these transfers.

How long we keep it

• Your photos: 30 days after you upload them, then deleted, even if you buy a portrait.
• Previews you don’t buy: 30 days, then deleted.
• Portraits you buy: 2 years, so you can download them again. We email you before we delete them.
• Order records: as long as tax and accounting law requires.
• Messages to us: 2 years.
• Usage data: 13 months.

You can ask us to delete any of it sooner.

Cookies

We use one cookie of our own. It keeps your portraits and cart on this device for up to 180 days, and counts visits to the site. We don’t use advertising cookies or third-party analytics. Stripe sets its own cookies on the checkout to prevent fraud.

Our YouTube channel

We post short videos of our example portraits on our YouTube channel, uploaded through YouTube API Services. We sign in to our own channel only: we never ask you to connect a YouTube or Google account, and we get no information about you from YouTube. Our videos never show a customer’s photos or portraits without their permission.

Watching, liking or commenting on our videos happens on YouTube, under the YouTube Terms of Service (https://www.youtube.com/t/terms) and the Google Privacy Policy (https://policies.google.com/privacy).

The only YouTube data we keep is the sign-in for our own channel, and we can withdraw it at any time. Any Google account’s access for an app can be removed in its security settings (https://myaccount.google.com/permissions). To have a video of ours taken down, or anything else about our channel, write to us through our contact page.

Your rights

You can ask to see the personal information we hold about you, correct it, delete it, or get a copy to take elsewhere. Where we rely on your consent, you can withdraw it. Write to us through our contact page; we answer within 30 days.

If you’re not happy with our answer, you can complain to the Office of the Privacy Commissioner of Canada, or to the data protection authority where you live.

Children

PortraitMix is for adults. Parents and guardians are welcome to make portraits of their children; we don’t knowingly collect information from children themselves. If you think a child has given us their information, tell us through our contact page and we’ll delete it.

Security

Your photos and portraits are kept in private storage and shown only through links that expire. Connections to the site are encrypted, and card payments are handled entirely by Stripe. No system is perfectly secure, but we keep what we hold to the minimum and delete it on schedule.

Changes

When this policy changes, we update it here and change the date above. If a change matters to how we use information you’ve already given us, we’ll tell you by email first.