Back to site

Legal & Trust

Privacy Policy

Last updated: September 2026 • Effective Date: September 2026

1. Overview & Privacy First Commitment

At Paint by Us (“we,” “us,” or “our,” operated at paintbyus.com), privacy and data minimization are built into the architecture of our software. We believe you should not have to sacrifice your personal privacy to create art. This Privacy Policy details how your uploaded photographs are processed, the minimal data collected, our automated deletion schedules, and your rights under global privacy regulations including the EU/UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and the Digital Personal Data Protection (DPDP) Act.

2. How Your Photos Are Processed (Strict In-Memory Architecture)

When you upload a photograph to generate a custom paint-by-numbers canvas, the image is transmitted securely over an encrypted HTTPS connection (TLS 1.2/1.3) to our dedicated computer vision engine:

  • Zero Persistent Photo Storage: Your original photo is processed strictly within temporary server volatile memory (RAM). It is never written, cached, or saved to persistent hard disks, solid-state drives, or permanent storage buckets.
  • Immediate Purge: Once the mathematical vector segmentation and palette extraction finish (typically 1–3 seconds), the source image buffer is immediately and permanently wiped from RAM.
  • No Facial Recognition or Biometrics: We do not scan, identify, catalog, or extract facial geometries, biometric identifiers, or personal likenesses. The algorithms analyze purely numerical pixel color values and contour gradients.
  • No AI Model Training: Your photographs are never used, shared, sold, or aggregated to train machine learning models, neural networks, or generative AI datasets.

3. Data We Collect & Why

We collect only the bare minimum information required to deliver and fulfill your digital order:

  • Generated Artwork Data: The generated vector SVG contour paths, color numbers, 150-artist palette guide, and compiled 2-page print-ready PDF files.
  • Order Metadata: A randomly generated anonymous Job ID, order creation timestamp, package tier selection (Single Base Pack or Personalized Gift Pack), gift dedication details (if provided), and digital delivery consent confirmations.
  • Payment Fulfillment Information: When you complete checkout via Paddle, we receive confirmation containing a transaction identifier, package type, and order completion status. We never receive or store your credit card number, debit card number, or CVV.
  • Anonymous Diagnostics: Non-personally identifiable operational counters (such as conversion attempts and processing latency) to maintain platform health and monitor error rates.

4. Legal Bases for Processing (GDPR & UK Data Protection)

If you reside in the European Economic Area (EEA) or the United Kingdom, our legal grounds for processing include:

  • Performance of a Contract (Art. 6(1)(b) GDPR): Processing your photo and delivering your purchased paint-by-numbers PDF and SVG files.
  • Legal Obligations (Art. 6(1)(c) GDPR): Retaining minimal accounting and statutory transaction records as required by tax and trade authorities.
  • Legitimate Interests (Art. 6(1)(f) GDPR): Protecting against fraud, security incidents, and ensuring server uptime.

5. Automated Data Retention & Deletion Schedule

We enforce automated lifecycle deletion policies:

  • Unpaid Preview Jobs: Automatically and permanently purged from server databases within 24 hours.
  • Paid Purchases: Generated printable PDF and SVG files are stored in our secure database for 30 days so you can return and re-download your files if you misplace them. After 30 days, your generated artwork files are permanently deleted.

6. Payment Processing & Merchant of Record (Paddle.com)

All financial checkout operations on Paint by Us are conducted by our online reseller and Merchant of Record, Paddle.com (Paddle.com Market Ltd, Judd House, 18-29 Mora Street, London, EC1V 8BT, UK).

When you initiate payment:

  • Paddle securely collects and processes payment credentials in an audited PCI-DSS Level 1 compliant environment.
  • Paddle manages international sales taxes (VAT, GST, US Sales Tax) and transaction compliance in your local jurisdiction.
  • Transactions are governed by Paddle’s Buyer Terms and Privacy Notice.

7. Cookies & Local Storage

We do not use third-party advertising cookies, ad tracking pixels, or marketing tracking scripts. We use only strictly necessary HTML5 LocalStorage in your browser to maintain your canvas preview state across page refreshes and facilitate your checkout session.

8. California Consumer Privacy Act (CCPA / CPRA)

For California residents:

  • We Do Not Sell or Share Personal Information: We have never sold, rented, or shared personal data or consumer photographs to third parties, data brokers, or advertisers, and will never do so.
  • Consumer Rights: You have the right to request disclosure of what data we have collected, the right to request deletion of your information, and the right not to be discriminated against for exercising your privacy rights.

9. Children's Privacy (COPPA)

Paint by Us is not directed toward children under 13 years of age. We do not knowingly collect personal information from children under 13.

10. Your Rights & How to Request Deletion

You have the right to request an extract or immediate early deletion of any order records associated with your email or Job ID. To exercise your rights, simply email us at hello@paintbyus.com. Requests are completed within 48 hours.

11. Contact & Data Controller Details

If you have questions, feedback, or concerns regarding this Privacy Policy or our security practices, contact our Data Protection representative at:

Paint by Us
Email: hello@paintbyus.com
Official Website: https://paintbyus.com