This Privacy Policy explains how PopPaw ("PopPaw", "we", "us", "our") collects, uses, shares, and protects your personal data when you visit pop-paw.com, upload pet photos, preview AI-generated pet art, place an order, or contact us. By using the site you agree to the practices described here.
1) Who we are
PopPaw operates pop-paw.com and creates custom pet art phone cases, phone grips, and digital artwork. The data controller responsible for your personal data is Everlou Ltd. (registered address to be added).
If you have any privacy questions or want to exercise your rights, email us at team@pop-paw.com.
2) What personal data we collect
We collect the following categories of personal data:
- Contact and account details: name, email address, phone number (where provided), and password-free login tokens.
- Order and billing details: shipping address, billing address, order items, order history, and customisation choices. Payment card details are processed directly by our payment providers (for example Shopify Payments, PayPal); we do not see or store full card numbers.
- Pet photos and customer content: images you upload to generate a preview, optional pet name, and any custom text you submit through our post-order text editor.
- AI-generated artwork: the stylised previews and final images our AI providers produce from your uploaded photo and chosen style.
- Device and usage data: IP address, browser, device type, pages viewed, referring URL, session identifiers, and similar technical telemetry collected through cookies and similar technologies.
- Marketing and communication preferences: your opt-in status for email, SMS, and advertising, and your interactions with our messages.
3) How we use your personal data
We use your personal data to:
- Provide the service: generate AI previews from your photo, fulfil and ship your order, deliver digital artwork, and provide customer support.
- Send transactional messages: order confirmations, shipping updates, post-order text customisation links, and other operational emails.
- Process payments and prevent fraud: verify payment, detect suspicious activity, and comply with anti-fraud obligations.
- Improve the product: analyse how visitors use the site, measure marketing performance, and improve the generation pipeline and style templates.
- Marketing (with your consent or as permitted by law): send promotional emails, run ads on platforms like Google and Meta, and measure their effectiveness.
- Meet legal obligations: retain transaction records for tax and accounting, respond to lawful requests, and enforce our Terms.
4) AI image generation and how your photo is handled
When you upload a pet photo to generate a preview, PopPaw sends that photo, along with a style-specific prompt, to a third-party AI image generation provider. By default we use OpenAI’s image-editing API; if OpenAI is unavailable we fall back to OpenRouter, which routes the request to an equivalent image-capable model.
These providers process your uploaded image solely to generate a preview that is returned to you. Their use of the image is governed by their own privacy and API terms. OpenAI’s API processing is covered by their API data policy, which at the time of writing states that API inputs are not used to train their models by default.
We store uploaded photos and generated artwork associated with your orders on our infrastructure for order fulfilment, quality review, reprints, and customer support. If you never place an order, unused uploads are retained only for a short period for caching and abuse prevention, and are then deleted on a rolling basis.
Previews shown before checkout are watermarked on the client; the clean, unwatermarked artwork is only used once you place an order for a related physical or digital product.
You can ask us to delete your uploaded photos and associated previews at any time by emailing team@pop-paw.com. If you have already placed an order, we may need to retain the generated artwork for the life of that order and for a limited period afterwards to handle remakes, defects, and tax records.
5) Cookies and similar technologies
We and our partners use cookies, local storage, pixels, and similar technologies to make the site work, remember your preferences, measure site performance, and deliver and measure advertising.
We use these categories:
Where required by law, we only set non-essential cookies after you give consent via our cookie banner. You can change your preferences at any time through the banner or your browser settings.
- Strictly necessary: authentication, cart, fraud prevention, and checkout.
- Analytics: Google Analytics 4 and Microsoft Clarity to understand how the site is used.
- Advertising and measurement: Google Ads, Meta Pixel and Meta Conversions API, used to measure ad performance and to show relevant ads. The Meta Conversions API sends hashed order and customer data server-to-server to improve ad attribution.
6) How we share your personal data
We share personal data only where necessary with the following categories of recipients:
- Shopify, our e-commerce platform, which hosts our storefront, cart, checkout, and order records.
- AI image generation providers (OpenAI and OpenRouter) who process your uploaded photo to produce previews.
- Payment providers (for example Shopify Payments, PayPal) to process payments and detect fraud.
- Shipping and logistics providers, including YunExpress and the carriers they work with, to ship physical orders internationally.
- Email and messaging providers such as Resend, to send order confirmations, shipping updates, and post-order customisation links.
- Analytics and advertising providers (Google, Meta, Microsoft Clarity) to measure site use and advertising performance.
- Professional advisers and authorities where required by law or to enforce our Terms and protect our rights.
7) International transfers
PopPaw is an international business. Your personal data may be processed in countries outside your own, including the United States (for example by our AI, analytics, and email providers) and in the countries our shipping partners operate in.
Where required, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or equivalent mechanisms to protect your data when it is transferred across borders.
8) How long we keep your data
We keep personal data only as long as needed for the purposes described above:
- Order records: for the length of our business relationship with you and for as long as required by tax and accounting laws (typically 6–10 years depending on jurisdiction).
- Uploaded pet photos and generated artwork linked to an order: for the life of the order and for a limited period afterwards to support remakes, defects, and tax records.
- Uploaded photos that do not lead to an order: for a short period for caching and abuse prevention, then deleted on a rolling basis.
- Marketing data: until you unsubscribe or withdraw consent, and for a short additional period to prove compliance.
- Site analytics: subject to the retention settings of each analytics provider.
9) Your rights
Depending on where you live, you may have the right to:
To exercise any of these rights, email team@pop-paw.com. We may need to verify your identity before acting on your request. You can also complain to your local data protection authority.
- Access the personal data we hold about you;
- Ask us to correct data that is inaccurate or incomplete;
- Ask us to delete your personal data (including uploaded photos and previews), subject to our obligation to keep order and tax records;
- Object to, or ask us to restrict, certain processing;
- Withdraw consent to marketing at any time (for example by clicking "unsubscribe" in any marketing email);
- Request a portable copy of the data you provided us;
- Opt out of the "sale" or "sharing" of your personal information where applicable (for example under the CCPA / CPRA).
10) Children
PopPaw is intended for adults. The site is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us personal data, contact team@pop-paw.com and we will delete it.
11) Security
We use reasonable technical and organisational measures to protect your data, including HTTPS, access controls, HMAC-signed links for order customisation, and vetted third-party providers. No system is perfectly secure, and we cannot guarantee that unauthorised access will never occur.
12) Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our services, our providers, or the law. Material changes will be indicated by updating the "Last updated" date above and, where appropriate, by a notice on the site or by email.
13) Contact us
If you have any questions about this policy, how we handle your data, or you want to exercise your rights, email team@pop-paw.com. We aim to respond within a reasonable timeframe and in any case within the period required by applicable law.