Privacy

You give us a photo of your pet. We use it to make a painting of them, and to work out what your pet looks like so the painting resembles them. We do not sell it, we do not use it to advertise to you, and you can delete all of it whenever you like.

Lienzo is run by [legal entity and address — to be confirmed], which is responsible for your data under this policy. You can reach a person at [contact email — to be confirmed].

Your account: your email address, and your name if you give us one. If you sign in with Google or Apple, we keep the account id they give us so we recognise you next time — we never see your password. If you upload a profile picture, we keep a small copy of it (resized, with its hidden data removed); anyone with its link can see it. If you joined through an invite, we keep the invite, which carries your email address.

Your pet photos: the photo you upload, and a written description of your pet derived from it (breed, colours, markings, expression) which is what lets the painting look like them. We also use it to suggest a name for the portrait.

Your lienzos: the paintings we make, including the attempts that did not come out well and the working images made along the way.

Your purchases:what you bought, when, for how much, and the payment’s reference number (from Stripe, Apple or Google). Card details never reach us.

Phone photos usually carry hidden data — the camera, the time, and often the GPS coordinates of where the photo was taken, which for a pet photo is usually someone’s home. We strip all of it the moment a photo reaches our server, before it is stored and before it goes anywhere else. We keep the picture, not the place.

On servers in Frankfurt, Germany, in the European Union, run for us by DigitalOcean. Your pet photos and the paintings are kept there in private storage: nothing in it can be opened directly from the internet, only through our own server, which applies the rules under “Who can see your lienzos” below. DigitalOcean hosts the data; it does not use it.

To make the painting. Your photo goes to OpenAI, to check there is an animal in it and describe it. It then goes, with that description, to Google (its Gemini models) to paint it — or, if Google fails, to fal.ai, which runs the Seedream model for us. The finished painting goes to OpenAI too, to check it came out right before we show it to you. They process it to answer our request.

To take payment. On the website, credits are paid through Stripe: you pay on Stripe’s own page, and we tell Stripe only your account number and which pack you chose. In the iPhone and Android apps, credits are paid through the App Store or Google Play, and we use RevenueCatto confirm those purchases: RevenueCat receives the store’s receipt and your Lienzo account number — not your name, your email or your photos.

To email you. An email provider sends our emails (password resets, invites), so it sees your address and the message.

If you sign in with Apple or Google, that sign-in happens with them, under their own privacy terms; they tell us who you are, and we check it.

Nobody else. We do not sell your photos or your data, to anyone, ever. There is no advertising, analytics or crash-reporting code in the website or the apps, so we collect no usage or diagnostic data from your device. (If you have told your phone to share analytics with app developers, Apple or Google may pass us their own anonymous crash reports — that is their feature, and your setting.)

We do not sell printed products right now, so we do not ask for or hold a shipping address. If we start, this page will change first to say who makes and ships the prints and what they need from you.

Your pet photo is private. It is not browsable and not guessable, and the storage it sits in cannot be opened from outside: our server hands it out only through a signed link that expires within the hour, which we give only to you on the website. The apps never load it back. Our own staff can see it through our admin tool, which only staff accounts can open.

A finished lienzo lives at a link nobody can guess. Anyone who has that link can open the picture. If you share a lienzo, it gets a public page, and that lienzo — with its style and the written description of your pet — can be read without signing in. Sharing cannot be switched off again yet, except by deleting your account.

The apps do not use cookies. To keep you signed in, they store a sign-in token in the phone’s protected storage — the Keychain on iPhone, encrypted storage on Android. It lasts up to 30 days, is renewed while you use the app, and is removed when you sign out. The apps also remember whether you have seen the welcome screen.

A lienzo is saved to your photo library only when you tap Save. A photo you take with the camera inside the Android app is kept in the app’s private cache on your phone.

A few, all boring: one that keeps you signed in, one that remembers your language, one that remembers you have seen the welcome page, and — only while you sign in with Google — one that lasts ten minutes to make sure the sign-in is really yours. No advertising cookies and no third-party tracking. Stripe’s payment page is Stripe’s own site, with its own cookies.

Until you delete it. There is no timer on your photos — only your credits expire, which is a separate thing.

Account → Delete my account, on the website or in the app. It erases your account, your lienzos (with every attempt and working image), your profile picture, any invite you joined with, and the pet photos you uploaded — they are deleted from our storage, not just hidden from your view. It cannot be undone and we cannot recover it for you.

One exception: we keep a record of any purchase you made, with you removed from it — what was bought, for how much, and the payment reference, with no name, no email, and no link to you. Tax law requires the record; it does not require your identity. Stripe, Apple, Google and RevenueCat keep their own records of the payment under their own terms; deleting your Lienzo account does not erase those.

You can ask what we hold about you, ask for it back, or ask us to delete it — the delete button does the last one immediately. For anything else, email [contact email — to be confirmed] and a person will reply.