Privacy policy

Last updated: 13 November 2026 (Microsoft Clarity added)

This policy explains what personal data personalizedpetportrait.com collects and why. The controller is Lumond GmbH, Kolonnenstraße 8, 10827 Berlin, Germany, hello@personalizedpetportrait.com.

What we collect

• Your photos (your pet, and for scenes with people, the people you add) and the portraits made from them, so we can paint, show and print your portrait.
• Technical data: IP address, country and a session cookie, so the site works, your previews stay yours, and we can stop abuse of the free preview. We delete stored IP addresses after 30 days.
• Advertising measurement: the Meta Pixel and Meta's Conversions API tell Meta which pages you visit here and when you make a preview, open checkout or buy, together with your IP address, browser, Meta cookies (_fbp, _fbc), a pseudonymous session id and, for purchases, your email, phone number, name and address in hashed (encrypted one-way) form. This lets us measure and improve our ads on Facebook and Instagram.
• Site analytics: Google Analytics, loaded through Google Tag Manager, counts which pages you visit, how you got here and how you use the site, together with your IP address (Google shortens it and does not store it), browser, device, rough location and the Google Analytics cookies. This lets us see which pages and ads work.
• Usage recordings: Microsoft Clarity records how you use our pages (clicks, scrolling, mouse movement, which page parts you see) as anonymised session recordings and heatmaps, with your IP address, browser, device and the Clarity cookies. Text you type is masked and never recorded. This helps us find and fix what is confusing or broken.
• Member sign-up: if you join as a member or save a portrait for later, your email address and the portrait you saved, so we can give you member prices and email you about your portrait (up to two reminders) and our offers. Every email has a link to unsubscribe at once.
• Order data when you buy: name, email, phone number, shipping and billing address, what you ordered, and when you accepted our terms (and, for digital files, the withdrawal waiver). Card details go straight to Stripe; we never see them.

Why (legal basis)

To give you the previews and fulfil your order (Art. 6(1)(b) GDPR), to meet tax and accounting duties (Art. 6(1)(c) GDPR), to keep the service secure and free of abuse, and to measure our advertising and how the site is used (Art. 6(1)(f) GDPR). Member emails are sent with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time. You can object to the advertising measurement, the site analytics and the usage recordings at any time by email; you can also block them with your browser, in your Facebook ad settings or with Google's opt-out add-on for Google Analytics.

Who processes data for us

• Cloudflare, Inc. hosts the website and stores photos, portraits and orders.
• Google LLC (Gemini API) processes your photos to paint the portrait.
• Stripe Payments Europe, Ltd. processes payments.
• Gelato AS and its partner print studios print and ship physical orders; they receive the print file and your shipping details.
• Amazon Web Services EMEA SARL (Amazon SES) sends our order emails.
• Meta Platforms Ireland Ltd. receives the advertising measurement data described above. For this we and Meta are joint controllers (Art. 26 GDPR) under Meta's controller addendum; Meta's own privacy policy applies to what it does with the data.
• Google Ireland Ltd. provides Google Analytics and Google Tag Manager and processes the site analytics data described above on our behalf.
• Microsoft Ireland Operations Ltd. provides Microsoft Clarity and processes the usage recordings described above on our behalf.

Some of these providers process data outside the EU, in particular in the USA. Transfers rely on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.

Cookies

We use one necessary cookie (ppp_sid) that keeps your previews linked to your browser, a member cookie (ppp_m) once you join as a member, and your browser's local storage remembers which photo you uploaded last. The Meta Pixel sets the advertising cookies _fbp and _fbc (up to 90 days). Google Analytics sets the cookies _ga and _ga_DPMSKHVLXT (up to 2 years). Microsoft Clarity sets the cookies _clck (up to 1 year), _clsk (1 day) and MUID (up to 1 year). Fonts are served from our own server, not from Google.

How long we keep it

Photos and previews that did not lead to an order are deleted after 90 days. Member email addresses are kept until you unsubscribe or ask us to delete them. Order data is kept for as long as tax and commercial law requires (up to 10 years); the photos and portrait files of an order are kept for 2 years so we can reprint it.

Your rights

You can ask for access, correction, deletion, restriction, data portability, and object to processing based on legitimate interest. Email hello@personalizedpetportrait.com. You can also complain to a data protection authority, for example the Berlin Commissioner for Data Protection and Freedom of Information.