Privacy Notice

Effective October 16, 2026

Pet & Us at us.flat4pet.com is operated by EuroAFF.com S.à.r.l., Luxembourg registration B280385, 21 Rue du Puits Romain, 8070 Bertrange, Luxembourg. Questions, support and legal notices: info@flat4pet.com.

1. What this notice covers

We are the controller of personal data used to operate this portrait studio. This notice covers uploaded photos, AI portraits, orders, gifts and use of this website. Payment providers also process information under their own privacy notices.

2. Information we process and why

Photos and portrait instructions: images you upload, selected styles and generated results, to create previews, fulfil purchases and provide requested revisions. The legal basis is performing our agreement with you.
Order and contact information: email, selected package, purchase amount, payment identifiers and status, to deliver access, recover orders, provide support and maintain accounting records. The bases are contract and applicable legal obligations.
Gift information: the recipient email and your message, to deliver the gift you request. Provide these only when the recipient would reasonably expect that use. We do not enrol gift recipients in marketing.
Security and technical information: session identifiers, request information, IP-derived rate-limit identifiers and error logs, to secure private collections and prevent fraud or excessive generation. The basis is our legitimate interest in a secure service.
First-party journey information: limited events such as starting a portrait or checkout and campaign information in the arrival URL, to understand service use and attribution. Optional advertising technologies require any consent applicable in your location.

We do not use this studio to identify people through facial recognition, make eligibility decisions or infer sensitive personal characteristics. Please avoid uploading documents, private information in the background, or images of anyone under 18.

3. AI processing and service providers

Creating a portrait requires sending your selected photos and style instructions to OpenAI. Cloudflare hosts and protects the website, Supabase stores private files and records, Stripe processes payments, and Resend sends transactional emails. Providers receive information needed for their role. We may also disclose information when legally required or necessary to protect rights and investigate abuse.

We do not sell your uploaded photos or publish them in our gallery or advertisements without separate permission. Gallery samples are illustrative. We do not use customer uploads to train our own AI model.

4. International processing

Our providers operate internationally, so information may be processed outside your country or the European Economic Area. Where required, transfers must rely on an applicable adequacy decision, standard contractual clauses or another lawful safeguard. Contact us for information about the safeguards relevant to your data.

5. Storage and retention

Uploaded source photos and portrait files are stored privately. We retain them while needed to generate, deliver, recover or revise your collection and to address disputes. They are not automatically erased when you close a tab. You may request deletion at any time; we will explain if specific records must be retained for legal, payment, fraud-prevention or dispute purposes. Download purchased files for your own backup.

Unused previews may be removed after 30 days. Purchased collections are retained to support access and recovery, subject to deletion requests and service availability. Financial records are kept for the period required by applicable law. Expired access tokens and rate-limit records are removed through maintenance. Backup copies may remain temporarily until their normal rotation and are not used for ordinary service delivery.

6. Cookies, private links and email

An essential signed session cookie keeps your collection associated with your browser for up to 180 days. Campaign attribution cookies may have the same duration. Browser storage also remembers your studio selections. Private access and gift links act as keys: anyone you share a valid link with may gain the access it grants. Recovery links expire; you can request a new one through Find an order.

We send purchase, gift, recovery and necessary service messages. These are not a marketing subscription. Marketing emails and optional advertising cookies require a separate appropriate choice. Blocking essential cookies can prevent order access.

7. Your choices and rights

Depending on applicable law, you can request access, correction, deletion, portability, restriction or object to processing, and withdraw consent where consent is the basis. Send your request to info@flat4pet.com. We may verify ownership using proportionate information. We respond within applicable legal deadlines, normally one month under the GDPR, and explain any lawful extension or refusal.

You may complain to Luxembourg’s data protection authority, the CNPD, or the competent authority where you live. Exercising your rights does not affect the lawfulness of earlier processing.

8. Security and changes

We use access controls, private storage and limited-duration download links. No internet service can guarantee absolute security. Contact us promptly if a private link or mailbox is compromised. We update this notice when our practices change and provide additional notice where required.