Privacy policy
Last updated: 4 October 2026
Who is responsible
Giacomo Guerrini, trading as Hystoriq Portraits, Apt. 22, Block 1, Island Key, East Road, East Wall, Dublin 3, D03 CA33, Ireland, is the controller of your personal data. Contact: info@hystoriqportraits.com.
Summary
- Your photo is used only to make your portrait and is deleted after 30 days.
- It is processed by the AI services that make the portrait, which don't use it to train their models.
- We don't sell your data or use it for advertising profiles.
- You can ask us at any time to see or delete your data.
1. Photos and portraits in the portrait lab
What: the photo you upload, the automatic check of it, and the previews made from it.
Why and legal basis: to make the portrait you asked for (steps taken at your request and performance of the contract, GDPR art. 6(1)(b)).
How:
- Automatic checks: OpenAI's moderation tool and AI model look at the photo to confirm that it shows one adult face clearly and nothing unsafe.
- Portrait: Runware's AI service runs the image model, made by OpenAI, that puts the face into the costume.
- Storage: the files are kept on Cloudflare.
We don't use your photo to identify you, and we don't use it to train AI models.
How long:
- Your photo, its crops and the previews are deleted automatically 30 days after upload.
- If a photo is stopped because it seems to show a child, a public figure or unsafe content, we don't keep the photo at all.
- If you tell us that none of your previews worked ("None of these look right"), we keep a copy of the photo and previews for 90 days, to see what went wrong and improve the costumes.
- When you order a print, the final print file goes to our print partner and is kept with your order.
Automated checks: the checks can stop a photo, for example if they think the person is under 18. This has no legal or similar effect on you. If you think a check was wrong, write to us and a person will look at it.
2. Portrait history and free previews
What we record:
- for each photo: the time, the costume, the results of the checks, the previews made, the one you chose, and your confirmation that you are 18 or older and have permission to use the photo;
- a random identifier stored in your browser;
- a coded (hashed) version of your network address, a short description of your browser, and your country;
- your email address, if you are signed in.
No photos are kept in this history.
Why and legal basis: to count your free previews and stop abuse, to prove which preview you approved if there is a dispute about an order, and to improve the service (our legitimate interests, GDPR art. 6(1)(f)).
How long: each history entry is deleted automatically 24 months after its last update. Counters of free previews are deleted after 30 days.
3. Accounts
If you sign in, Shopify manages your customer account (name, email and orders). We keep a small record linked to it on Cloudflare: your email, your remaining previews and any block for misuse. We keep it until you ask us to delete your account.
4. Orders and payments
What: name, delivery and billing address, email, phone number if you give it, and order details.
Why and legal basis: to deliver your order and provide customer service (contract, GDPR art. 6(1)(b)), and to keep accounting records (legal obligation, GDPR art. 6(1)(c)).
Who processes it:
- Shopify runs the shop and the checkout. Payments are processed by Shopify Payments and its payment partners, or by PayPal or Klarna if you choose them.
- Printful receives your name, address and the print file to produce and ship your order, and shares the address with the carrier.
How long: order and accounting records are kept for 6 years, as Irish tax law requires.
5. Marketing emails
If you tick the box to receive news and offers (when you sign in, at checkout or in the newsletter form), we use your email to send you news about new costumes and offers (consent, GDPR art. 6(1)(a)). Your email and your choice are stored in Shopify, and we will name here any other email service before we use it. You can unsubscribe at any time with the link in every email or by writing to us.
6. Bot protection, cookies and browser storage
Bot protection: to block bots, the portrait lab uses Cloudflare Turnstile. When you upload a photo or sign in, it checks technical data such as your IP address and browser. It doesn't use cookies to track you.
What the lab stores in your browser:
- a random identifier, used to count free previews;
- the list of your portraits on this device;
- whether you are signed in.
We use these only to run the lab and prevent abuse, never for advertising. You can delete them at any time by clearing your browser data.
Cookies: Shopify uses cookies for the cart and checkout. Where the law requires it, a cookie banner lets you accept or refuse optional cookies.
7. Who receives your data
| Service | What it does | Data and location |
|---|---|---|
| Shopify (Shopify International Ltd, Dublin) | Shop, checkout, accounts, emails | Processor. Data may be processed outside the EU, for example in Canada, under EU-approved safeguards. |
| Printful (Printful, Inc., USA) | Printing and shipping | Processor. Data goes to the facility that makes your order and to the carrier. Transfers are covered by Standard Contractual Clauses. |
| Cloudflare (Cloudflare, Inc., USA) | Hosts the portrait lab, stores photos and previews, bot protection | Processor. We have asked for storage in Western Europe; Cloudflare treats this as a preference. Transfers are covered by the EU-US Data Privacy Framework and Standard Contractual Clauses. |
| OpenAI (OpenAI Ireland Ltd) | Automatic photo checks | Processor. Inputs may be kept by OpenAI for up to 30 days for abuse monitoring and are not used for training. Transfers are covered by Standard Contractual Clauses. |
| Runware | AI image generation | Processes the photo to make the portrait. Hosted in the United States and the EU (Germany and Romania). Doesn't use it for training. We have asked Runware for a written data processing agreement. |
| Payment providers (Shopify Payments, PayPal, Klarna) | Payments | Under their own terms. |
You can ask us for a copy of the safeguards used for transfers outside the European Economic Area.
8. Your rights
You can ask to see your data, correct it, delete it, restrict or object to its use, or receive it in a portable format. Where we rely on your consent, you can withdraw it at any time. Write to info@hystoriqportraits.com.
If you are unhappy with how we handle your data, you can complain to the Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland (www.dataprotection.ie).
9. Children
The portrait lab is for adults. Please don't upload photos of anyone under 18.
10. Changes
We will update this policy when our services change and show the date at the top.