Privacy Policy

Last updated November 4, 2026 · All of Us Portraits is a trade name of Cadia First Holdings LLC, California

The short version

Your photos are used only to make your portrait and check how closely it resembles the people and pets in them. Photos are deleted 30 days after delivery (or 30 days after upload if you don't order). Purchased portraits are kept 12 months so you can re-download them. Nothing is ever used to train AI, used to recognize or identify anyone, or sold.

Who can use this site

All of Us Portraits is for adults 18 and over. We make portraits of pets; customers may add themselves and up to one other adult. We don't make portraits of children and don't accept photos of children as subjects.

Where we offer the service

All of Us Portraits is available to residents of the United States. If you live in Illinois or Washington, we can make portraits of pets only for now: every subject must be a pet, and your photos must show only your pets, with no person anywhere in them (not in the background, not in a reflection, not holding a pet). The upload page asks where you live, asks you to confirm this, and won't accept a portrait with a person in it from those states. We don't run any face detection or face matching on these orders. If we learn that an order with a person in it comes from an Illinois or Washington resident (for example, from the billing address at checkout), we'll cancel it, refund any payment, and delete the photos right away. If we notice a person in the photos of an Illinois or Washington pets-only order, we'll delete those photos right away and contact you.

What we collect

Your email address; the state you tell us you live in; the photos you upload and the names or details you type; your selections and order, including any card greeting; a record of the consent boxes you ticked (with the date); payment confirmation and billing address from Stripe (we never see your card number); your IP address and the approximate location our network provider (Cloudflare) derives from it, to prevent abuse; for paid orders, a record of your checkout and downloads (time, IP address, browser type) to answer payment disputes; if you order a print, the names and shipping addresses you give us for each package (yours from Stripe's checkout, and anyone you send a print to as a gift); if you send a gift copy to another home, that person's name and email address, your note and the "from" line; if you sign up for holiday reminders, your email address, when you signed up, the version of the sign-up wording you agreed to and whether you confirmed (see Holiday reminder list); if you write to us (by email or the contact form), your name, email address, any order number you give and your message; unless you opt out, the advertising measurement data described in Advertising measurement; and basic technical logs.

How your photos are used

Your photos go to our image-generation providers to create the portrait, and to our AI review provider, which compares the portrait with your photos and returns a resemblance score from 1 to 10 for each person and pet, a short note on anything that doesn't match, and a check for visual defects. To judge resemblance it compares visible features in your photos with the portrait (for people: face shape and features, hair, skin tone, apparent age, glasses and facial hair); it doesn't label, record or report those traits. We use that result only to decide whether a portrait is good enough to show you. We never use your photos or the scores to recognize or identify anyone, to verify anyone's identity, or to infer anything else about them (such as age, health, race or emotions). We also run our own automated checks on our server. Face-detection software finds where each face is, so we can check that each photo of a person is clear enough and crop a clear reference of each person, and for photo-style portraits, face-matching software measures each face (face geometry) in your photos and in the portrait and compares them. Those measurements are biometric identifiers. They exist only in memory for the few seconds each check takes and are then deleted: we never save, share or sell them, and never use them to recognize or identify anyone. The scores are kept only in a working log that is deleted with your photos. We never sell your photos, never use them to train AI, and never use children's images in marketing.

Consent

Before you upload, you give consent using separate checkboxes on the upload page, not by agreeing to our Terms. You confirm you're 18 or older. You confirm that every other adult pictured has agreed to be included, and that everyone you add to a portrait is an adult 18 or over. You consent to our processing of the photos, including facial features, for the purpose above, and to our collection and use of biometric identifiers and biometric information (the temporary face measurements described above) for that purpose only, and to our named providers receiving the photos. You also confirm that every other adult pictured has agreed to that face check. We keep a record of that consent (see the retention schedule), including the exact version of the wording you saw. You can withdraw consent at any time by emailing [email protected]. We'll stop processing and delete your photos within 10 days.

Who processes your data

We share only what each provider needs to do its job:

Google (Gemini API): creates the portrait. We use Google's paid API service, which Google says it does not use to improve its products; Google may keep limited logs for a short time to detect abuse.
Replicate: backup portrait creation and print upscaling. Replicate deletes API inputs and outputs within about an hour.
Anthropic: the likeness check. Data sent through its commercial API isn't used for training and is deleted within 30 days (longer only if flagged for a safety review).
Printful (only if you order a print): makes and ships it. It receives the portrait image to print and each recipient's name and shipping address; never your uploaded photos or your email address.
Stripe (payments), Resend (email), Cloudflare (network, security, the quick human check on the upload page, the reminder sign-up form and the contact form, and encrypted offsite backup storage) and our hosting provider, The Constant Company, LLC (Vultr) (the server that runs the site).

Each provider handles photos under its written terms with us, which limit its use of them to providing its service to us. None of these providers trains its AI models on them. If you ask us to delete your data, we also tell these providers. Providers may keep limited records under their own terms (for example, for security or legal reasons). Separately, unless you opt out, Meta receives the advertising measurement data described in Advertising measurement; it never receives photos.

AI and watermarks

Portraits are made with AI. They're generated with Google's invisible SynthID watermark where available, and delivered files are labeled as AI-generated in their metadata. Please don't remove these labels.

Retention and deletion schedule

Uploaded photos, full-size renders and the likeness scores and logs made from them: deleted 30 days after your portrait is delivered, or 30 days after upload if you don't order.
Previews: deleted 30 days after upload if you don't order. If you order, previews (including styles you didn't buy) are deleted with your photos, 30 days after delivery.
Purchased portraits and files, and for purchases your email address, the names you typed and your order details (including any card greeting): kept for 12 months so you can re-download your files, then deleted. You can have them deleted sooner at any time.
Minimal order record (tax and accounting): order number, date, amounts paid or refunded, sales tax and the payment processor's reference, kept 7 years. It contains no photos, no names and no email address; only a one-way code made from the email.
Consent record: which boxes were ticked, the version of the wording, your state and the date, kept 5 years as proof of consent, then deleted. It is stored with a one-way code made from your email, not the address itself, and your IP address is removed from it when your photos are deleted.
IP address and approximate location: deleted with your photos (30 days after delivery, or 30 days after upload if you don't order).
Payment-dispute records (paid orders only): when you check out, a record that you ticked the "sales are final" box (time, IP address and browser type); and each time your files are downloaded, the time, file, IP address and browser type. Used only to answer a payment dispute or chargeback. Kept 120 days after payment (the time card issuers allow for disputes), or, if a dispute is open, until it is resolved; deleted with your order on a deletion request unless a dispute is open.
Advertising measurement (only if you haven't opted out): the IP address, browser information and Meta cookie IDs saved with a checkout are deleted as soon as the purchase is reported to Meta, or within 2 days if the checkout isn't paid. A record of whether a purchase was reported (no contact details) is kept 120 days. What Meta keeps is governed by Meta's own terms.
Prints: each recipient's name and shipping address, and the package's tracking details, are kept 120 days after the print ships or is refunded (for delivery problems and reprints), then deleted; the print file is deleted 30 days after. The amounts paid stay in the minimal order record.
Gift copies for another home: the recipient's name and email address, your note and the "from" line are used only to send that one email and show their download page. We never email them again or add them to any list. The same applies to a gift copy you add from your download page after delivery; if you start that checkout but don't pay, what you typed is deleted within 2 days. They are deleted with your order (12 months after delivery), when the order is refunded or deleted, or sooner if the recipient asks us (email [email protected]); their page then stops working. When a recipient downloads a file we record the time, file, IP address and browser type, kept like the payment-dispute records above.
Messages you send us (email or the contact form): your name, email address, any order number and your message, used only to answer you. A contact-form message is emailed to our support inbox through our email provider (Resend) and isn't kept on our website's server once it's delivered (if it can't be delivered within 3 days, a copy is kept for 30 more days so we can send it by hand). Our support emails are kept only as long as we need them to help you and follow up; you can ask us to delete them at any time.
Reviews (only if you leave one): about 3 days after delivery we email you one link to leave a star rating and a review. If you do, we keep your rating, what you wrote, the name you chose to show (optional) and the date, linked to your order so we know it came from a customer. We check it against our review policy (we publish every review, positive or negative, unless it's abusive, off-topic or shares someone's private information) and then publish it on our website with the name you chose. A published review stays up after your order's other records are deleted, no longer linked to you; ask us and we'll take it down. A deletion request removes your review too. A review link that isn't used stops working after 90 days.
Share links (only if you make one): on your download page you can make a link to one portrait you have downloaded, to send to family. Anyone with the link sees that portrait at screen size, with no names, email or order details, and the page isn't listed on search engines. We keep only the link code, which portrait it shows and when you made it. "Stop sharing" on your download page turns every link for your order off at once, and links are deleted with your order.
Gift vouchers (only if you give or receive one): when you buy a gift we keep your email address, the name and (optional) email address of the person it's for, the "from" name and note you write, the day to send it, the gift code and the payment record. We use them only to send your receipt and the gift, to let the person use it, and for refunds and payment disputes. The person's email receives one email from us with your gift; we never add them to any list. Their name, email and your note are deleted 30 days after the gift is used or refunded, and your email address 120 days after (for payment disputes); the gift code, what it was for, the amount and the dates are kept with our 7-year payment records. If you receive a gift, the photos you upload are treated exactly like any order's photos (see above).
Unsubscribe list: a one-way code of your address, so we never email you reminders again.
Holiday reminder list (only if you sign up): your email address, when you signed up, which version of the sign-up wording you agreed to, and whether you confirmed. We use it only to email you reminders before holidays and other gift-giving times and news about new portrait styles. We never sell it or share it for advertising; our email provider (Resend) receives it only to deliver those emails. Nothing is sent until you confirm by pressing the button in the one email we send you first; if you don't confirm within 7 days, your address is deleted. Every reminder email has a one-click unsubscribe link, and you can also reply "unsubscribe". When you unsubscribe, your address is deleted right away; we keep only a one-way code made from it, so we know not to email you. A deletion request removes that code too. We don't ask where you live for this list, and signing up doesn't mean portraits are available where you live (see Where we offer the service).
Technical logs: 30 days. Backups: uploaded photos and previews are never copied to backups. Copies of our order database in short-term backups expire on their own within 7 days. We also keep an encrypted offsite copy of purchased portraits and files (with Cloudflare) so we can restore them if our server fails; it is updated every night, so when your files are deleted here, that copy is deleted within 24 hours. If we ever restore from a backup, we re-apply every deletion request we handled since that backup.

You can ask us to delete everything sooner by emailing [email protected] from the address you used. We'll confirm within 10 days.

If you appear in a portrait

Anyone who appears in a portrait may ask us to delete it, even if they didn't place the order. Email [email protected] with the order number (it's on the receipt and the print release, and starts with AOU-) or the preview or download link, and tell us you're pictured in it. We'll delete the photos, previews and portraits for that order within 10 days and confirm to you. If you don't have the order number or link, tell us whatever you can (for example, who placed the order and roughly when) and we'll look for it.

Biometric Information Retention and Destruction Policy

(public written policy)

What we collect. Our own likeness check measures the faces in your photos and in the portrait (face geometry) and compares them. These measurements are biometric identifiers. They are created on our own server, are held only in memory while one check runs (a few seconds), and are never written to disk, logged, backed up or sent to anyone. Only the resulting resemblance score is kept. This policy also covers the face photos themselves wherever a law treats them as biometric data.
Purpose. Face photos, and anything derived from them, are used only to create the customer's portrait and to score how closely it resembles each person. They are never used for identification, verification, marketing or AI training.
Retention schedule. Face measurements are destroyed as soon as each check finishes (within seconds). Photos and any other such data are permanently destroyed when the purpose is satisfied, and no later than 30 days after the portrait is delivered (or 30 days after upload if there's no order). In every case this is within 24 months of the person's last interaction with us, and within 45 days of our determining it is no longer needed.
Destruction method. Deletion from our servers and storage. Uploaded photos are never copied to backups; backup copies of our order database expire within 7 days. Our providers delete API data on their own published schedules.
Disclosure. Only to the service providers named in this policy, to perform the purpose above, or as required by law or a valid warrant or subpoena. We never sell, lease, trade or otherwise profit from biometric data.
Security and incidents. We protect this data with reasonable industry-standard care, at least as protectively as our other confidential information. If a security incident may have compromised it, we will investigate promptly and notify affected people and regulators as the law requires.
Requests. Email [email protected] to access, delete or withdraw consent. We respond within 10 days, and always within the time the law allows.

Children

We don't make portraits of children, and our site isn't directed to children. If a child appears in the background of a pet photo by mistake, the photo is used only to make the portrait. We never run face matching on anyone except the adults you added; if a photo of you also shows other people, face detection only notices their faces so we can blur them out of the reference. The photo is deleted on the same schedule as every other photo. We never use images of children in marketing. If you think we have a child's photo that shouldn't be here, email us and we'll delete it.

Your rights

Wherever you live, you can ask to access, correct or delete your information, withdraw consent, or opt out of reminder emails, and we won't treat you differently for asking. Email [email protected] from the address you used; we may ask you to confirm it's you. We respond within 10 days where we can, and always within 45 days. If we decline a request, reply with the word "Appeal" and we'll reconsider and answer in writing within 45 days. Washington residents: see our Washington Consumer Health Data Privacy Policy. We never sell your photos or portraits. Our advertising measurement with Meta (below) may count as "selling" or "sharing" personal information under California law; you can opt out at any time, and we honor Global Privacy Control signals automatically. We don't use personal information for decisions with legal or similarly significant effects.

Advertising measurement

When we advertise on Meta (Facebook and Instagram), we use the Meta Pixel on some pages of our site and Meta's Conversions API on our server, to see which ads lead to orders and to show our ads to people likely to be interested. The pixel runs only on our home page, the upload page, the checkout page and the thank-you page. It never runs on your download page or on this page, and we remove any order reference from a page's address before the pixel loads.

What Meta receives: the pages of our site you visit and when; that you started checkout; when you buy, the purchase amount and which package; your IP address and browser information; Meta's own cookie IDs (and the ad click ID if you came from an ad); and, from our server, a one-way coded (hashed) version of your email address and a coded order reference, so Meta can match the purchase to an ad. We never send Meta your photos, portraits, the names or details you type, your card greeting, or your order or download links. Meta may combine it with information it collects about you elsewhere on the internet, and uses it under its own terms and policies to measure ads and to target and deliver ads, including ours.

Under California law (and similar laws in other states), sharing this information with Meta for advertising may be a "sale" or "sharing" of personal information. The categories involved are identifiers (IP address, cookie IDs, the hashed email), internet activity on our site, and purchase information. Our site is for adults; we don't knowingly sell or share the personal information of anyone under 16.

Do Not Sell or Share My Personal Information

You can opt out of this advertising measurement at any time. Use the button below to opt out on this browser: we then don't load the Meta Pixel, and orders placed from this browser aren't reported to Meta. If your browser or an extension sends a Global Privacy Control (GPC) signal, we treat it as the same opt-out automatically, with nothing else to do. The choice is saved in this browser, so opt out again if you clear your browsing data, and on each browser or device you use. Opting out never changes your price or your order. If you have any trouble, email [email protected] and we'll help.

Site statistics and cookies

We count visits to our home page ourselves, on our own server, without any outside analytics service. When your browser shows our home page, it sends us one short note: which version of the page's headline you saw (we're comparing two), and, if you followed a "make yours" link from a customer's download page or delivery email, that you did. We keep only totals per hour (for example, "12 views of headline A between 3 and 4 p.m."), never your IP address, browser details or any ID, and we delete them after 400 days. Two small first-party cookies make this work: ps_hv remembers which headline you see, so it doesn't change between visits (90 days), and ps_ref remembers that you came from a customer's link (30 days). If you check out, your order keeps the same two labels, so we can count orders for each version; they say nothing about you. None of this is shared with anyone or used for advertising, and you can delete the cookies in your browser at any time.

Emails

When you ask for previews, we email you a link when they're ready. If you don't order, we send up to 2 reminders (about 24 hours and 72 hours later), each with an unsubscribe link; you can also reply "unsubscribe". Order emails (receipts and download links) always arrive. If you sign up for holiday reminders, we email you only after you confirm, and every reminder has a one-click unsubscribe link (see Holiday reminder list). When prints are offered, we may also send one email about a day after your portrait is delivered, offering prints of it, with an unsubscribe link; we don't send it if you've unsubscribed or already ordered a print. About 3 days after your portrait is delivered, we send one email asking for a review (every customer gets the same one), with an unsubscribe link; we don't send it if you've unsubscribed (see Reviews). If you started or ordered a portrait with us, we may also send up to 3 seasonal offer emails a year (for example for Black Friday, before the last day to order prints for Christmas, and for last-minute gifts), each with an unsubscribe link; we don't send them if you've unsubscribed.

Global Privacy Control, Do Not Track and third parties

We honor Global Privacy Control: a GPC signal opts you out of advertising measurement automatically (see above). Browsers no longer send a standard Do Not Track signal, so we don't respond to it separately. Our fonts are served from our own site. The upload page, and the reminder sign-up form on our home and thank-you pages (once you start filling it in), load a quick human check from Cloudflare, checkout happens on Stripe's secure page, and, unless you've opted out, the pages listed under Advertising measurement load the Meta Pixel; those services receive your IP address and basic browser information under their own privacy policies. No other third party collects information about your browsing on our site.

Changes to this policy

When we change this policy we update the date at the top of this page, and we'll email you before any change that affects photos you've already uploaded.

Questions: [email protected] · Cadia First Holdings LLC, 2817 High St, Apt 10, Oakland, CA 94619