Privacy Policy

Last updated: October 13, 2026

AIPetPortrait is operated by hongmei qin under the AIPetPortrait brand. For privacy and data requests, contact contact@aipetportrait.net.

What we collect and why

Google sign-in provides your email, name and profile image URL. We use these to identify your account, provide sign-in and credit balances, and respond to account requests; we do not receive your Google password. We store your credit ledger, order IDs, transaction amounts, currency and status, and generation history. We also process uploads, generated images and support or content-report emails you send us.

We use this information to deliver the service and payments, handle support and safety reports, prevent abuse and meet legal obligations. Where applicable, the legal bases are performance of our service contract, legitimate interests in security and support, and legal obligations. We do not sell your personal information or use your photos to train our own models.

We record anonymous usage events, including country and page, with no IP addresses or personal data in the events table, to improve the service.

Payments

Waffo (Waffo Pancake), our merchant of record, handles billing, taxes, receipts and payment information. We do not store full payment card numbers. Payment and refund records received from Waffo are used to manage your credits and resolve billing issues.

Pet photos and AI processing

We store uploads and results privately in Cloudflare R2. Only your account or browser ownership cookie can access them through our app. Images are retained for up to 30 days; download your favourites. Reports may require manual review and removal of offending images.

Photos and server-generated portrait instructions are sent through EvoLink to Google Gemini image models (Nano Banana) or ByteDance Seedream for AI processing. If the operator configures fal instead, the selected fal model processes them. See How it works and the model disclosure in the tool for the active configuration. Provider processing and retention follow their own policies. Some EvoLink input configurations use temporary provider storage for up to 72 hours; signed input links expire after 15 minutes. We cannot promise that upstream providers follow our 30-day storage policy.

Daily free use and cookies

We use a SHA-256 hash of your IP address with a daily salt to enforce the daily free limit; we do not store your raw IP in our application database. Cloudflare and other infrastructure providers may process request metadata, such as IP addresses and request times, under their policies.

Essential cookies keep you signed in (up to 30 days), protect Google sign-in (short-lived), and identify your anonymous images (up to 31 days). You can clear or block cookies in your browser, but signing in and accessing anonymous results may stop working. We do not use advertising cookies or third-party marketing analytics.

Security, sharing and international processing

We use HTTPS and owner access checks for images; session tokens are hashed in the database. No system can guarantee absolute security. Cloudflare, Google, EvoLink, the model providers and Waffo process data needed to provide their services, potentially in countries other than yours. Their processing and transfer safeguards are governed by their own terms; we do not claim a particular transfer agreement that has not been confirmed. We may disclose relevant records where required by law. We will provide legally required security-incident notifications.

Retention and your rights

Images are retained for up to 30 days. Account information and credit/generation history remain while your account is active; request deletion when you no longer need the account. Financial and support records may be retained as needed to resolve requests, prevent fraud and meet accounting or legal obligations. The required period depends on the record and applicable law.

Request access, correction, deletion (including photos), a portable copy, restriction of processing, or exercise applicable objection/consent-withdrawal rights by emailing us from your account email. We may verify ownership before releasing or deleting data. We aim to respond within 30 days, subject to applicable law. Some financial records may need to be retained by law. You may complain to your local data protection authority.

Children and policy updates

The service is for adults aged 18 and over. If a child has supplied personal information, contact us to request removal. We publish changes here with an updated date; third-party services have their own privacy policies. Read our Terms of Service and Acceptable Use Policy.