Privacy Policy
Effective date: 22 October 2026
This policy explains how Draw Paw collects, uses, shares and protects personal information. We've written it to meet the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) and the EU General Data Protection Regulation (GDPR) and UK GDPR.
1. Who we are
Draw Paw ("we", "us") is based in New South Wales, Australia, and operates the website https://draw-paw.com. We are the controller of the personal information described in this policy.
Contact for privacy questions: hello@draw-paw.com (subject line "Privacy").
We don't currently sell to people in the European Union, the European Economic Area or the United Kingdom (people there can join a waitlist instead). Before we do, we will appoint the representatives the GDPR and UK GDPR require, where they apply, and update this policy.
2. The short version
- Your uploaded photo is sent to OpenAI to create your portrait. We don't store your uploaded photo — we keep only the generated artwork.
- Unpaid artwork is deleted after about 24–48 hours. Paid full-size files are deleted after 30 days.
- We keep basic order records (email, pet name, style, amount, currency and payment IDs) for accounting and tax.
- We use only strictly necessary cookies. No advertising or analytics trackers.
- We don't sell your personal information.
3. What we collect
| What | Examples | Where it comes from |
|---|---|---|
| Uploaded photo | Your pet photo, and anything else visible in it | You |
| Order details | Pet name (lettered on the art), chosen style | You |
| Generated artwork | Preview and full-size portrait | Created by our AI provider from your inputs |
| Contact and payment details | Email address; payment status, amount, currency, Stripe customer/payment IDs; billing country | You, via Stripe Checkout |
| Location | Your approximate country, worked out from your IP address when you visit and when you check out (to show prices in your currency, check whether we can sell in your country, and keep tax records) | Cloudflare |
| Consent records | Which consent boxes you ticked (photo rights; terms and immediate delivery; waitlist), the wording version and when | You |
| Waitlist | Your email address and country, if you ask us to tell you when Draw Paw is available in your country | You |
| Card details | Card number, expiry, CVC | Collected and held by Stripe only — we never see or store them |
| Technical data | IP address (converted to a one-way hash for rate limiting), browser and device information, request logs | Your browser; Cloudflare |
| Bot-protection data | Signals used by Cloudflare Turnstile to tell humans from bots | Your browser; Cloudflare |
| Support messages | Anything you send us by email | You |
Please don't upload photos of people, especially children. If a photo contains a person, that information is processed only to generate the artwork and is not stored by us.
We don't intentionally collect sensitive information (such as health or biometric information). We don't use your photo to identify anyone.
4. Why we use it, and our legal bases
The GDPR and UK GDPR require us to tell you our "legal basis" for each use. Under the Australian Privacy Act, we collect personal information only where it is reasonably necessary for our functions and activities.
| Purpose | Information used | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Generating your preview and portrait | Photo, pet name, style | Performance of a contract (Art. 6(1)(b)) — taking steps at your request before entering a contract, and providing what you bought |
| Taking payment and delivering your download | Email, order and payment details, artwork | Performance of a contract (Art. 6(1)(b)) |
| Sending order confirmations and download links | Email, order details | Performance of a contract (Art. 6(1)(b)) |
| Keeping accounting and tax records | Order records | Legal obligation (Art. 6(1)(c)) |
| Customer support, refunds, redos and handling disputes or chargebacks | Order records, support messages, artwork (while held) | Contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)) in resolving issues and defending claims |
| Telling you when Draw Paw is available in your country (waitlist) | Email, country | Consent (Art. 6(1)(a)) — you can withdraw it at any time by emailing us |
| Security, bot protection, rate limiting and preventing abuse | Hashed IP, Turnstile signals, logs | Legitimate interests (Art. 6(1)(f)) in keeping the service secure and available, and preventing fraud and misuse |
| Complying with law and law-enforcement requests | Any relevant information | Legal obligation (Art. 6(1)(c)) |
We don't send marketing emails (apart from the one-off "now available" email if you join our waitlist). If we ever want to, we'll ask for your consent first and every message will have an unsubscribe link.
We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. (Automated safety filters may decline to process a photo or text that appears to break our Terms — if so, you won't be charged, and you can contact us.)
5. Who we share it with
We use the following service providers ("processors") to run Draw Paw. They may only use your information to provide services to us, under their data processing terms.
| Provider | What they do for us | Information involved |
|---|---|---|
| Cloudflare, Inc. | Website hosting, file and database storage (R2, D1), bot protection (Turnstile), security and logs | Generated artwork, order records, technical data |
| OpenAI (OpenAI, L.L.C. and affiliates) | AI image generation | Uploaded photo, pet name, style prompt, generated output |
| Stripe (Stripe Payments Australia Pty Ltd and affiliates) | Payment processing and fraud prevention | Email, payment details, billing country, device data |
About OpenAI. Under OpenAI's API data controls, data sent through the API is not used to train OpenAI's models unless the customer opts in (we have not). OpenAI may keep API inputs and outputs in abuse-monitoring logs for up to 30 days, or longer where required by law or reasonably necessary to protect its services or others from harm. See OpenAI's "Data controls in the OpenAI platform": https://developers.openai.com/api/docs/guides/your-data
We may also share information with our professional advisers (such as accountants and lawyers), with authorities where the law requires it, or with a buyer if the business is sold (who would have to protect it in the same way).
We do not sell or rent your personal information, and we do not share it for advertising.
6. Overseas transfers
We are based in Australia, but our providers process information in the United States and other countries where they or their sub-processors operate (Cloudflare's network is global). This means your information is likely to be transferred and stored outside your country, including outside Australia, the EU and the UK.
- Australia (APP 8): before disclosing personal information overseas, we take reasonable steps to ensure recipients handle it consistently with the APPs, including through contractual data processing terms.
- EU/UK: where information leaves the EU/UK for a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum or International Data Transfer Agreement), or on the EU–US Data Privacy Framework (and UK Extension) where the provider is certified. You can ask us for more information about these safeguards.
7. How long we keep it
| Information | How long |
|---|---|
| Uploaded photo | Not stored by us. Sent to OpenAI for generation only; OpenAI may retain it for up to 30 days for abuse monitoring as described above |
| Unpaid artwork (previews and generated files) | Deleted automatically after about 24–48 hours |
| Paid full-size artwork | Deleted 30 days after purchase (when your download link expires) |
| Order records (email, pet name, style, amount, currency, Stripe IDs) | Kept for as long as we need them for accounting, tax and legal purposes — generally 5 years after the end of the financial year of the order (Australian tax record-keeping), then deleted or de-identified |
| Hashed IP addresses (rate limiting) | Deleted after 7 days |
| Waitlist entries | Until we've told you Draw Paw is available in your country, you ask us to remove you, or 13 months — whichever comes first |
| Server and security logs | Kept for a limited period under our providers' standard log retention (generally up to 30 days) |
| Support emails | Up to 2 years after the issue is resolved, unless needed longer for a legal claim |
| Payment records held by Stripe | Kept by Stripe under its own legal obligations — see Stripe's privacy policy |
8. Cookies and similar technologies
We only use cookies and similar technologies that are strictly necessary for the Site to work and stay secure:
- Cloudflare Turnstile — checks that you're a human and not a bot.
- Tester access cookie — used only to give our team access to test features; it isn't set for ordinary visitors.
- Order reference in your browser — after you buy, we save your order number and a private order key in your browser's local storage so you can find your download again on this device ("Find my order"). It never leaves your browser except to fetch your own order, and you can delete it at any time from that page or by clearing your browser data.
We don't use analytics, advertising or social-media tracking cookies. Because these cookies are strictly necessary, we don't need to ask for your consent to use them, but you can block cookies in your browser (some parts of the Site may then not work). If we ever add non-essential cookies, we will ask for your consent first where the law requires.
9. Your rights
Wherever you live, you can ask us to:
- access the personal information we hold about you;
- correct information that is inaccurate, out of date or incomplete;
- delete your information (we may need to keep order records to meet legal obligations).
If the GDPR or UK GDPR applies to you, you also have the right to:
- object to processing based on our legitimate interests;
- restrict processing in certain circumstances;
- data portability (receive information you gave us in a commonly used, machine-readable format); and
- withdraw consent at any time, where we rely on consent.
To make a request, email hello@draw-paw.com. We may need to verify your identity (for example by asking you to reply from the email used for your order). We'll respond within 30 days (Australia) or one month (EU/UK), and we won't charge you unless the law allows. If we refuse a request, we'll tell you why and how to complain.
Many requests resolve themselves quickly: we don't store your uploaded photo, and artwork is deleted automatically as described above.
10. Children
Draw Paw is not directed at children. Under-18s may only use Draw Paw with the involvement of a parent or guardian, and we do not knowingly collect personal information from children under 16 without parental consent. Please don't upload photos that show children. If you believe a child has given us personal information, contact us and we'll delete it.
11. Security
We protect personal information with measures appropriate to the risk, including encryption in transit (HTTPS), restricted access to systems and storage, hashing of IP addresses, bot protection, automatic deletion schedules, and using reputable providers that maintain recognised security certifications. Card payments are handled by Stripe, which is certified to PCI DSS Level 1. No system is completely secure; if a data breach is likely to result in serious harm to you, we will notify you and the relevant regulator where the law requires.
12. Complaints
Please contact us first at hello@draw-paw.com. We'll acknowledge your complaint within 7 days and aim to resolve it within 30 days.
If you're not satisfied, you can complain to:
- Australia: the Office of the Australian Information Commissioner (OAIC) — https://www.oaic.gov.au/privacy/privacy-complaints, phone 1300 363 992.
- European Union: the data protection supervisory authority in your country of residence, work or where the issue occurred — list at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.
- United Kingdom: the Information Commissioner's Office (ICO) — https://ico.org.uk/make-a-complaint/.
13. Changes to this policy
We may update this policy as our service or the law changes. We'll post the new version on the Site with a new effective date and, if the changes are significant, tell you before they apply to you where we have your contact details.
14. Contact
Draw Paw — New South Wales, Australia
Email: hello@draw-paw.com
Website: https://draw-paw.com