Privacy policy

Furloom makes portraits from photos of pets. This page explains what we collect and why, in plain language.

What we collect

Photos you upload and the portraits made from them. These are used only to make your previews and your order.
Order details when you buy: your name, email, shipping address and phone number (for canvases). Payment is handled by Stripe; we never see or store your card number.
Your email, if you ask us to tell you when orders open. We use it to send you your preview and one note when orders open, nothing else, and delete it after 60 days.
Basic usage data such as a random browser id that limits free previews per day, and a hashed IP address for abuse prevention.
Site statistics: our own server counts anonymous steps (page view, upload, preview, checkout) with the random browser id, the page version you landed on and the ad campaign tags in the link. No IP address is stored with them and nothing is shared. Nothing is sent if your browser sends Global Privacy Control or Do Not Track.
Ad measurement: if enabled, the TikTok Pixel and TikTok Events API record page views and purchases so we can measure our ads. A hashed version of your email may be sent to TikTok for purchase matching. The pixel does not load if your browser sends Global Privacy Control or Do Not Track.

Our AI image provider receives your uploaded photo to generate the portrait.
Stripe processes payments. Our print partner (Printful) receives your portrait file, name, address and phone number to print and ship your canvas. Resend may deliver our order emails.
We do not sell your personal information or your photos.

Photos and previews from people who do not order are deleted after 7 days. A preview you asked us to email you about is kept for 60 days, with your email.
For paid orders we keep the final image files for 90 days so we can reprint or help with a problem, then delete them. Order records needed for taxes and accounting are kept as the law requires.

Write to hello@shopfurloom.com to ask for a copy of your data or to have it deleted. We will respond within 30 days.

We do not knowingly collect data from children under 13.