Privacy Policy

Who We Are

Vanitas, a Specie house is operated by PaintedApp, LLC. Vanitas (“we,” “us,” “our”) is a US-based shop that sells still-life pictures as giclée prints on canvas and paper, and paints proofs of tables its visitors lay. This policy describes how we collect, use, and protect your personal information when you visit our website at specie-vanitas.vercel.app or use our services.

For privacy inquiries, contact us at support@painted.app, or write to PaintedApp, LLC, 1327 SE Tacoma St #394, Portland, OR 97202.

Information We Collect

We collect the following categories of personal information:

• A photograph you upload of one object, if you choose to add one to a proof. Sent to a safety check and to the image model, and not kept; only the painted proof is stored.
• Order information — email address, name, phone number (when you place an order).
• Your email, if you sign in — there are no passwords. To see your orders, you ask for a sign-in link, we email it, and clicking it sets a signed cookie that keeps you signed in for 30 days.
• Payment information — processed securely through Stripe. We never store credit card numbers on our servers.
• Shipping address — when you order physical products, shared only with our fulfillment partners.
• Device and usage data — IP address, used to limit proofs per connection; and, only with your consent, browser type and pages visited through analytics.
• Attribution — which ad brought you here, kept in your browser's own storage for 30 days and attached to your order.
• Communications — emails you send us for customer support.

How We Use Your Information

We use your information for the following purposes and legal bases:

• To paint your proof from your choices and any photograph you add (contractual necessity / consent)
• To process payments and fulfill orders (contractual necessity)
• To send order confirmations, shipping updates, and delivery notifications (contractual necessity)
• To respond to customer support inquiries (legitimate interest)
• To measure our advertising through analytics you have consented to (consent)
• To prevent fraud and abuse (legitimate interest)

Your Photograph

A photograph you add is sent to OpenAI twice: once to a moderation and object check that refuses people, documents and card numbers, and once to the image model that paints the proof. We do not store it. The proof is stored in Vercel Blob so it can be bought and printed; when you commission it, Claid.ai upscales it into a print master, which is also stored. We do not sell, share, or use your photographs or proofs to train AI models. Write to support@painted.app and we delete your proofs.

Photographs of People and Biometric Data

Your photograph should show one object and nobody at all. A photograph with a person, a face or a hand in it is refused before anything is painted. We do not perform facial recognition, attempt to identify anyone, or build a biometric profile.

If you reside in a state with a biometric-privacy law (for example, Illinois, Texas, or Washington) and a photograph you upload contains a face, the automated check refuses it, and nothing else is done with it.

Third-Party Service Providers

We share limited information with trusted partners to operate our service. Each partner is bound by a data processing agreement:

• OpenAI (San Francisco, CA) — checks your photograph and paints the proof. Receives image data and the table you chose only.
• Stripe (San Francisco, CA) — securely processes payments. Receives name, email, phone number, shipping address, and payment card details.
• Prodigi (Manchester, UK) — prints and ships canvas and paper. Receives shipping address and print file.
• Vercel (San Francisco, CA) — hosts our website and stores proofs and print masters (Vercel Blob).
• Claid.ai — upscales proofs and pieces for print resolution. Receives image data only.
• Resend (San Francisco, CA) — sends our email: sign-in links, receipts and shipping notices. Receives your email address and the message.
• Google (Analytics 4 and Google Ads), Meta (Facebook/Instagram) Pixel and, where enabled, the Pinterest Tag and Reddit Pixel — measurement, conversion tracking, and advertising. These load only with your consent (see Cookies and Tracking) and receive online identifiers and activity events such as page views and purchases. With that same consent, when you buy we also send Meta a server-side record of the purchase (order value and a hashed email) so the browser event is not double-counted.

We do not sell your personal information for money, and we never share it with data brokers or identity resolution vendors. We do use advertising and analytics cookies (Google, Meta and, where enabled, Pinterest and Reddit) only after you consent, which under some U.S. state laws is considered "sharing" for cross-context behavioral advertising. You can withdraw consent, reject these cookies, or send a Global Privacy Control signal at any time — see Privacy Choices.

Cookies and Tracking

We set a few essential first-party cookies: two that remember your privacy choices, a signed count of your free proofs, and, once you sign in, your session. We also keep one entry in your browser's own storage that (for our own reporting) remembers which ad brought you to us for 30 days. These are strictly necessary for the service to function and are always on.

With your consent we also use analytics and advertising cookies — Google Analytics 4, Google Ads, the Meta (Facebook/Instagram) Pixel and, where enabled, the Pinterest Tag and Reddit Pixel — to measure traffic, track conversions, and improve our advertising. None of these load until you click "Accept all" in our cookie banner. If you reject them, send a Global Privacy Control (GPC) signal, or haven't chosen yet, only essential cookies are set. We honor GPC automatically as a valid opt-out of any sale or sharing of personal information. See our Cookie Policy for the full list and how to withdraw consent.

International Data Transfers

Our services are hosted in the United States. If you are visiting from the European Economic Area (EEA) or United Kingdom, your personal data will be transferred to and processed in the United States. We rely on the European Commission's Standard Contractual Clauses (SCCs) executed within our processors' Data Processing Agreements to ensure adequate protection for international transfers.

Data Retention

We keep your order records for as long as needed to provide our service and to meet legal, tax, and accounting obligations — transaction records are typically retained for up to seven (7) years. Photographs you upload are not stored at all. Proofs are stored from the moment they are painted so they can be commissioned and reprinted, and are deleted on request.

• Uploaded photographs: Not stored.
• Proofs and print masters: Retained so your order can be reprinted; deleted on request.
• Order records: Retained for 7 years for legal/tax compliance.
• Sign-in session: 30 days, then you are signed out.
• Free-proof count cookie: 365 days in your browser.
• Ad attribution: 30 days in your browser.

Business Transfers

If Vanitas or its parent, or any of our brands or assets, is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, customer information may be transferred to the successor or acquiring entity as part of that transaction. Any successor will remain bound by the commitments in this Privacy Policy or will notify you of any material changes.

Your Rights

All users:

• Right to access your personal data
• Right to correct inaccurate data
• Right to delete your data
• Right to data portability (receive a copy in machine-readable format)

California residents (CCPA/CPRA):

• Right to know what personal information we collect, use, and disclose
• Right to delete your personal information
• Right to opt out of the sale or sharing of your personal information
• Right to limit use of sensitive personal information
• Right to non-discrimination for exercising your rights

European residents (GDPR):

• Right to withdraw consent at any time
• Right to restrict processing
• Right to object to processing based on legitimate interest
• Right to lodge a complaint with your local Data Protection Authority

To exercise any of these rights, email support@painted.app. We will respond within 30 days. To delete everything, ask from the email you signed in or ordered with: we remove your proofs, your account and your sign-in, and keep only the order records the tax rules above require.

California Disclosure: Categories of Personal Information

In the preceding 12 months, we have collected the following categories of personal information as defined by the CCPA:

• Identifiers: name, email address, phone number, IP address
• Commercial information: order history, products purchased
• Internet activity: pages visited (only through analytics you consent to)
• Geolocation data: approximate location derived from IP address (only through analytics you consent to)
• Audio/visual & sensitive information: a photograph of one object you upload for a proof; checked, painted from, and not stored

We do not sell personal information for money. Where visitors consent to advertising cookies (Google, Meta and, where enabled, Pinterest and Reddit), we "share" identifiers and internet-activity for cross-context behavioral advertising as defined by the CCPA/CPRA. You may opt out at any time via Privacy Choices, the cookie banner, or a Global Privacy Control signal.

Children's Privacy

Our services are for adults only. We do not knowingly collect personal information from anyone under 18, and photographs with any person in them are refused. If you believe a minor used the service, contact us and we will delete what we hold promptly.

Changes to This Policy

We may update this policy from time to time. Material changes will be posted on this page with an updated date, and every change is listed with its date on Legal and changes. Your continued use of the service after changes constitutes acceptance.

Contact

For privacy-related questions, data requests, or complaints, email us at support@painted.app.