Privacy policy

Paintings From Photo is a trading name of TMR Digital Ltd, a company registered in England and Wales (company number 15550089), with its registered office at Suite 4387a, 60 Tottenham Court Road, London W1T 2EW, United Kingdom. We run this website and decide what happens to the information on it, which makes us the data controller for everything described below. Your details exist here for two reasons: so we can paint your painting, and so we can write back to you. There is no third reason. If you open a trade account for your business, what we keep for it is set out under Trade accounts. If we have written to your business about trade prices, that is covered separately under If we emailed your business.

What we collect, and when

When you request a commission

Your name, your email address, a phone number if you choose to give one, the photographs you upload, and the details of the painting: the subject, how many people or pets are in it, the canvas size, anything you tell us about the occasion, and a discount code if you use one. We also record which page you started from and how you found us, described under How you found us below, so we can see which parts of the site are doing their job.

When you order a painting from the catalogue

Your name, your email address, an optional phone number, which painting you want, the size, and any notes you add. As with a commission, we record how you found us alongside it.

When you order photo restoration

Your name, your email address, an optional phone number, the photographs you want restored, whether you want colour added, and any notes. As with a commission, we record how you found us alongside it.

When you use the contact form

Your name, your email address, an optional phone number, what the enquiry is about, and your message.

When you buy a gift voucher

Your name and email address, the canvas size, and the name and message for the voucher if you add them. Stripe takes the payment. The name and message appear on the printable voucher, which anyone with the code can open. As with a commission, we record how you found us alongside it.

When you ask for a free photo check

Your email address, your name if you give it, the photographs you upload and any note you add. As with a commission, we record how you found us alongside it.

When you ask for a free photo restoration

Your email address, your first name if you give it, the photograph you upload, whether you want colour added, and whether you ticked the box to join our email list, with the words beside that box and when you ticked it. We record how you found us, as with a commission, and we keep a scrambled code made from your IP address, not the address itself, for 30 days, so that one connection can’t use up lots of free restorations. When you press Start, your photograph goes to our image processing provider to be restored. We keep the restored file where only we can reach it and email you a smaller copy with our name across it. If you pay to unlock the file, Stripe takes the payment, and we keep your reference, the amount and when you paid.

When you ask for a free royal portrait

Your email address, the name you want under the portrait if you give one, the photograph you upload and its file name, who is in it (a pet, a person, or a group and how many), and the costume and century you pick. We record how you found us, as with a commission. So that one person or connection can’t use up lots of free portraits, we count requests for two days against your email address and against a scrambled code made from your IP address, not the address itself, and we keep a copy of that code with your request. Asking for a portrait does not put you on our email list.

When you press the button, your photograph goes to our image processing provider, which paints the portrait by computer from your photograph and a reference painting in the style of the century you chose. It is given the photograph, never your name or email address. If our limits stop the portrait starting straight away, we email you a link instead. It opens a page with a Start button, and painting begins when you press it; the link works for 48 hours. If the day’s free portraits have already run out when you send the form, we say so on the page and your request is not saved. We keep the finished portrait where only we can reach it, and make a card from it, with its title and our name, that we email to the address you gave. The card is public on purpose, so you can share it: anyone with its link can open it, and the name you gave is on it. When painting starts, your request also reaches our internal admin system. We are emailed a note, with your email address and the card, when your free portrait is ready, and another if you pay.

The page that shows your portrait has a code in its web address. Whoever has that address can see your portrait and, once you have paid, download the full-size files and see your painting code, so keep it to yourself. The same code is in the links in our emails to you, including the Start link if we send one. Our visitor statistics record the addresses of the pages people visit, so that code reaches our own Umami and Vercel’s Web Analytics, both described under How you found us. Stripe is given the address so it can bring you back after paying, and our host’s request logs record the code when the page checks on your portrait. The Meta Pixel is never given it, even if you allow advertising cookies. The page asks search engines not to list it, and tells your browser not to pass its address on to other websites.

If you pay to keep the portrait at full size, Stripe takes the payment and is given your email address and your reference. Your photograph then goes to our image processing provider again, and the computer makes the portrait afresh at full size; we make a card from that one too. We keep your reference, the amount and currency, when you paid, and the painting code the payment earns, which is saved with your email address and the name you gave.

If the portrait is of a pet, paying also gets you a short film of it. Your photograph and the portrait go to the same image processing provider, which makes two short video clips from them: the photograph turning into the portrait, and the portrait moving. A server of our own then joins the clips into a thirteen-second film with the name you gave on it and stores the film with our image host. The film is public in the same way as the card, so anyone with its link can play it, and we email you the link. It is kept for 90 days from your payment, like the full-size files.

If you joined our email list

Your email address, when you joined, which sign-up box you used and on which page, and the wording you agreed to. There is more under Our email list below.

When you open a trade account

Your business name, your name, your email address, your website, when you opened the account, and whether you ticked the optional box asking for trade emails, along with the words beside that box, their version and the time. What we keep when you log in or place a trade order is under Trade accounts below.

If you joined our old waitlist

Your email address, and which page you signed up from.

If we email your business

Your business name, the email address your website publishes, your website, the town, the category your business is listed under on Google Maps and, if your website shows one, your company registration number. There is more under If we emailed your business below.

Payment and your delivery address

Payment is taken by Stripe on its own secure checkout page, which also asks for your delivery address. Stripe tells us the address and that you have paid; your card details never pass through this website and we never see them. You don’t need an account to order. Businesses can open a trade account, which has no password: you log in with a link we email you.

One technical exception: photo uploads are rate-limited by IP address, so the upload form cannot be used as free file hosting. That count is held in memory for a minute and then gone. It is not written to the database and it is not tied to your order. The trade forms are protected the same way: opening an account, asking for a login link, logging in and placing a trade order are each counted by IP address, in memory, over at most 10 minutes, and that count is not stored either. The free restoration and royal portrait forms, the Start buttons behind their email links, and the buttons you press to approve your painting also run Vercel BotID, a check from our host that looks at signals from your browser when you press them, to tell people from automated scripts. Vercel may use cookies or similar technology in your browser to do that. We receive only its answer, and we store nothing from it.

The photographs you send us

Your photographs are stored for us by Cloudinary. Each one is given a long, random web address that is not listed or linked anywhere public — but anyone who has that address can open the photograph, so treat it as unlisted rather than secret. The same links appear in the confirmation email we send you and in the notification that reaches us.

To paint from a photograph, the photograph has to reach the person painting it, and the artists we work with may be outside the UK. So your photograph and the brief for the painting go to the artist who paints it.

We keep photographs afterwards so a painting can be reworked or painted again — a second copy for a family member, or a replacement if something happens to the first. If you would rather we did not, ask and we will delete them.

We do not publish your photograph, or the painting made from it, anywhere without asking you first.

Free restorations work a little differently. The full-size restored file is kept private: nobody can open it until it has been paid for, and then only through a download link that works for 90 days. The preview we email you has an unlisted web address, like your upload.

Royal portraits are the same: the portrait itself stays private, and after you pay you download the full-size files from your portrait’s page through links that work for ten minutes each. The card made from it is the exception, because it is made to be shared.

Who else handles your information

Ten suppliers, each doing one job:

• Cloudinary — stores the photographs you upload, the previews and restored files from free restorations, and royal portraits and their cards.
• Instantly — sends the emails we write to businesses about trade prices, described under If we emailed your business.
• Image processing providers — used to repair the photographs you send us for restoration, including free restorations, and to paint royal portraits by computer: the free one, and the full-size one if you pay for it.
• Vercel — hosts the website, and like any host keeps ordinary request logs.
• Stripe — takes your payment and your delivery address at checkout, and shows Klarna payment information on some pages. It sends us the address and confirmation that you paid, never your card details.
• Resend — sends our emails. The confirmations and updates we email you go out through Resend, which keeps a record of each one.
• Google — our inbox, and the backup route for our email if Resend is unavailable. Anything you write to us, and our own copy of your order, sits in a Google mailbox. Separately, if a paid order came from a Google advert, we may tell Google Ads, as described under How you found us.
• Google Customer Reviews — after you pay for a painting, the confirmation page may show a small box from Google offering a short survey about your order. To offer it, the page gives Google your order number, your email address, the country your painting is going to and the date we expect it to arrive. Google only emails you if you say yes in that box, sends the survey after that date, and handles your answers under its own privacy policy.
• Our own database and internal admin system, on a server we run — every order and enquiry is saved there, and it is what we work from when we reply.
• Meta — only if you allow advertising cookies, and only for our advertising, described under Advertising cookies. Without your yes, nothing from Meta is loaded.

They are suppliers, not partners: they hold your information to do a job for us and nothing else. Some of them are based outside the UK, so your information may be processed outside the UK. We do not sell personal data. The one exception to not sharing it for marketing is the Meta Pixel, and only with your consent, under Advertising cookies; even then Meta is not given your name, email address or phone number.

Our email list

If you joined our email list, we keep your email address, when you joined, which box you used and on which page, and the words you agreed to. We use it to write now and then about new paintings, order-by dates and offers. Every one of those emails has an unsubscribe link, and replying with the word “unsubscribe” works too. The emails go out through Resend, like the rest of the email we send.

If you tick the box on the free photo restoration form, you join this list when you press Start. The first email is about having your restored photo painted, three days after your preview.

When you unsubscribe we keep your address marked as unsubscribed, with the date, so that you are never emailed from the list again by mistake. If you would rather we deleted even that, ask.

Trade accounts

A trade account lets a business, such as a photographer, order paintings for its clients at trade prices. For each account we keep the details listed above under “When you open a trade account”, and when you last logged in. A new account also reaches us as an email and as an entry in our internal admin system, so we know who has joined. Opening an account again with the same email address never changes the details or the trade emails choice already on the account.

There is no password. You log in with a link we email to the address on the account. The link in the email that welcomes you works for 24 hours, and a link you ask for on the login page works for 30 minutes. Each works once. We never store the link itself, only a scrambled version of it that cannot be turned back into the link, and we delete that when the link is used or soon after it expires.

Logging in uses two cookies. Both are strictly necessary, so we set them without asking. Neither tracks you, both are sent only to this site, and no script on the page can read them.

• pfp_trade_login — holds the one-time code from a login link you have opened, until you press Log in. Keeping it here means the code is never part of a page address our visitor statistics could record. It lasts up to 24 hours and is deleted when you use it.
• pfp_trade — keeps you logged in. It holds a random session number and lasts 30 days, or until you log out.

Each login also leaves a session record with us: a scrambled version of that session number, which account it belongs to, when it started and when it expires. Logging out deletes it, and “Log out of all devices” on your account page deletes the session records of every browser logged in to your account, along with any login link not used yet. Otherwise a session record is deleted once it expires, after 30 days.

Trade emails are optional. If you tick the box when you open the account, we may write now and then with trade news, such as order-by dates and new sizes. To stop them, reply “unsubscribe” to any trade email, or tell us in any words, and we stop. The emails an account needs in order to work, such as login links and payment confirmations, are sent whether or not you ticked the box.

When you place a trade order, we keep what we keep for any commission (the photographs, the subject, how many people or pets, the canvas size and your notes), and whether the painting comes to you or goes straight to your client. We also record your account details on the order, with your trade level and the number of paid trade orders it was worked out from, so the price can always be explained. If the painting goes to your client, you can give their name for the packing note, and Stripe’s checkout takes their delivery address, as it takes yours on any other order. We use your client’s name and address only to deliver the painting; please give them to us only if your client is happy for you to. The approval photograph, and our emails about the order, go to you as the account holder, not to your client. If a trade order is refunded in full, we record that on the order so it stops counting towards your trade level; for a refund made through Stripe, Stripe tells us.

We keep a trade account while it is open, and delete it when you ask. If we close an account, we keep its record until you ask us to delete that too. Orders placed through an account are kept for six years as accounting records, like every order, even after the account itself is deleted.

If we emailed your business

We write to some businesses whose clients might want a painting, such as photographers, framers and interior designers, about buying our paintings at trade prices. We find them on Google Maps and on their own websites, and we only use the email address a business publishes on its website. We keep the business name, that address, the website, the town, the Google Maps category and, where the website shows one, the company registration number, along with which emails we sent and whether you replied.

In the UK we only send these emails to limited companies and LLPs, and each business gets no more than three. If you reply “no thanks”, or ask us to stop in any words, we stop straight away and keep your address on a do-not-contact list, so it is never emailed again by mistake. If you would rather we deleted even that, ask.

Most are sent through Instantly, from addresses at paintingsfromphototrade.com and getpaintingsfromphoto.com, two domains we use only for these emails; a few come from hello@paintingsfromphoto.com. Replies come straight back to us.

Cookies and tracking

We set two small preference cookies of our own, and neither tracks you. One remembers which currency to show prices in: it is set on your first visit from the country your connection comes from, or when you pick a currency at the foot of the page. The other remembers your language, when you choose one or are sent to a translated version of a page. Each holds nothing but a currency or language code and lasts a year, and we do not store the country your connection came from.

Trade account holders also get two strictly necessary cookies when they log in, pfp_trade_login and pfp_trade, described under Trade accounts.

Opening a link from one of our free restoration emails sets a strictly necessary cookie, pfp_free_restore. It holds the code from that link, so the code is never part of a page address our visitor statistics could record. It is sent only to the page that shows your restoration, no script on the page can read it, and it lasts 24 hours. The free restoration and royal portrait forms, their Start buttons, and the buttons for approving a painting also run Vercel BotID, the check from our host described above, and Vercel may use cookies or similar technology to do that. We set no cookie of our own for royal portraits.

The free restoration box that slides up on some pages uses your browser’s local storage to remember that you closed it (for 30 days) or already sent a photo, so it doesn’t ask again, and session storage so it opens at most once a visit. After you pay to unlock a free restoration, the page also uses session storage so the payment is counted in our visitor statistics only once. That is all they hold, and none of it leaves your browser.

The home, pricing and commission pages also load a small script from Stripe, our payment provider, to show whether Klarna instalments are available at that price; Stripe may use cookies or similar technology to do that. Beyond that and the advertising cookies below, nothing follows you between websites: no Google Analytics, no social network tag, no ad network, on any page.

Advertising cookies

From September 2026 we advertise on Facebook and Instagram, and we ask on your first visit whether we may use advertising cookies. This is the only thing on the site we ask about, because it is the only thing here that is not either necessary or anonymous.

If you say yes, the page loads the Meta Pixel, a script from Meta (Facebook and Instagram), and Meta may set cookies in your browser. It tells Meta the address of the page you are on, and Meta works the rest out from the request itself, which includes your IP address. We do not send it your name, email address or phone number, and we do not use it to build a profile of you here. It lets us show our paintings again to someone who has already looked, and see which of our ads brought anyone to the site.

With the same yes, when you ask for a free royal portrait we also tell Meta that a portrait was requested, and whether it is of a pet, a person or a group, so our ads can reach people likely to try it. The page sends that, and our server sends it too in case the page's message is lost; Meta counts it once. It carries only what the Meta Pixel sees anyway: the page address, your IP address, your browser and Meta's own cookie from this site. Never your email address, your name or your photograph. Without your yes, or with Global Privacy Control, neither is sent.

If you say no — or close the bar, or never answer — nothing from Meta is requested at all: the script is not loaded, not merely silenced. Your answer is kept in one first-party cookie, pfp_consent, which holds the single word granted or denied and lasts 6 months; after that we ask again. Clearing your cookies clears the answer, and we ask once more. If your browser sends the Global Privacy Control signal we treat that as a no and never ask.

Nothing else on the site depends on your answer. Prices, languages, the order forms, the free photo check and our own visitor statistics all work exactly the same either way.

Separately, the page you see after paying for a painting loads the Google Customer Reviews script, to offer the survey described above. Google may use cookies or similar technology to show that box.

How you found us

When you open one of our order forms, the page notes where your visit came from: the address of the page that linked you here, if that page was on another website; the campaign values on the link you followed, if it carried any (utm_source, utm_medium, utm_campaign, utm_term and utm_content, the ones an advert or a newsletter link adds); if you came from a Google advert, the click code Google adds to the link (gclid, gbraid or wbraid); which page of ours you were on at the time; and which page you sent the form from. That is the whole list, and none of it is read from a page on any other website. The Google click code identifies a click on an advert, not you by name. When an order that came from a Google advert is paid, we may give that code back to Google Ads, with the time and value of the order, so we can see which adverts led to a sale. No Google script runs on the site for this, and no cookie is set.

Those few values are held in your browser, in what is called session storage. It is not a cookie: only this site can read it, it is not attached to the requests your browser makes, and your browser throws it away when you close the tab. If you send us an order, a photo check, a free restoration request or a royal portrait request, they travel with it so we can tell which part of the site, or which link, brought you to us, and they are kept with that order. If you do not send one, they never leave your browser. Apart from that Google click code, we do not share them with advertisers, and no advertising network can read them.

For visitor numbers we run our own copy of Umami, an open-source analytics tool, on a server we control. It counts page views and a handful of events — a contact form sent and what it was about, a photo check sent with how many photos, a commission requested with its subject, size, how many people or pets and photos, any discount code and the total, a paid photo restoration requested with how many photos, whether colour was asked for and the total, a gift voucher requested with its size, an order from the catalogue placed with the painting, artist, size and total, an order form that failed to send and why, a checkout started, our email list joined and from which box, a trade account opened, a trade checkout started with its size, how many people or pets and total, a free restoration requested, turned away, started, previewed and unlocked, the free restoration box shown, closed or followed, and the menu opened on a phone and on which page. On the royal portrait pages it also counts a button to the form pressed and where, the form reached, the photo picker opened and from where, a photo added, the form stopped for a missing answer and which one, sent with the century and who is in it, or turned away and why, painting started, the portrait seen, the portrait shared and how, the offer to have it hand-painted followed, and a checkout started. Several of these carry the order’s reference, so we can match an event to an order. It does that without cookies and without following you to other websites, and it never receives your name, your email address or your photographs. Vercel, our host, also counts visits with its Web Analytics, which likewise sets no cookies and never receives your details.

How long we keep things

• Orders and correspondence — while the commission is live, and afterwards as accounting records, which in the UK means six years.
• Photographs — kept so the painting can be reworked or reordered, until you ask us to delete them.
• Photo checks — kept so we can pick up where we left off if you order later, until you ask us to delete them.
• Free photo restorations — if you don’t unlock the file, your photograph, the preview and the restored file are deleted 30 days after the preview, or 7 days after your start link expires if you never pressed Start. If you unlock it, they are deleted 90 days after you pay. We keep your email address and reference for 12 months so that each address gets one free restoration, or for six years if you paid, as an accounting record. The scrambled IP code goes after 30 days.
• Free royal portraits — if painting never starts, your request is deleted 30 days after you send it, but the photograph you uploaded is kept, like any upload, until you ask us to delete it. Once painting has started, whether or not a portrait comes of it, your request with the scrambled IP code, your photograph, and any portrait and card are kept until you ask us to delete them. If you pay, we keep the record for six years, as an accounting record, and a film, if one was made, is deleted 90 days after you pay. The request counts go after two days.
• Email list — until you unsubscribe. After that, only your address, marked unsubscribed with the date, so we never email you from the list again by mistake.
• Trade accounts — while the account is open, with your trade emails choice so we can show what you agreed to and when, and deleted when you ask. Orders placed through an account are kept for six years, like every order.
• Trade login links and sessions — a login link until it is used, and no longer than 24 hours (30 minutes for one you ask for); a session for 30 days, or until you log out.
• Businesses we emailed about trade prices — up to two years after our last email, unless you become a trade customer. If you ask us to stop, only your address, marked do-not-contact, so we never email you again by mistake.
• Old waitlist signups — until you ask to come off the list. Replying to any of our emails with the word “remove” is enough.
• Visitor statistics — counts of pages and events. Some can point to one person’s request: the order reference a few events carry, and the code in the web address of a royal portrait’s page. Our own copy of Umami keeps them until we clear it.

Why we are allowed to use it

Most of it is straightforward: you asked us to paint something or to answer something, and we cannot do either without your details and your photograph. Keeping order records for six years is a legal obligation — the accounting one. Running the business day to day, which includes keeping our own copy of an enquiry so it does not get lost, and counting visitors, is what the law calls a legitimate interest. A photo check is something you asked us for, and answering it needs your photo and your email address. A free restoration is something you ask for, and doing it needs your photograph and your email address. Keeping your address for 12 months so that each address gets one free restoration, and the scrambled IP code, are a legitimate interest: stopping the offer being abused. Emails about having it painted run on consent: you give it by ticking the box, and you withdraw it by unsubscribing. A royal portrait is something you ask for too, and making it needs your photograph and your email address; the request counts, the scrambled IP code, and checking that each address has one free portrait, are a legitimate interest: stopping the free offer being abused. Telling Google Ads which of its advert clicks led to a paid order is a legitimate interest too: knowing which advertising works. The old waitlist runs on consent: you give it by asking to be on the list, and you withdraw it by asking to come off. The email list runs on consent too: you give it by joining, and you withdraw it by unsubscribing. Writing to a business about trade prices is a legitimate interest, and you can object to it at any time by replying to one of those emails.

A trade account is something you ask us for as well: its login links and sessions are how it works, and the two trade cookies are strictly necessary for it. Trade emails run on consent: you give it by ticking the box, and you withdraw it by replying “unsubscribe”. Delivering a trade order to the client you name, with their name on the packing note, is a legitimate interest: getting the painting to the person you asked us to send it to.

Your rights, and how to use them

Under UK GDPR you can ask us to:

• show you what we hold about you;
• correct anything that is wrong;
• delete it, photographs included;
• stop using it, or object to one particular use of it;
• send it to you, or on to someone else, in a portable form.

One email to hello@paintingsfromphoto.com does any of these. There is no form to fill in. We will answer within a month, and normally within a day or two. If we cannot tell who is asking, we will ask you to write from the address the order came from, or the email address of your trade account.

Complaints

If you think we have handled your information badly, tell us first — it is usually something we can put right the same day. If that goes nowhere, you have the right to complain to the Information Commissioner’s Office, the UK regulator, at ico.org.uk.

How to contact us

Email hello@paintingsfromphoto.com. Enquiries, questions about this policy and data requests all go to the same address, and it reaches a person. If you would rather use a form, there is one on the contact page.