Privacy policy

Paintings From Photo runs this website and decides what happens to the information on it, which makes us the data controller for everything described below. Your details exist here for two reasons: so we can paint your painting, and so we can write back to you. There is no third reason.

What we collect, and when

When you request a commission

Your name, your email address, a phone number if you choose to give one, the photographs you upload, and the details of the painting: the subject, how many people or pets are in it, the canvas size, anything you tell us about the occasion, and a discount code if you use one. We also record which page you started from and how you found us, described under How you found us below, so we can see which parts of the site are doing their job.

When you order a painting from the catalogue

Your name, your email address, an optional phone number, which painting you want, the size, and any notes you add. As with a commission, we record how you found us alongside it.

When you use the contact form

Your name, your email address, an optional phone number, what the enquiry is about, and your message.

When you join the waitlist

Your email address, and which page you signed up from.

What we do not ask for

No delivery address and no payment details. Nothing is charged when you send the form — we look at your photograph, reply within one working day with an honest read on it, and send a payment link once you are happy with the plan. Your card details never pass through this website. There is no account to open and no password to set.

One technical exception: photo uploads are rate-limited by IP address, so the upload form cannot be used as free file hosting. That count is held in memory for a minute and then gone. It is not written to the database and it is not tied to your order.

The photographs you send us

Your photographs are stored for us by Cloudinary. Each one is given a long, random web address that is not listed or linked anywhere public — but anyone who has that address can open the photograph, so treat it as unlisted rather than secret. The same links appear in the confirmation email we send you and in the notification that reaches us.

To paint from a photograph, the photograph has to reach the person painting it, and our studio is outside the UK. So your photograph and the brief for the painting go to the artist who paints it.

We keep photographs afterwards so a painting can be reworked or painted again — a second copy for a family member, or a replacement if something happens to the first. If you would rather we did not, ask and we will delete them.

We do not publish your photograph, or the painting made from it, anywhere without asking you first.

Who else handles your information

Four suppliers, each doing one job:

• Cloudinary — stores the photographs you upload.
• Vercel — hosts the website, and like any host keeps ordinary request logs.
• Google — our email. Anything you write to us, and every confirmation we send, sits in a Google mailbox.
• Our own database and internal admin system, on a server we run — every order and enquiry is saved there, and it is what we work from when we reply.

They are suppliers, not partners: they hold your information to do a job for us and nothing else. Some of them are based outside the UK, so your information may be processed outside the UK. We do not sell personal data, and we do not share it with anyone for marketing.

Cookies and tracking

This site sets no cookies. There is no cookie banner because there are no cookies to ask you about, and nothing following you between websites: no Google Analytics, no advertising pixel, no social network tag, no ad network, on any page.

How you found us

When you open one of our order forms, the page notes where your visit came from: the address of the page that linked you here, if that page was on another website; the campaign values on the link you followed, if it carried any (utm_source, utm_medium, utm_campaign, utm_term and utm_content, the ones an advert or a newsletter link adds); which page of ours you were on at the time; and which page you sent the form from. That is the whole list. There is no identifier for you in it, and none of it is read from a page on any other website.

Those few values are held in your browser, in what is called session storage. It is not a cookie: only this site can read it, it is not attached to the requests your browser makes, and your browser throws it away when you close the tab. If you send us an order, they travel with it so we can tell which part of the site, or which link, brought you to us, and they are kept with that order. If you do not send one, they never leave your browser. We do not share them with advertisers, and no advertising network can read them.

For visitor numbers we run our own copy of Umami, an open-source analytics tool, on a server we control. It counts page views and a handful of events — a contact form sent, a commission requested with its size and total, an order placed. It does that without cookies and without following you to other websites, and it never receives your name, your email address or your photographs.

How long we keep things

• Orders and correspondence — while the commission is live, and afterwards as accounting records, which in the UK means six years.
• Photographs — kept so the painting can be reworked or reordered, until you ask us to delete them.
• Waitlist signups — until you ask to come off the list. Replying to any of our emails with the word “remove” is enough.
• Visitor statistics — counts of pages and events, with no record of an individual attached to them.

Why we are allowed to use it

Most of it is straightforward: you asked us to paint something or to answer something, and we cannot do either without your details and your photograph. Keeping order records for six years is a legal obligation — the accounting one. Running the business day to day, which includes keeping our own copy of an enquiry so it does not get lost, and counting visitors, is what the law calls a legitimate interest. The waitlist runs on consent: you give it by asking to be on the list, and you withdraw it by asking to come off.

Your rights, and how to use them

Under UK GDPR you can ask us to:

• show you what we hold about you;
• correct anything that is wrong;
• delete it, photographs included;
• stop using it, or object to one particular use of it;
• send it to you, or on to someone else, in a portable form.

One email to hello@paintingsfromphoto.com does any of these. There is no form to fill in. We will answer within a month, and normally within a day or two. If we cannot tell who is asking, we will ask you to write from the address the order came from.

Complaints

If you think we have handled your information badly, tell us first — it is usually something we can put right the same day. If that goes nowhere, you have the right to complain to the Information Commissioner’s Office, the UK regulator, at ico.org.uk.

How to contact us

Email hello@paintingsfromphoto.com. Enquiries, questions about this policy and data requests all go to the same address, and it reaches a person. If you would rather use a form, there is one on the contact page.