Privacy Policy

1. Information We Collect

We collect several types of information depending on how you interact with our Site:

1.1 Photos You Upload

When you use our AI portrait generation service, you upload one or more photographs. These photos are transmitted to our servers and processed by our AI system to generate royal-style portraits. We store uploaded photos securely and use them solely for the purpose of generating your portrait(s). Photos are not shared with third parties except as necessary for AI processing (see Section 4).

1.2 Order Information

When you make a purchase, we collect information necessary to process your order, including:

• Email address (collected during Stripe checkout)
• Billing information (processed and stored by Stripe; we do not store full payment card details)
• Shipping address (for physical print and canvas orders only)
• Order details (product type, size, amount paid)

1.3 Device and Usage Information

When you visit the Site, we automatically collect certain information about your device and browsing activity, including:

• IP address and approximate geographic location
• Browser type and version, operating system
• Device type (desktop, mobile, tablet) and screen resolution
• Referring website or source
• Pages visited, time spent on pages, click behavior

1.4 Session Information

We use anonymous sessions to allow you to use the Site without creating an account. A unique session identifier is stored in a cookie on your browser and linked to your uploads, generations, and orders. No personal information is required to start a session.

2. How We Use Your Information

We use the information we collect to:

• Provide the service: Process your uploaded photos through our AI system to generate portraits, deliver digital downloads, and fulfill physical print/canvas orders.
• Process payments: Complete transactions securely through Stripe and maintain order records.
• Communicate with you: Send order confirmations, download links, shipping updates, and respond to support inquiries via email (powered by Resend).
• Improve the service: Analyse usage patterns, identify issues, and optimise the user experience using analytics tools.
• Marketing: With your consent, send promotional emails about new features, templates, or offers. You can unsubscribe at any time.
• Prevent fraud and abuse: Monitor for unauthorised access, automated abuse, or attempts to circumvent our security measures.

3. Photo Data Handling

We take the handling of your uploaded photos seriously. Here is how we treat your photo data:

• Purpose limitation: Uploaded photos are used solely for generating AI portraits. We do not use your photos for training AI models, selling to third parties, or any purpose other than fulfilling your portrait request.
• AI processing: Your photos are sent to our AI provider (Google) for portrait generation. The AI provider processes the images in real time and does not retain them after generation is complete.
• Storage: Uploaded photos are stored securely in our cloud infrastructure (Supabase Storage) with encryption at rest (AES-256), encrypted transport (TLS), and access controls. Only your session can access your uploads.
• No biometric templates: We do not extract, generate, or store face geometry, faceprints, or biometric identifier templates from uploaded photos. The AI processing is performed transiently in-memory by our AI provider on the photograph itself; no biometric data structure is retained by us or by the AI provider.
• Early deletion: You may request immediate deletion of your photos and generated portraits at any time by contacting us at hello@turnroyal.com.

3.1 Retention Schedule for Uploaded Photos

• Periodic photo deletion: uploaded photos are kept indefinitely, but may be deleted periodically.
• Immediate deletion on request: contact hello@turnroyal.com to request deletion at any time.

4. Third-Party Services

We share your information with the following third-party service providers, each for a specific purpose:

Payment Processing

• Stripe— Processes all payments. Stripe receives your email, billing details, and payment card information. Stripe's privacy policy: stripe.com/privacy

Data Storage

• Supabase — Hosts our database and file storage (uploaded photos, generated images, session data, order records). Data is stored in secure cloud infrastructure with encryption at rest.
• Vercel — Hosts our website application. Processes web requests and may log IP addresses and request metadata.

AI Processing

• OpenRouter— Primary AI provider. Processes your uploaded photos to generate AI portraits. Photos are transmitted securely and processed in real time. OpenRouter does not retain your images after processing per OpenRouter's API terms.
• Replicate— Used to upscale generated images after a purchase has been made. Replicate's privacy policy: replicate.com/privacy

Email Communications

• Resend— Sends transactional emails (order confirmations, download links) and marketing emails (with your consent). Resend receives your email address and order information. Resend's privacy policy: resend.com/legal/privacy-policy

Analytics and Tracking

• Vercel Web Analytics— Manages analytics on our Site. Vercel Web Analytics only stores anonymised data and does not use cookies, providing data for us while respecting our visitors' privacy and web experience.
• Meta Pixel — Tracks conversions and enables retargeting advertising on Meta platforms (Facebook, Instagram). Collects browsing behavior and purchase events.
• Meta Conversions API (CAPI) — In addition to the Meta Pixel, we transmit purchase confirmation and key conversion events to Meta server-side. We transmit hashed email addresses and order details for ad-attribution purposes. We do not transmit uploaded photos.
• TikTok Pixel — Tracks conversions and enables retargeting advertising on TikTok. Collects browsing behavior and purchase events.

5. Cookies and Tracking Technologies

We use cookies and similar technologies for the following purposes:

• Essential cookies: Session identifier cookie (user_id) that allows you to use the Site without creating an account. This cookie is necessary for the service to function.
• Analytics cookies: Placed by Vercel Web Analytics to collect anonymised usage data and improve the service.
• Marketing cookies: Placed by Meta Pixel and TikTok Pixel to enable targeted advertising and measure ad campaign effectiveness.

You can control cookie preferences through your browser settings. Disabling essential cookies may prevent the Site from functioning properly. Disabling analytics and marketing cookies will not affect core functionality but will limit our ability to improve the service and show you relevant advertisements.

6. Behavioral Advertising

We use your personal information to provide you with targeted advertisements or marketing communications that we believe may be of interest to you. This is done through the following mechanisms:

• Meta: We use Meta Pixel to track actions on our Site (such as viewing a preview or completing a purchase) and create custom audiences for advertising on Meta platforms.
• TikTok: We use TikTok Pixel to track actions on our Site (such as viewing a preview or completing a purchase) and create custom audiences for advertising on TikTok.

You can opt out of targeted advertising by adjusting your preferences on these platforms:

• Facebook: facebook.com/settings/?tab=ads
• TikTok: tiktok.com/setting/ad_privacy/personalized_ads
• Digital Advertising Alliance: optout.aboutads.info

7. Data Retention

We retain your data for the following periods:

• Order records: Retained for as long as necessary for accounting, tax, and legal compliance purposes (typically 7 years).
• Session data: Anonymous session records are retained indefinitely, but may be purged periodically.
• Email and marketing data: Retained until you unsubscribe or request deletion.
• Analytics data:Retained according to each analytics provider's retention policies (typically 14–26 months).

8. Your Rights

We provide these rights to every user worldwide, regardless of which country or U.S. state you live in. These commitments meet or exceed the requirements of the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and comparable privacy laws in Colorado, Connecticut, Illinois, Montana, Oregon, Texas, Utah, Virginia, Washington, the UK, Canada, and other jurisdictions:

• Right to know / access: Request information about what personal data we hold about you, including a copy of that data.
• Right to delete / erasure: Request deletion of your personal data, including uploaded photographs and generated portraits.
• Right to correct / rectification: Request correction of inaccurate personal data we hold.
• Right to data portability: Request your data in a structured, commonly used, machine-readable format.
• Right to object / restrict processing: Object to or request that we limit how we process your data, including for direct marketing.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time.
• Your photos are never sold or shared: We do not sell, lease, trade, or share your uploaded photographs or generated portraits with any third party for marketing, AI training, or commercial purposes. The only third party that ever receives your photos is the AI provider used to generate your portrait (OpenRouter and Replicate), as described in Section 4.
• No sale of personal information: We do not sell, lease, trade, or otherwise profit from your personal information.
• Limited ad-attribution sharing (with opt-out): Like most consumer websites, to measure advertising effectiveness and serve relevant ads, we transmit non-photo events (such as pageviews, purchase confirmations, and hashed email addresses) to our advertising partners (Meta, TikTok) via tools described in Section 4. You can opt out at any time using the platform opt-out links in Section 6.
• Non-discrimination: We will not deny service, change pricing, or otherwise penalise you for exercising any of these rights.
• Unsubscribe: Opt out of marketing emails using the link in any email we send, or by emailing us.

To exercise any of these rights, email hello@turnroyal.com. We respond to verifiable requests within 30 days. Residents of the EU, EEA, and UK additionally have the right to lodge a complaint with their local data protection authority.

Biometric data notice (Illinois BIPA and similar state laws):

Our AI generates royal-style portraits from photos you upload. The computer-vision processing on facial features is performed transiently and in-memory by our AI provider (OpenRouter and Replicate); we do not retain a biometric template, faceprint, or face geometry vector. Original photographs are stored only for the purposes and retention periods stated in Section 3 above, and we do not sell, lease, trade, or otherwise profit from biometric information. By uploading a photo containing a face, you acknowledge this notice and provide written consent to this processing under the Illinois Biometric Information Privacy Act (740 ILCS 14) and any comparable biometric privacy law in your state of residence (including Texas CUBI and Washington's biometric privacy statute).

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption in transit (TLS/SSL), encryption at rest for stored data, access controls on file storage, and secure handling of payment information through Stripe (PCI DSS compliant). However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

10. Children's Privacy

Our service is not directed to anyone under the age of 18. Per Section 4.1 of our Terms of Service, users must be at least 18 years of age (or the age of majority in their jurisdiction, if higher) to upload photographs or otherwise use the service. We do not knowingly collect personal information from individuals under 18. If you become aware that someone under 18 has provided us with personal data, please contact us at hello@turnroyal.com and we will take steps to delete such information. This commitment is at least as protective as the United States Children's Online Privacy Protection Act (COPPA, under 13) and Article 8 of the EU General Data Protection Regulation (GDPR, under 16).

Note that uploading photographs that depict children is separately governed by Section 4 of our Terms of Service — adult uploaders must be the parent or legal guardian of every child depicted, or have written consent from each such parent or legal guardian.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States (where some of our service providers are located). We ensure that appropriate safeguards are in place for such transfers, including Standard Contractual Clauses (SCCs) where required under GDPR.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will post the updated policy on this page with a revised “Last updated” date. We encourage you to review this page periodically. Your continued use of the Site after any changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

• Email: hello@turnroyal.com
• Website: turnroyal.com