Privacy policy

Who is responsible?

Andreas Sundqvist, a sole trader using the name Angelbear, is responsible for Furistry’s processing of your personal data. Contact info@angelbear.se or write to Magasinsgatan 9D, 753 42 Uppsala, Sweden. See our company details.

What we use and why

• Creating your portrait. Your uploaded photo, chosen style, generated portrait and technical generation information are used to provide the preview and product you request. Where these are personal data, the basis is providing the service or taking steps at your request before a purchase (GDPR Article 6(1)(b)). Please use pet photos and avoid including people or sensitive information unnecessarily.
• Orders and delivery. We use your email, selected portrait, order identifiers, payment status, digital-delivery consent and, for prints, name, postal address and any supplied phone number to process your requested order and contact you about it. The basis is performance of the service or contract. Consent to immediate digital delivery concerns withdrawal rights; it is not consent to unrelated marketing.
• Security and costs. Guest identifiers, request information, timestamps, generation usage and network-derived identifiers prevent abuse, keep portraits private and enforce free-preview limits. Our legitimate interest is maintaining a secure, financially sustainable service (Article 6(1)(f)). Shared networks can share a preview allowance.
• Support and disputes. We use the information you send us to help with your order and resolve issues, based on performance of the service and our legitimate interest in handling complaints and defending legal claims. For real sales, records required by accounting or tax law will be processed under a legal obligation (Article 6(1)(c)). Test orders do not involve real payments.

Without a photo we cannot create a portrait; without an email we cannot send your private order link. A print needs a delivery address. No customer account is required.

Services involved

• OpenAI: a resized copy of your photo and generation instructions are sent to the image API to create the portrait. We do not store the uploaded source photo in our own image storage. OpenAI’s provider-side retention and account data controls are separate from our deletion schedule.
• OpenAI Sites and Cloudflare: website hosting, private image and order storage, background processing and request handling. Cloudflare Turnstile processes browser and network signals for bot protection. Infrastructure providers can process IP addresses even though our preview-allowance database does not store raw IP addresses.
• Stripe: the embedded checkout and payment status. Payment credentials are entered in Stripe’s payment fields; we do not store full card numbers or card security codes in our order database. Test mode must use test payment credentials.
• Resend: your recipient email and order-confirmation content, including the private order link, are sent to Resend for delivery.
• Gelato: when the studio explicitly creates a print draft, the print file link and delivery details are provided to Gelato. Test drafts do not authorise printing. Production orders remain disabled.
• Email support: messages sent to info@angelbear.se are handled through one.com, our mailbox provider. Its retention arrangements are being confirmed.

Providers may act as processors and, for some purposes such as payment compliance or service security, as independent controllers. We are verifying the applicable contracts and roles for our accounts.

International processing

These services operate internationally, and processing may occur outside the EU/EEA, including in the United States. We have not established that all processing is EU-only. The applicable receiving entities, processing locations, contractual safeguards and any adequacy decisions must be documented for our accounts before commercial launch. You can request information about the safeguards from info@angelbear.se.

How long we keep information

• Watermarked preview links expire after 24 hours. Expired preview files are removed by scheduled cleanup.
• Unpurchased generated portraits become eligible for deletion after 30 days.
• Paid digital portraits remain available for 90 days from delivery. They are then removed unless still needed for an ongoing print order or a held support case. Saved copies on your device are not affected.
• Private confirmation payloads and eligible print exports are cleaned up after their retention period, subject to active order and link protections. Cleanup runs hourly in batches, so removal is not necessarily at the exact expiry minute.
• The essential guest cookie lasts 30 days. Network-allowance records older than 48 hours are removed on the next allowance check.
• Order records, payment references, consent evidence, support correspondence and generation-budget records are separate from image files. They do not currently have automatic time-based deletion in the test service. Their final retention schedule, including records required for real sales, is a pre-launch requirement. Contact us to request deletion or a review.

Deleting files from our active storage does not immediately delete provider logs, backups, previously submitted print drafts or copies you downloaded. Provider-specific retention and backup expiry are being reviewed. Active disputes and orders may require continued retention for that purpose.

Cookies and private links

The secure, HTTP-only cookie “__Host-furistry-guest” separates your portraits and orders from other guests. Turnstile and Stripe also process information necessary for their security and checkout services. Our application does not include advertising trackers or an optional analytics integration; platform-level behaviour remains part of our pre-launch review.

For delivery support, we record when a verified digital download starts and the number of downloads per order. Viewing the portrait preview is not counted. These records follow the order-record retention described above.

Your order link is a private access link. Anyone who has it may view that order and download its digital portrait while the link is valid. Do not share it. Contact us if it needs to be revoked.

Your choices and rights

You may request access, correction, deletion, restriction or, where applicable, portability of your personal data. You may object to processing based on legitimate interests. These rights are subject to legal conditions; for example, we may need to retain information required by law or for a dispute. We may ask for proportionate information to verify that the request concerns your data.

Email info@angelbear.se. We normally respond within one month and will explain if a lawful extension is needed. You may complain to the Swedish supervisory authority, Integritetsskyddsmyndigheten (IMY).

Portrait generation and abuse controls are automated. Furistry does not use them to make decisions producing legal or similarly significant effects about you. Print production requires studio review.

Changes to this notice

We update this page when our processing changes. Its version and date appear above. Material changes will be communicated where required. The notice and remaining provider checks will be reviewed before real sales start.