Privacy Policy
Last updated 16 October 2026
Draft for legal review. Highlighted notes mark points a lawyer must confirm; they disappear once review is complete.
This policy explains what personal data Whisker & Oil collects when you use this website, why, who we share it with and how long we keep it. We have tried to keep it short and specific: we only need a photo of your pet, an email address and, if you buy, your order details.
Who we are
Whisker & Oil is run by [Company legal name] Limited, a company registered in Ireland (company number [CRO number]), [Registered office address], Ireland. We are the controller of the personal data described here. Contact us about privacy at privacy@[domain].
Legal review: Confirm whether a UK GDPR Article 27 representative is still required for UK visitors; if so, name them here. A data protection officer is not required for a business of this size and type.What we collect and why
| Data | Why we use it | Legal basis (EU/UK) |
|---|---|---|
| The photo you upload and the portraits we generate from it | To create your previews and, if you buy, your full-resolution portraits | Contract (providing the service you asked for) |
| Your email address | To show you your previews, send you a link to them and deliver your order | Contract |
| Marketing emails, only if you tick the box | Occasional news and offers. You can unsubscribe from any email. | Consent |
| Order details: what you bought, price, currency, country, time of purchase | To deliver your order, handle redo and refund requests, and keep business records | Contract; legal obligation (accounting and tax records) |
| Technical data: a salted, one-way hash of your IP address, browser type, the pages you visit, and a session cookie | To keep the site working, prevent abuse (rate limits, bot checks) and cap our costs | Legitimate interests (security and fraud prevention) |
| Campaign information: which ad or link brought you here (UTM parameters), at campaign level only | To understand which campaigns work, in our own records | Legitimate interests |
| Advertising identifiers and events (see Cookies) | To measure which Meta and TikTok ads lead to visits and purchases | Consent (EU, EEA, UK, Switzerland); opt-out elsewhere |
Please upload photos of your pet. If a photo happens to include a person, we process it only to make your portrait (the person is not kept in the result) and delete it on the same schedule as every other upload. We remove location and camera metadata from every photo when you upload it.
We do not use your pet's photo or portraits in our advertising unless you separately and explicitly agree to it. That permission is never pre-ticked.
Who we share it with
We use these service providers. Each processes data only for the purpose listed.
- Railway (hosting and database, EU region, Amsterdam) and Cloudflare (image storage in the EU, bot protection with Turnstile, transactional email, network delivery).
- OpenAI generates the portraits from your photo. Under its API terms, data sent through the API is not used to train its models.Legal review: Confirm the production contract is OpenAI's API directly (or another provider with a DPA in place), that its data processing addendum is signed, and the retention period on their side. The current development gateway must not be used for customer photos.
- Stripe processes payments. For our digital products Stripe acts as the reseller and merchant of record, so it is an independent controller of the payment data it collects (card details, billing address, tax information) under its own privacy policy. We never see your full card number.Legal review: Confirm the Stripe Managed Payments role description and link Stripe's privacy notice.
- Meta (Facebook and Instagram ads) and TikTok, only with your consent in the EU, EEA, UK and Switzerland, or unless you opt out elsewhere. They receive the events listed under Cookies and, for matching, a hashed (unreadable) form of your email address, your IP address and browser type. Meta and TikTok act as joint controllers with us for this collection and as independent controllers for what they do with it afterwards.Legal review: Check joint-controller wording against the current Meta Business Tools Terms (with the Controller Addendum) and TikTok's Business Products (Data) Terms.
We do not sell personal data for money. We share it with authorities only when the law requires it.
International transfers
We keep our database and image storage in the EU. Some providers above (OpenAI, Stripe, Meta, TikTok, Cloudflare) may process data in the United States or other countries. Where they do, the transfer relies on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses (and the UK addendum for UK data).
Legal review: Confirm each provider's transfer mechanism and DPF certification status at launch.How long we keep it
- Uploaded photos and watermarked previews: deleted 30 days after upload.
- Purchased full-resolution portraits: the download link works for 30 days after purchase; we then delete the files. Please save them to your device.
- Visits that never become an order (session, email address): deleted after 30 days.
- Order records: kept for six years after the end of the financial year of the order, as Irish tax law requires.
- Marketing list: until you unsubscribe.
- Our own event log (no names, emails or IP addresses): 26 months.
Cookies and similar technologies
We use a small number of cookies. The essential ones keep the site working and need no consent. The advertising ones are off until you accept them if you are in the EU, EEA, UK or Switzerland; elsewhere they are on unless you opt out. You can change your choice at any time with Cookie settings (or, in the US, Do Not Sell or Share My Personal Information) at the bottom of every page.
| Name | Set by | Purpose | Kept for |
|---|---|---|---|
| wo_sid | Us (essential) | Links your upload, previews and order to your browser | 30 days |
| wo_consent | Us (essential) | Remembers your cookie choice | 6 months |
| Turnstile | Cloudflare (essential) | Checks that uploads come from a person, not a bot | Session |
| wo_landing (browser session storage) | Us (essential) | Remembers which campaign link you arrived from, for this tab only | Until you close the tab |
| _fbp, _fbc | Meta (advertising) | Measures visits and purchases from Meta ads | 90 days |
| _ttp, wo_ttclid | TikTok, us (advertising) | Measures visits and purchases from TikTok ads | Up to 13 months |
With advertising cookies on, we tell Meta and TikTok when you view a page, choose a style, enter your email and start or complete a purchase. We send these events from your browser and from our server with the same event ID so each is counted once. With them off, nothing is sent to either platform, from your browser or from our server.
Legal review: Verify the TikTok cookie lifetimes against TikTok's current cookie documentation.Your rights (EU, EEA and UK)
You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable format. Where we rely on consent you can withdraw it at any time, which does not affect what we did before. Email privacy@[domain]; we reply within one month.
You can also complain to a supervisory authority: in Ireland the Data Protection Commission (dataprotection.ie), in the UK the Information Commissioner's Office (ico.org.uk), or the authority where you live. We would appreciate the chance to sort it out with you first.
Your rights (United States)
Depending on your state, you may have the right to know what personal information we collect, to access, correct or delete it, and to opt out of its “sale” or “sharing” for cross-context behavioural advertising. We do not sell personal information for money. Sending advertising events to Meta and TikTok may count as “sharing”; use Do Not Sell or Share My Personal Information at the bottom of any page to opt out. We treat a Global Privacy Control signal from your browser as an opt-out automatically. We will not treat you differently for using these rights. Contact privacy@[domain] for the other requests.
Categories collected in the last 12 months: identifiers (email address, hashed IP address, advertising cookie IDs), commercial information (orders), internet activity (pages and events on this site), and the photos you upload. Sources, purposes and recipients are described above.
Legal review: Check whether any US state threshold (California CCPA/CPRA, others) applies at launch volumes; the notice above is written to satisfy them if it does.Children
This site is not intended for children under 16 and we do not knowingly collect their data.
AI-generated content
Portraits are generated by an AI image model from your photo. Generated images may carry a machine-readable mark from the model provider indicating that they are AI-generated.
Changes
If we change this policy we will update the date at the top. Significant changes will be highlighted on the site. See also our Terms and Refunds and redo policy.