Privacy Policy

We collect only what we need to run your account and generate your caricatures:

• Account details. Your name, email address, and a one-way hash of your password. We never store your password itself and cannot read it.
• Photographs you upload. Used solely to generate the caricature you requested. See section 3 for how long we keep them.
• Generation details. The options you selected and any notes you wrote, together with the resulting artwork.
• Credit and payment records. Your credit balance and history, and — from PayPal — confirmation of payment, the amount, and the email address associated with your PayPal account. We never receive or store your card number.
• Technical data. Your IP address, browser type and the pages you visit, used to keep the site secure and to apply rate limits.

We use your information to create and deliver your caricatures, to run your account and credit balance, to process payments, to send you transactional email (verification codes, receipts and service notices), to detect and prevent fraud and abuse, and to comply with our legal obligations.

Where the law requires a legal basis, ours is the performance of our contract with you for the Services, our legitimate interest in securing and improving them, and your consent where we ask for it.

We do not sell your personal information, and we do not use it for advertising or profiling.

This is the part that matters most, so we will be plain about it.

When you generate a caricature, your photograph is transmitted to Google's Gemini image generation API, our AI provider, together with a text description built from the options you chose. Google processes the image in order to return generated artwork, and its handling of that data is governed by its own terms and privacy policy. We send only the photograph and the prompt — never your name, email address or payment details.

Before your photograph is sent anywhere, we strip its metadata. The image is decoded and re-encoded on our server, which removes EXIF data including GPS coordinates, the camera and device identifiers, and the original timestamp.

We do not use your photographs or your artwork to train AI models, and we do not permit our provider to use them for training under the API terms we operate on.

Uploaded photographs are retained for 365 days and then deleted. Generated artwork stays in your gallery until you delete it or close your account, so that you can download it again.

We share personal information only with the service providers we need to operate, and only to the extent each one needs:

• Google (Gemini API) — receives your uploaded photograph and the generation prompt.
• PayPal — handles your payment and receives what it needs to take it. We receive back only a confirmation and basic transaction details.
• Our email provider — receives your email address and the content of transactional messages we send you.
• Our hosting provider — stores the data described in this Policy on our behalf.

We may also disclose information where we are legally required to, or to protect our rights, safety or property. If our business is sold or merged, account data may transfer to the buyer, who will remain bound by this Policy.

We are established in the United States, and our providers may process data in the United States and elsewhere. Where we transfer personal data out of the European Economic Area or the United Kingdom, we rely on the European Commission's Standard Contractual Clauses or an equivalent lawful mechanism.

The site is served over HTTPS. Passwords are stored using a modern one-way hashing algorithm. Uploaded photographs and generated artwork are stored outside the web root and are served only to the account that owns them, through an authenticated route — they are not reachable by guessing a URL. Access to production systems is limited to those who need it.

No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your personal data and creates a risk to you, we will notify you and the relevant regulator as the law requires.

Depending on where you live, you may have the right to access the personal information we hold about you, to correct it, to delete it, to restrict or object to our processing, to receive it in a portable format, and to withdraw consent where we relied on it. If you are in California, you also have the right not to be discriminated against for exercising these rights.

You can update your name and password in your account settings at any time. For anything else, email contact@cactuspaints.com and we will respond within 30 days.

Deleting your account deletes your photographs, artwork and credit balance. We retain payment records for as long as tax and accounting law requires.

We use one strictly necessary cookie: a session cookie that keeps you signed in. It contains a random session identifier and nothing else, it is marked HttpOnly and SameSite, and it expires when you close your browser or sign out.

We do not use advertising, analytics or tracking cookies, so there is no cookie banner to click through.

The Services are not directed to children, and you must be 18 or older to hold an account. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

We may update this Policy. The "last updated" date above always reflects the current version. If a change materially affects how we handle your personal information, we will notify account holders by email before it takes effect.

CACTUS PAL LLC, trading as CACTUSPAINTS
8206 Louisiana Blvd Ne, Ste A Albuquerque NM 87113, United States
contact@cactuspaints.com