Privacy Policy

This policy explains how EditMyPet handles personal data when you use our website, accounts, AI pet-image tools, purchases, support, galleries, contests, referrals, and related features. It is intended to meet the transparency requirements of the UK GDPR and Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, and the EU GDPR where it applies.

Data controller

EditMyPet

Email

support@editmypet.com

Our privacy contact can be reached at support@editmypet.com or through our contact form. If a data protection officer or representative is appointed or legally required, we will publish their contact details here.

• Account and profile: email, user ID, sign-in provider, display name, avatar, preferences, privacy choices, and saved-pet settings.
• Content: uploaded photos, prompts, selected styles and accessories, generated images, favourites, public/private choice, and file metadata.
• Generation records: job IDs, model and style configuration, token cost, timestamps, errors, logs, flags, review notes, and outcomes.
• Purchases: products, prices, currency, billing country, payment-provider customer, session and transaction references, invoices, token grants and allocations, subscription status, refunds, and disputes. Our payment provider receives payment credentials directly.
• Community and rewards: contest entries, public submissions, votes, ranks, referral codes and relationships, reward eligibility, and anti-abuse records.
• Support: name, email, subject, message, attachments or details you provide, and our response and internal review record.
• Technical and security: IP address, coarse IP-derived location, browser, device, pages and features used, timestamps, diagnostic events, security logs, rate-limit and CAPTCHA signals.
• Consent and communications: cookie choices, marketing preference, email delivery status, suppression events, and service-message history.

Photos may incidentally contain a person, home interior, location clue, or embedded metadata. Please crop or remove information that is not needed and do not upload special-category data or another person's image unless you have a lawful reason and their permission.

Our legitimate interests include delivering a reliable product, understanding and fixing failures, securing accounts and infrastructure, preventing fraud and reward manipulation, handling complaints, and establishing or defending legal claims. We balance those interests against your rights and reasonable expectations. Where we rely on consent, you may withdraw it without affecting earlier lawful processing.

Account, generation, and purchase information marked as required is necessary to enter into or perform our contract with you. Without it, we may be unable to create an account, generate an image, fulfil a purchase, or provide the requested feature. Public sharing, optional profile information, marketing, and non-essential analytics are optional.

6. Uploaded Photos and AI Processing

To generate an image, we create a protected temporary working copy of your source photo and make it available to the generation workflow for a limited time. The source image, prompt, chosen styles, and necessary instructions are sent to our AI generation provider. Temporary working files are queued for deletion after a job completes or fails and the short operational-recovery period ends. A failed cleanup may be retried.

Generated results and their metadata are stored in your account so you can view, download, flag, or delete them. Owner-only media is kept in private storage and accessed using time-limited links. If you opt into a gallery, contest, or other public feature, a public derivative and the associated public profile information may be displayed until removed under that feature's rules.

7. Who Receives Personal Data

We use carefully selected service providers acting for us or providing an integrated service. Depending on the features you use, the relevant categories include:

• Cloud infrastructure providers for hosting, databases, account authentication, media storage, content delivery, queues, caching, and operational reliability;
• AI processing providers that receive the source image, prompt, selected options, and necessary instructions to generate your requested result;
• Payment and billing providers for checkout, payment credentials, subscriptions, fraud prevention, refunds, and disputes;
• Security providers for CAPTCHA, rate limiting, abuse prevention, and service protection;
• Communications providers for transactional and service email delivery, delivery status, and suppression handling;
• Consent and analytics providers for recording privacy choices and, only with the required consent, understanding product use and performance; and
• Content-management providers for publishing public editorial and help content.

We may also disclose data to professional advisers, insurers, courts, regulators, law enforcement, or a buyer or successor where reasonably necessary and lawful. Public content is shared with visitors by your choice. We do not sell personal data for money. You may contact us for more information about a relevant provider or the safeguards applying to your data.

9. How Long We Keep Data

We keep data only for as long as needed for the purpose collected, taking account of account status, feature operation, user choices, legal duties, security, disputes, and limitation periods. Our current retention approach is:

• Temporary generation uploads: until the generation and short recovery window finish, then queued for deletion; failed cleanups are retried.
• Account and private generated content: while your account or saved content remains active, then deleted or anonymised when no longer needed, subject to backups and legal holds.
• Public submissions: while public or needed to administer the feature, plus a reasonable period for cached copies, moderation, disputes, and integrity records.
• Payment, refund, and token-ledger records: generally for up to seven years after the relevant transaction or relationship, where needed for tax, accounting, fraud, disputes, and legal claims.
• Support, moderation, and complaint records: for the time needed to resolve the matter and normally up to three years afterwards, longer if a claim or legal duty requires it.
• Security and technical logs: for a shorter operational period unless an event must be investigated, preserved as evidence, or retained by a provider's documented schedule.
• Consent records: for as long as needed to demonstrate and honour your choice and resolve related complaints.

Deletion from live systems may not immediately remove encrypted backup copies. Backups are protected, rotate on a limited schedule, and are not used for ordinary product activity.

11. Your Data-Protection Rights

Depending on the law and processing, you may ask us to access, correct, erase, restrict, or provide a portable copy of your personal data. You may withdraw consent and may object to processing based on legitimate interests or to direct marketing. Some rights have exceptions, for example where records must be retained by law or are needed for legal claims.

Send a request using our contact form or email, preferably from your account address. We may ask for proportionate proof of identity. We normally respond without undue delay and within one month; the law allows an extension for a complex or numerous request, in which case we will explain it. Rights requests are normally free.

13. Privacy Complaints

To complain about our use of personal data, use the contact form with the subject "Data protection complaint" or email us. Explain what happened, the relevant account or feature, and the outcome you seek. We will acknowledge a data-protection complaint within 30 days, investigate it appropriately, keep you informed where needed, and communicate an outcome without undue delay.

You may also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, by telephone on 0303 123 1113, or by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. If the EU GDPR applies, you may complain to the supervisory authority where you live, work, or believe an infringement occurred. We ask that you contact us first, but you do not have to.

14. Children

EditMyPet is not for children under 13. Users under 18 should involve a parent or guardian, especially before a purchase or public submission. We aim to use privacy-protective defaults, make public sharing a choice, avoid behavioural advertising to known children, and collect no more data than the feature needs. Parents, guardians, and children can contact us about an account or privacy concern. If we learn that an under-13 has provided data without appropriate authority, we will investigate and delete it where required.