Privacy
& Data.

Last updated · May 2026

This policy explains what personal data Olea & Hound collects, why we collect it, how long we keep it, and what rights you have under the EU General Data Protection Regulation (GDPR). We collect the minimum data needed to run this service. We do not sell data. We do not share it with advertisers. Full stop.

Who we are

Olea & Hound is a trading name of the legal entity registered in Malta (Co. C 102212 · VAT MT29182301). For all data-protection matters we are the data controller.

Contact: [email protected]
We respond to all data requests within 30 days.

What data we collect and why

Your pet photograph

When you upload a photo, it is sent to Google's Gemini API to generate fine-art portrait previews. The photograph is transmitted over an encrypted connection (HTTPS/TLS). We do not permanently store your original photo on our servers - it is held in memory only for the duration of the generation request, then discarded.

Generated portrait previews

The six AI-rendered portrait previews we generate for you are stored on Cloudflare R2 (encrypted object storage) for up to 30 days, so you can return to a saved session from the same browser. After 30 days they are automatically and permanently deleted.

If you purchase, your high-resolution digital file is stored for 12 months and accessible via the signed download link in your confirmation email. After 12 months the file is deleted.

Email address

We collect your email address at checkout to deliver your digital file and order confirmation. We will only email you about your order unless you explicitly opt in to marketing. You can unsubscribe from any marketing email at any time via the link at the bottom of each message.

Payment details

All payment processing is handled by Mollie B.V., a Netherlands-based payment institution regulated under PSD2 (licence DNB). We never see, receive, or store your card number, CVV, or bank account details. Your payment data is governed by Mollie's privacy policy.

IP address

Your IP address is logged by Cloudflare (our hosting and security provider) as part of normal server operation, and is used by our rate-limiting system to prevent abuse and protect service availability for all users. IP logs are retained for a maximum of 7 days before automatic deletion.

Order metadata

When you place an order we store: your chosen portrait style, the pet name you provide (if any), and your Mollie payment reference (a reference number, not payment data). This is retained for 7 years for accounting and legal compliance purposes.

Cookies & analytics

We use three categories of cookies and tracking. When you first visit we ask you to choose what you're comfortable with. You can change your choice at any time by appending ?consent=reset to any URL on this site.

• Essential (always on). Session state, rate-limit tokens, and Cloudflare Turnstile (bot protection). These are strictly necessary to operate the service. No consent required under GDPR.
• Measurement (opt-in). We use Google Analytics 4 to understand how visitors use the site - which pages help, which confuse, and which styles are most popular. Data is anonymised (IP anonymisation enabled; no cross-site tracking). GA4 data is retained for 14 months in Google's systems.
• Marketing (opt-in). With your consent we load the Meta Pixel and Google Ads conversion tags. These allow us to show our portraits to people who might love them, and to measure which ads are working. Without your consent neither tag fires.

Third-party processors

The following sub-processors may handle personal data as part of our service:

• Google LLC - Gemini API (portrait generation), Google Analytics 4
• Mollie B.V. - Payment processing
• Cloudflare, Inc. - Hosting, CDN, R2 storage, KV, Turnstile bot protection
• Meta Platforms, Inc. - Advertising pixel (consent-gated)
• Resend, Inc. - Transactional email delivery (order confirmations)

All sub-processors are bound by data processing agreements and operate under adequacy decisions or Standard Contractual Clauses (SCCs) where required by GDPR for transfers outside the EEA.

Legal basis for processing

• Contract performance - processing your photo and delivering your order.
• Legitimate interests - IP rate limiting and fraud prevention.
• Legal obligation - retaining order records for tax and accounting purposes.
• Consent - analytics and marketing cookies (consent-gated as described above).

Data retention summary

• Original uploaded photograph - not stored (in-memory only during generation)
• Generated portrait previews - 30 days, then auto-deleted
• Purchased high-res digital file - 12 months, then auto-deleted
• Order records (email, style, payment reference) - 7 years (legal obligation)
• IP rate-limit logs - 7 days
• Analytics data (GA4) - 14 months in Google's systems

Your rights under GDPR

If you are in the UK or EU, you have the following rights:

• Access - request a copy of the personal data we hold about you.
• Rectification - ask us to correct inaccurate data.
• Erasure - ask us to delete your data, subject to legal retention obligations.
• Portability - receive your data in a structured, machine-readable format.
• Objection - object to processing based on legitimate interests.
• Withdraw consent - withdraw analytics or marketing consent at any time via ?consent=reset.
• Restriction - ask us to restrict processing while a dispute is resolved.

To exercise any of these rights, email [email protected] with the subject line "Data request". We will respond within 30 days. There is no charge.

If you believe we have handled your data unlawfully, you have the right to lodge a complaint with the Information and Data Protection Commissioner (IDPC), Malta's supervisory authority: idpc.org.mt.

Children

This service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has submitted data to us, contact us and we will delete it promptly.

Changes to this policy

We may update this policy when our service changes. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be announced via email to customers who have placed orders.

Contact

Olea & Hound · Malta, EU
[email protected]
We reply within one business day, Monday through Friday.