Privacy Policy

The short version

• Your uploaded photo is deleted within 24 hours.
• Your looks are deleted 30 days after they are made.
• We don't use your photos or looks to train AI, and we don't sell your data.
• No ads and no analytics trackers.
• You can delete your account and everything in it on the Your looks page.

What we collect

• Your photo. On upload we remove its metadata (such as location) and resize it. The file as you sent it is deleted right after that.
• What we read from the photo and what you type: species, a breed guess, coat, build and size estimate, and your pet's name and weight if you give them. If a person is in the photo, we note where their face is so we can pixelate it.
• Your looks: the pictures we make, the products in them and any share links.
• Account details: your email address (if you sign in or buy), language, credits, and the country your connection comes from (used to pick language, currency and payment options).
• Session data: a session cookie, and for each session the browser type (user agent) and when it was last used.
• Purchases: pack, amount, currency, date and status, the email you give for the receipt, and the payment notices Polar or Latpeed send us, which can include your name, email and billing details.
• Network (IP) address, to enforce limits and stop abuse. See below for how briefly we keep it.
• Emails you send us.

How we use it

• To run the service: read your photo, recommend products, make and deliver your looks, sign you in, add your credits and send receipts.
• To email you: sign-in links, receipts and "your look is ready" messages. We send no newsletters or marketing.
• To keep the service fair and safe: free-preview limits, request limits and a human check.
• For accounting and tax.

We use your data to provide the service you ask for, and where needed for our legitimate interest in preventing abuse and for our legal duties (accounting and tax).

People in photos

Pawlooks is for pets. If a person is in the frame, the first analysis step sees the photo as uploaded and marks where faces are. We then pixelate those faces before the photo is edited, used in a share template, or shown on a share page.

How long we keep it

• Uploaded photo: deleted within 24 hours of upload. An upload that never finished is deleted within 24 hours too.
• Looks and their share templates: deleted 30 days after the look is made. A share template that shows your original photo goes when the photo goes.
• Try-ons made through a shop's widget: result deleted after 7 days, the rest after 8 days.
• Network addresses: stored with free previews and with each look, deleted within 3 days (after 48 hours, by a nightly job). Stored with a sign-in link request, deleted within 3 days after the link expires. Hourly request counters are deleted after about 2 hours, and at the latest within a day.
• Sessions: deleted 90 days after the browser last used them.
• Browser-only accounts (no email): an empty one is deleted after 2 days. One whose session has expired is deleted once it holds no purchases and no files.
• The record of each look (date, products, status), your pet's description, your email and credits: kept until you delete your account.
• Orders and the payment notices Polar and Latpeed send us: kept for 5 years, as Korean e-commerce law requires for payment records, then deleted. This continues after you delete your account, but we then keep only what that law needs (pack, amount, dates, status and the payment reference) and remove your email, name, phone and address.
• Server logs: kept by our hosting providers for up to 30 days. They can include network addresses.

Deleting a file removes it from our storage; deleting a record removes it from our database. Deleted records can stay in our database host's encrypted backups for up to 30 days until those are overwritten.

Who processes data for us

These providers run parts of Pawlooks for us. Each gets only what its task needs.

• Google (Gemini API): reads the photo, edits it and checks the result. Gets the photo, product images and your pet's description; for an HD version, the look instead of the photo.
• fal.ai (FLUX): backup image editing when Gemini fails. Gets the same inputs as Gemini's editing step.
• Polar: payments outside Korea, as merchant of record. Gets what you enter at checkout and, if we have it, your email.
• Latpeed: payments in Korea. Gets what you enter on its payment page.
• Resend: sends our emails. Gets your email address and the message.
• Sentry: error reports from our server and this site, so we can fix what breaks. Before a report leaves, we remove network addresses, cookies, request contents and email addresses.
• Cloudflare: sits in front of this website (sees your network address and country, to deliver pages and block attacks), stores photos and looks (R2) and runs the human check (Turnstile). Turnstile gets your network address and signals from your browser.
• Fly.io: runs this website, our server and our database (Fly Postgres) in Tokyo, Japan.

Most of these companies are based in the United States, and our server and database run in Japan, so your data may be processed outside your country. It always travels encrypted, and our providers' data processing terms (including standard contractual clauses where the GDPR asks for them) cover these transfers.

The AI providers get your photo only to return the result to us, under their API terms for paying business customers. We don't use your photos or looks to train AI models, and we don't sell your data or share it with advertisers.

Cookies and browser storage

• pl_sid: your session (signed in or not), which holds your looks and credits on this browser. Needed for the service. Lasts 90 days after your last visit.
• pl_locale: remembers your language for a year.
• In your browser's own storage we keep a reference to the last look you started, so a reload doesn't lose it (ignored after 6 hours), and during a checkout the order you are paying for (until you close the tab).
• Cloudflare Turnstile runs when you upload a photo, ask for a sign-in link or give an email at Korean checkout, to check you're human.

We use no advertising or analytics cookies. If you block the pl_sid cookie, the service can't work.

Try-on widget on shop websites

Some shops show our try-on on their product pages. For those try-ons:

• the shopper's photo is deleted within 24 hours and the result after 7 days;
• no account is created and no email is asked for;
• we don't store the shopper's network address with the try-on; it is used only for the hourly request counter (deleted after about 2 hours) and the human check;
• of the page the widget runs on, we keep only the shop's address (like https://shop.example), not the full page link.

Your rights

You can see your looks and credits on the Your looks page and delete your account there ("Delete my account and all photos"). This removes your photos, looks, pet details, credits and sessions right away, and turns off your share links. Order and payment records stay for the 5 years the law requires, with your personal details removed.

To see, correct or export your data, or to object to how we use it, write to [email protected]. We reply within 10 days.

If you live in the EU or the UK, you can also complain to your data protection authority. In Korea, you can contact the Personal Information Infringement Report Center (118, privacy.kisa.or.kr) or the Personal Information Dispute Mediation Committee (1833-6972, kopico.go.kr).

Security

All traffic is encrypted (HTTPS). We store session and sign-in tokens only in hashed form. Photos and looks are private files, opened through short-lived signed links. A look becomes public only if you make a share link.

Children

Pawlooks isn't meant for children under 14. If you are under 14, please don't add an email or buy a pack. If we learn that a child under 14 gave us personal details without a guardian's consent, we delete them.

Contact and changes

Privacy questions: [email protected]. Our privacy officer is the operator of Pawlooks, reachable at the same address.

If we change this policy, we update the date at the top and announce important changes on the site at least 7 days before they apply.