The short version: We collect only what we need to process your order, generate your caricature, deliver it by email, prevent abuse, and meet legal obligations. Your original photo and generated caricature are deleted after 72 hours. We never sell your data, and Stripe handles payments so we never see your card details.
Caricature.online is an AI-powered caricature e-commerce service. When this policy says “we”, “us” or “our”, it refers to the operator of caricature.online, acting as the data controller for the personal data described in this policy.
Privacy contact: privacy@caricature.online
Support contact: support@caricature.online
| Data | When collected | Why |
|---|---|---|
| Email address | Checkout, support, review forms | To deliver your caricature, send receipts, support your order, and send review/free-order links where applicable |
| Full name | Checkout | To personalise order records, emails and customer support |
| Uploaded photo(s) | Order flow | To assess photo quality, generate the caricature, prevent abuse, and deliver the result |
| Personalisation answers | Order flow | To adapt the caricature to your selected theme, occasion and preferences |
| Free-text description and notes | Order flow | To generate custom scenes and check requests against our content safety rules |
| Order ID, template, plan and price | Checkout and order processing | To fulfil the contract, provide support, prevent fraud and keep accounting records |
| Review feedback and ratings | Optional review form | To improve service quality and issue free-caricature tokens when offered |
| Data | Source | Why |
|---|---|---|
| IP address and request metadata | Server logs | Security, abuse prevention, debugging and fraud prevention |
| Browser and device type | Server logs | To ensure the site works correctly across devices |
| Pages visited, time on site and referral source | Analytics tools, only where enabled | To improve the website and understand performance, subject to cookie choices where required |
| Cookie preferences | Browser localStorage | To remember your consent choices |
Payments are processed by Stripe. We do not receive, process or store your full card number, CVV or banking credentials. We store only payment references such as the Stripe PaymentIntent ID, amount, currency and payment status, because these are needed for order fulfilment, support, refunds and accounting.
We do not sell your personal data. We do not use your uploaded photo to train our own AI models. We do not intentionally publish your uploaded photo or generated caricature without your permission.
Caricature.online uses AI services to help assess uploaded photos, create generation prompts and produce caricature images. This means your uploaded photo and order instructions may be processed automatically by our systems and by selected AI processors strictly for the purpose of fulfilling your order and maintaining platform safety.
We may refuse, cancel or refund orders that violate our Terms and Conditions or content safety rules. Where possible, moderation decisions are based on the minimum information needed to detect abuse. We may store a short moderation record, such as the order ID, moderation category, timestamp and blocked reason, for security and dispute-resolution purposes.
Important: Safety checks are designed to protect people and the platform. They are not used to profile you, make unrelated decisions about you, or sell advertising data.
| Processing activity | Legal basis |
|---|---|
| Generating and delivering your caricature | Contract performance — Art. 6(1)(b) |
| Sending order, delivery, receipt and support emails | Contract performance — Art. 6(1)(b) |
| Processing payments and refunds | Contract performance — Art. 6(1)(b); Legal obligation — Art. 6(1)(c) |
| Photo quality assessment and AI prompt generation | Contract performance — Art. 6(1)(b) |
| Content safety checks, abuse prevention and fraud prevention | Legitimate interests — Art. 6(1)(f) |
| Keeping accounting records | Legal obligation — Art. 6(1)(c) |
| Optional analytics and marketing/referral tracking | Consent — Art. 6(1)(a), where required |
| Review feedback and optional promotional/free-order token | Consent or legitimate interests depending on the context |
Your photo is the most sensitive data we handle. We use it only to process your order, perform safety/quality checks and generate your caricature.
We do not claim ownership of your original photo. You are responsible for ensuring that you have permission to upload any photo and that each person depicted has consented where required.
We share data only with service providers needed to run the platform, process orders, generate caricatures, send emails, prevent abuse and comply with the law.
| Processor | Role | Data shared | Location / safeguards |
|---|---|---|---|
| Stripe | Payment processing | Email, name, order amount, payment metadata | US / EU, contractual safeguards |
| Google Cloud Platform | Hosting, database, file storage | Order data, uploaded photos, generated images, logs | Configured cloud infrastructure with contractual safeguards |
| Resend | Transactional email | Email address, name, order ID, delivery links | Contractual safeguards |
| fal.ai | AI image generation / image processing | Uploaded photo and generation prompt where required | Contractual safeguards |
| Anthropic | Photo analysis, prompt enhancement, safety/quality checks | Uploaded image data or order text where required | Contractual safeguards |
| Google Analytics or similar analytics | Optional analytics | Anonymised or pseudonymised usage data, subject to consent where required | Contractual safeguards |
We may disclose information to courts, regulators, law enforcement, payment providers or legal advisers if required by law, necessary to defend our rights, or necessary to investigate serious abuse, fraud or illegal content.
| Data type | Retention period | Reason |
|---|---|---|
| Original uploaded photo | 72 hours after delivery | Temporary generation, quality checks and support window |
| Generated caricature file | 72 hours after delivery | Download window and short support window |
| Order record: email, name, template, plan, amount, Stripe reference | Up to 7 years | Accounting, tax, refund, fraud-prevention and legal obligations |
| Personalisation answers and free-text notes | Up to 90 days | Customer support, quality review and dispute handling |
| Moderation records | Up to 12 months, unless legally required longer | Abuse prevention, dispute handling and platform safety |
| Reviews and feedback | Until deletion request or business need ends | Service improvement and review/free-token handling |
| Free-order tokens | Up to 12 months after creation or use | Fraud prevention and token validation |
| Server logs | Typically up to 90 days | Security, debugging and abuse prevention |
| Analytics data | Up to 26 months | Site improvement, where analytics are enabled |
| Cookie consent record | Up to 12 months | To remember your preferences |
Deletion times may vary if an order is subject to a chargeback, refund dispute, fraud investigation, legal claim or technical incident. In those cases, relevant records may be retained for as long as necessary to resolve the issue.
Under GDPR, you may have the following rights. To exercise them, email privacy@caricature.online. We will respond within 30 days unless a lawful extension applies.
If you are in Greece, you may contact the Hellenic Data Protection Authority (HDPA): www.dpa.gr.
We apply appropriate technical and organisational measures to protect personal data, including:
No online system is perfectly secure. If a personal data breach occurs and GDPR notification rules apply, we will notify the relevant authority and affected users where required.
You must be at least 18 years old to place an order. If an uploaded photo includes a child, you confirm that you are the child’s parent or legal guardian, or that you have explicit permission from the parent or legal guardian.
We do not knowingly collect personal data from children for account creation or marketing. Requests that sexualise, exploit, endanger or otherwise misuse images of children are strictly prohibited and may be blocked, cancelled or reported where legally required.
Some of our processors may operate outside the European Economic Area. Where personal data is transferred internationally, we rely on appropriate safeguards such as contractual protections, Standard Contractual Clauses, provider compliance frameworks, or other lawful transfer mechanisms available under GDPR.
We may update this Privacy Policy to reflect changes in our service, AI providers, legal obligations, safety systems or business operations. The updated version will be posted on this page with a new “Last updated” date.
If a change materially affects your rights or how we process your data, we will take reasonable steps to notify you where required.
For privacy questions or data rights requests:
Last updated: 14 May 2026