Privacy policy

Effective date: 7 August 2026

This Policy explains how GirlAndStories (“GirlAndStories”, “we”, “us” or the “Service”) collects, uses, shares and protects personal information when you visit the website or place an order. It is intended to address widely applicable privacy requirements, including the GDPR and UK GDPR where they apply and relevant US state privacy laws.

1. Information we collect

Photos and portraits: the selfie you upload, the portraits generated for your order and related generation files. We do not use them to identify you, create biometric identification templates or train our own or third-party general-purpose AI models.
Order and contact information: your email address, order number, selected styles, price, status and support correspondence.
Payment information: payment status, transaction reference and limited billing details supplied by a payment provider when payments are available. We do not receive or store complete card numbers.
Technical and usage information: IP address, device and browser information, security logs, pages visited, referral source and campaign parameters.
Analytics information: optional Google Analytics data collected only after you consent, where consent is required.

2. How and why we use information

Contract and steps at your request: to accept your order, generate portraits, provide your private order link, process a payment when available and answer order-related questions.
Legitimate interests: to secure, troubleshoot and improve the Service, prevent abuse and understand non-cookie referral performance, balanced against your rights.
Consent: to use optional analytics cookies. You may withdraw consent at any time.
Legal obligations: to keep records or respond to lawful requests when required by applicable law.

Where local law requires a different legal basis, we will rely on the basis permitted by that law.

3. AI processing and service providers

We share only the information reasonably needed with providers that help us host the website, store files, deliver email, detect abuse, generate portraits, provide analytics and, when enabled, process payments. Portrait generation may require sending your uploaded photo and selected style instructions to an AI processing provider. Providers act under their own terms and/or contractual data-protection obligations. We may also disclose information when required by law, to protect users or the Service, or as part of a business transfer subject to appropriate safeguards.

4. International transfers

Our providers may process information in countries other than your own. Where GDPR-style transfer restrictions apply, we use an available lawful transfer mechanism, such as an adequacy decision, approved contractual clauses or another recognised safeguard.

5. Retention

Uploaded photos and generated portraits are ordinarily retained for up to 14 calendar days from order creation and are then scheduled for permanent deletion. Download your portraits before that period ends. Order, email, security, support and transaction records are kept only for as long as reasonably necessary for the purposes described above and any applicable legal, accounting or fraud-prevention requirements. Backup copies may remain for a limited additional period before being overwritten.

Essential browser storage is used for features such as remembering an order link, attribution details and your privacy choice. When a Google Analytics measurement ID is configured, Google Analytics remains off until you select Accept analytics. If you decline, or your browser sends Global Privacy Control, we do not load Google Analytics. You can change your choice at any time using change analytics settings in the footer. Google may process device, interaction and approximate-location information under its own privacy terms. You can also clear website data in your browser.

7. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete or receive a copy of your information; restrict or object to processing; withdraw consent; and complain to a local data-protection authority. California and certain other US residents may also have rights to know, correct and delete personal information, opt out of sale or sharing, limit certain uses of sensitive personal information and receive equal service when exercising privacy rights.

We do not sell personal information. We do not use your photos for cross-context behavioural advertising. To exercise a right, email [email protected]. We may verify your request and may retain information where an applicable exception permits or requires it. You may use an authorised agent where local law allows.

8. Security

We use reasonable technical and organisational safeguards appropriate to the nature of the information. Order pages use hard-to-guess unique links, but anyone with the link may be able to access the order, so do not share it publicly. No online system can be guaranteed completely secure.

9. Children

The Service is intended only for people aged 18 or older. We do not knowingly collect personal information from children. A parent or guardian who believes a child has used the Service should contact us for prompt review and deletion.

10. Changes and contact

We may update this Policy to reflect changes in the Service or applicable requirements. The effective date above identifies the current version. Privacy questions and requests can be sent to [email protected].