Privacy Policy

doodelo is a brand of Abaporu Studio LLC, a California limited liability company ("we," "us," or "our"). Abaporu Studio LLC is the business responsible for your personal information. This Privacy Policy explains what we collect when you visit our website or order from us (the "Site"), why, who we share it with, how long we keep it, and the choices and rights you have.

We sell only in the United States, and this policy is written for people in the United States.

Most of what we collect comes directly from you. Some comes from your device when you use the Site, and some from the ad link you followed to get here.

Contact and order details. When you order: your name, email address and shipping address, and, if you send an order to someone else, their name and address and any gift message. If you pay with Apple Pay or Google Pay, your wallet may also share a phone number. When you track an order or write to our support team: your email address, order number, your message and any photos you attach.

Payment details. Card and wallet payments are handled by our payment processor, Stripe. Your card number and security code go straight to Stripe and never reach our servers. Stripe tells us limited details about the payment, such as the card brand and whether it succeeded.

Photos and portraits. The photos you upload, the portraits we generate from them, and the choices you make in the editor. The photos are of pets, but a photo may also show a person. See Pet Photos & Image Data.

Your email, to keep creating. After a number of free portraits, we ask for your email address so you can keep going. See Emails We Send and Discounts and Free Portraits.

Reviews. If you review an order: your rating, your words, the photo you attach, and, if you choose, a name to show and your pet’s name.

Device and usage data. Your IP address, browser user agent, preferred language and the page that referred you, which we record with each portrait you create; a temporary guest session identifier and a one-way fingerprint of your device’s settings, which let you keep working without an account; and the pages you view and what you do on the Site (for example, choosing a style or starting checkout), linked to a random session identifier. Our servers also log IP addresses.

Ad Click Data. If you arrive at the Site by clicking one of our ads, we record the ad click identifier in the link you followed, the campaign tags on that link, the page you landed on, and your IP address and browser user agent at that visit. See Advertising Partners and Cookies below.

Information we work out. From your orders, we work out simple measures, such as when you last ordered, how many orders you have placed and their total value, and whether you left a portrait unfinished. We use them to understand our customers and to decide who receives the emails described in Emails We Send.

What we don’t collect. We do not collect Social Security, driver’s license or passport numbers, precise location from your device, or biometric information.

We use personal information to:

• Generate your portraits, and check that each upload is a usable pet photo
• Take payment, calculate sales tax, and print, ship and track your order
• Send the emails described in Emails We Send
• Answer support requests and handle quality claims, including reviewing a pattern of repeated claims
• Show your review on the Site, if you leave one
• Understand how the Site is used, and improve it
• Measure how our advertising performs, and help the platforms we advertise on show our ads to people likely to be interested in them (see Advertising Partners)
• Prevent fraud and abuse, keep the Site secure, and limit how often it can be used from one place
• Meet our legal, tax and accounting obligations, and enforce our Terms

AI assistant. We use an AI assistant to help run the business, for example to draft replies to support requests and to summarize orders and reviews. It works only for us, under our instructions, and it never sees your photos.

We disclose personal information only as described here. We do not sell personal information for money.

Service providers. These companies process information for us, to do the work they do for us:

• Amazon Web Services — hosts the Site, stores our data in the United States, sends our emails, and checks uploads with Amazon Rekognition
• Black Forest Labs and fal.ai — generate and process your portraits (see Pet Photos & Image Data)
• Stripe — processes payments and calculates sales tax; receives your name, email address, shipping address, what you ordered and any gift message
• Gelato — prints and ships your order; receives the print file, the name and address it ships to, and your email address
• Anthropic — provides the AI model behind our assistant; may receive names, email addresses, order details, support messages and reviews when the assistant works on them, and never receives photos
• Google Workspace — hosts our email inboxes, including privacy@doodelo.com

Google address suggestions. When you type a shipping address, your browser loads Google Maps Platform and sends Google what you type, with your IP address, so it can suggest addresses. Google handles that under its own privacy policy, at policies.google.com/privacy.

Advertising partners. We share information about purchases with Meta Platforms, Inc., as described in Advertising Partners. Under California law this is "sharing" for cross-context behavioral advertising, and you can opt out at any time.

Public reviews. If you leave a review, we may show it on the Site with your photo and the name you chose to show.

Legal and safety. If we believe disclosure is required by law, or needed to protect the rights, property or safety of our customers, the public or Abaporu Studio LLC.

Business transfers. If Abaporu Studio LLC is involved in a merger, acquisition or sale of assets, your information may transfer as part of it, and this policy will continue to apply to it.

We advertise on platforms operated by Meta Platforms, Inc., such as Facebook and Instagram. To measure whether those ads lead to purchases, and to help Meta show our ads to people more likely to be interested in them, our servers send Meta information about completed purchases through Meta’s Conversions API. We do not place Meta’s tracking pixel or any other Meta script on the Site.

What we send. For each purchase we report:

• Your email address, first and last name, city, state, ZIP code and country (for an order sent to someone else, the name and location are the recipient’s), and our internal identifier for your account or guest session — each converted on our servers into a one-way SHA-256 hash before it is sent
• The order’s identifier, its value (excluding tax) and currency, and the identifiers, quantities and prices of the products in it
• If you arrived from an ad click: your IP address and browser user agent from that visit, the page you landed on, and the ad click and browser identifiers described in Cookies and Similar Technologies
• The time of the purchase

Hashing. A hash turns a value such as your email address into a fixed string of characters that cannot practically be turned back into the original. Meta compares it with information it holds to match the purchase to an account; your IP address, user agent, and ad click and browser identifiers are not hashed.

When. We report completed purchases shipped to addresses in the United States, whether or not you arrived from an ad. We do not report the pages you browse, the portraits you create, or a checkout you do not complete.

How Meta uses it. Meta uses this information to attribute purchases to our ads, report their results to us, and improve how our ads are delivered, under its own terms and privacy policy, available at facebook.com/privacy/policy.

Your choices. You can opt out of this sharing at any time on our Your Privacy Choices page. You do not need an account. From then on we do not report your purchases to Meta. If you add your email address on that page, the opt-out also covers future orders placed with that address on any device; we keep only a one-way hash of the address, never the address itself. Without an email address, the opt-out applies to that browser, and is lost if you clear the Site’s data from it.

Global Privacy Control. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out of the sale or sharing of your personal information from that browser, and you do not need to do anything else.

From the time you opt out. An opt-out applies from the time you make it. Information reported to Meta before then cannot be recalled.

What we keep. We keep a record of each report — which kinds of information it included and which order it was for, never the information itself — for about 13 months in our systems, and then in an archive for our records. The ad click record described in Cookies and Similar Technologies is deleted from our servers 90 days after it was last updated. We keep the one-way hash of an opt-out email until you ask us to remove it; to withdraw it, write to privacy@doodelo.com from that address.

Your photos. The photos you upload and the portraits generated from them are never sent to Meta or to any other advertising partner.

We use a few first-party cookies and some browser storage. We do not use third-party advertising or analytics cookies, and we do not place a Meta, Google or any other tracking pixel on the Site.

Always. Two cookies are set for every visitor:

• bicho_session — keeps your guest session, so your portraits stay with you while you create and check out. It lasts 48 hours from your last visit, or 7 days once you’ve given us your email.
• site_locale — remembers your language. It lasts one year.

Browser storage. We also keep some things in your browser, where only our Site can read them: a random identifier and a session identifier for our own analytics; your language and display choices; the photos and edits in your current editor session, so a reload does not lose your work; and, after you order, the order number, product and email address used, for 30 days, so you can find the order again on this device. Clearing the Site’s data in your browser removes all of it.

Only after an ad click. We set two more cookies only for visitors who arrive by clicking an ad — a link carrying an ad click identifier such as fbclid, gclid or ttclid. If you arrive any other way, including from a link that carries only campaign tags, we set neither of them.

• _fbp — a browser identifier in Meta’s format, made of the time it was created and a random number. It lets Meta recognise the same browser across visits. Set when you arrive from any ad click. It lasts 90 days.
• _fbc — the Meta ad click identifier from the link you followed, with the time you arrived. It lets Meta connect a purchase to the ad click that led to it. Set only when you arrive from a Meta ad, and replaced if you later arrive from another. It lasts 90 days.

Both cookies are set by our own website code, not by Meta. On the same visit we also keep the ad click identifiers, the campaign tags and the page you landed on in your browser’s session storage, which is cleared when you close the tab, and send them to our servers with your IP address and browser user agent so they can be linked to a purchase. That server record is deleted 90 days after it was last updated, and a newer ad click replaces an older one.

If you opt out on Your Privacy Choices, or your browser sends a Global Privacy Control signal, we do not set these cookies, we clear any we set earlier, and we do not send the ad click record to our servers.

You can delete these cookies, or block cookies, in your browser settings at any time.

Here is exactly what happens to the photos you upload and the portraits made from them.

• Photos are uploaded over an encrypted (HTTPS) connection and stored encrypted
• Your uploaded photos, and the cropped copies we make from them for the AI model, are deleted from our servers automatically 90 days after you upload them
• We keep the portraits we generate, and the print-ready file for any portrait you order, so you can come back to them, order prints, and claim under our quality guarantee, until you ask us to delete them
• A photo you attach to a review or a support request is kept with that review or request
• You can ask us to delete your photos and portraits at any time — write to privacy@doodelo.com with your order number or the email you used. We will, unless we still need a portrait to finish an order or a quality claim
• We do not use your photos or your portraits to train AI models. Black Forest Labs, which generates portraits for us, has terms that allow it to use the images it receives to train and improve its own models
• Your photos and the portraits made from them are never sent to Meta or to any other advertising partner

No face recognition. When you upload a photo, we check that it shows a pet and find where the animal’s face is, so the portrait can be framed on its head and chest. That check draws a rectangle; it does not measure facial features, create a face template or identify anyone. We do not collect biometric identifiers or biometric information from any photo, including of any person who appears in one.

To make and deliver your portrait, we share your photos and portraits only with the service providers that do that work for us:

• Amazon Web Services — stores your photos and portraits, and checks that each upload is a pet photo using Amazon Rekognition image analysis. Amazon does not store or use them to improve its own AI services
• fal.ai — finds the animal’s face in each photo you upload, removes stray painted signatures from finished portraits, and increases a portrait’s resolution when you order a print
• Black Forest Labs — receives your photo, cropped to your pet, and generates your portrait from it
• Gelato — receives the print-ready portrait when you order, and prints and ships it

We send these emails:

• About your order — confirmation, production, shipping, delivery, and any refund or claim
• About your support request — acknowledgements, replies, and a short survey when it is resolved
• Reminders and offers — a reminder if you make a portrait and do not order it, an invitation to review your order after it arrives, and the thank-you code for a review

We do not track whether you open our emails or click their links. To stop reminders and offers, write to privacy@doodelo.com and we will stop sending them.

Two offers give you something in return for information. Both are optional, and you can leave either at any time.

More free portraits for your email. After a number of free portraits, we ask for your email address to let you keep creating. We use it to send the reminders and offers in Emails We Send. You can stop those emails at any time without losing anything you made.

A discount code for a review. After your order arrives, we offer a 15% discount code, valid for 90 days, for reviewing it. A review includes a photo, and may include your words, a name to show and your pet’s name; we may show it on the Site. You get the code whatever rating you give.

How we value them. We value an email address at what the extra free portraits it unlocks cost us to generate, and a review at the discount it earns. To leave either offer, stop our reminder emails, or ask us at privacy@doodelo.com to remove your review.

We keep information only as long as we need it for the purposes in this policy:

• Uploaded photos and the copies made from them: 90 days after upload
• Portraits, and the details recorded when each was made (IP address, browser, language and referring page): until you ask us to delete them
• Guest session, including its device fingerprint and any email you gave to keep creating: 48 hours after your last visit, or 7 days after it once you give an email
• Orders — names, addresses, email, gift message, what you bought and paid: as long as we need them to fulfil and support the order and to meet our tax, accounting and legal obligations
• Support requests, messages and attachments: as long as we need them to resolve the request and keep a record of it; copies of the original emails, 90 days
• Reviews and review photos: until you ask us to remove them
• Records of the emails we send you (address, subject and delivery status): 90 days in our systems, then in an archive for our records
• Site usage events, which carry no name or email: 90 days in our systems, then in an archive for our records
• Ad click records: 90 days. Ad opt-out email hashes: until you withdraw them
• Our AI assistant’s activity records, which may include names, email addresses and support messages: 1 year
• Server logs, which include IP addresses: as long as we need them for security and troubleshooting

Wherever you live in the United States, you can ask us to:

• Tell you what personal information we have about you, where it came from, why we use it and who we disclosed it to, and give you a copy you can take elsewhere
• Correct personal information that is wrong
• Delete personal information we have about you
• Stop sharing your personal information for advertising

How to ask. Email privacy@doodelo.com. To opt out of advertising sharing you can also use Your Privacy Choices, or turn on Global Privacy Control in your browser — no email or verification needed.

Confirming it’s you. Before we act on a request to see, correct or delete information, we confirm it comes from you: we ask you to write from the email address on your order and to give an order number or other details only you would know. We use what you send only to confirm who you are.

Someone acting for you. Someone you authorize can make a request for you. We will ask for your signed permission and may ask you to confirm your identity with us directly, unless they hold a power of attorney.

Timing. We confirm we have your request within 10 business days and answer within 45 days. If we need up to 45 more days, we will tell you why.

What we may keep. Deleting your information does not erase records we must keep, such as order and tax records, or information we need to finish an order, honour a claim or prevent fraud. We will tell you what we kept and why. Copies in backups and archives are deleted as those copies expire, and are not used in the meantime.

Appeals. If we turn down your request, reply to our answer with "Appeal" in the subject line. We will respond within 60 days and explain our decision. If you are still not satisfied, you can contact your state attorney general.

No penalty. We will not charge you more, give you a lesser service or refuse you anything for using these rights. The offers in Discounts and Free Portraits are the only programs where what you get depends on information you give.

California law asks us to describe what we collect in its own categories. This covers the 12 months before the date at the top of this policy.

• Identifiers — name, email address, postal address, IP address, guest session and device identifiers, ad click and browser identifiers. Disclosed to our service providers. Shared with Meta for advertising: hashed email, name, location and guest session identifier, plus IP address and ad identifiers
• Customer records — name, address, and a phone number if your wallet shares one. Disclosed to Stripe and Gelato
• Commercial information — what you ordered and paid, claims and reviews. Disclosed to our service providers. Shared with Meta: order value, currency and products
• Internet activity — pages viewed and actions on the Site, browser user agent, referring and landing pages. Shared with Meta: user agent and landing page, after an ad click
• Visual information — photos you upload, portraits, and photos attached to reviews or support requests. Disclosed only to the providers in Pet Photos & Image Data; shown publicly only if you leave a review. Never shared for advertising
• Inferences — the order measures in Information We Collect. Not disclosed, except to the provider of our AI assistant
• Sensitive personal information — none

Sources. You, your device and browser, and the ad link you followed.

Purposes and retention. The purposes are those in Use of Your Information; how long we keep each category is in How Long We Keep Information.

Sale and sharing. We do not sell personal information for money. We share it, as California law uses that word, with Meta Platforms, Inc., for cross-context behavioral advertising, in the categories above. Because Black Forest Labs’ terms let it use the images it receives to improve its own models, California law may treat sending it your photo as a sale of visual information; you can ask us not to by writing to privacy@doodelo.com. We do not knowingly sell or share the personal information of anyone under 16.

Some browsers send a "Do Not Track" signal. There is no agreed standard for what it means, so the Site does not change what it does when it receives one. We do honour Global Privacy Control, as described in Advertising Partners.

doodelo is not for children. You must be 18 or older to order. We do not knowingly collect personal information from children under 13, or sell or share the personal information of anyone under 16. If you believe a child has given us personal information, write to privacy@doodelo.com and we will delete it.

Abaporu Studio LLC is in the United States, and we store your information in the United States with Amazon Web Services. Some of our providers are based in other countries and may process your information there, including Gelato in Norway and Black Forest Labs in Germany.

We protect personal information with encryption in transit (HTTPS) and at rest, and limit access to the people and systems that need it. No method of storage or transmission is completely secure. If a breach affects your personal information, we will notify you as the law requires.

If we change this policy, we will post the new version here with a new effective date. If a change materially affects how we use information we already have, we will tell you before it takes effect, by email if we have your address.

Abaporu Studio LLC is responsible for your personal information. For questions about this policy, or to make a request:

Email: privacy@doodelo.com

Mail: Abaporu Studio LLC, Attn: Privacy, 2108 N St, Ste N, Sacramento, CA 95816