🎄 Festive Portrait Maker

Privacy notice

Effective from 26 September 2026

This notice explains how Hampton.io Ltd ("we", "us") uses personal data when you use Festive Portrait Maker at www.festivecards.app. We decide how and why your data is used, which makes us the "controller" under UK data protection law (the UK GDPR and the Data Protection Act 2018).

Who we are

Hampton.io Ltd, a private limited company registered in England and Wales, company number 15728356. Our address is 139 Old Station Road, Hampton in Arden, Solihull, West Midlands, B92 0HE, United Kingdom. You can reach us about anything in this notice at support@hampton.io.

What we collect

  • Photos you upload to turn into a portrait. They may show you, other people or pets. The copy we keep has location and camera details (EXIF data) removed.
  • Portraits we create from your photo, their watermarked previews, and any greeting or message you add.
  • Your email address, when you check out, so we can send your downloads and order updates.
  • Payment details, handled by Stripe. We see what you bought, the amount and whether payment succeeded, never your full card number.
  • Messages you send us.
  • Technical and usage information: your IP address (used to show prices in your currency and to protect the site), browser and device type, and the pages and buttons you use. See Cookies and analytics.

How we use it, and our lawful bases

  • To provide what you ask for: creating portraits and previews, taking payment, delivering downloads, order emails and customer support. Lawful basis: contract (Article 6(1)(b)), including steps you ask us to take before you buy.
  • To keep order and payment records for tax and accounting. Lawful basis: legal obligation (Article 6(1)(c)).
  • To keep the site secure and working: preventing fraud and misuse, fixing faults, and understanding in general terms how the site is used without storing anything on your device. Lawful basis: legitimate interests (Article 6(1)(f)) in running a safe and reliable shop.
  • Optional analytics and advertising cookies (PostHog cookies and session replay, and the Meta Pixel). Lawful basis: consent (Article 6(1)(a)), which you can withdraw at any time.

We only email you about your orders. We don't send marketing emails, and we never sell your data.

Your photos

  • To create a portrait we send your photo to Google's Gemini API. Under Google's terms for its paid API service, Google does not use this data to improve its products; it may keep it for a limited time to detect misuse.
  • We don't use your photos for facial recognition or to identify anyone, and we don't use them to train AI models. We won't use your photo or portraits to promote Festive Portrait Maker without your permission.
  • We store your uploaded photo and your portraits with our storage provider so that previews, downloads and share pages work.
  • Share pages: each portrait has a share page. Anyone with its link can see the watermarked portrait and the photo it was made from. The link contains a long random code and isn't published anywhere, so only share it with people you're happy to show your photo to.
  • Please only upload photos you have the right to use. If other people are in the photo, check they are happy for you to use it. For children, you should be their parent or guardian, or have their permission.

Who we share it with

We use these service providers, who handle data for us under contract:

  • Vercel: hosts the website and runs our servers.
  • Supabase: our database and file storage, in its London (UK) region.
  • Google (Gemini API): creates the portraits from your photo.
  • Stripe: takes payments. Stripe also uses payment data as an independent controller, for example to prevent fraud and meet its legal duties.
  • MailerSend: sends our order emails.
  • Google Workspace: our customer support mailbox, which receives the emails you send us.
  • PostHog (EU cloud): product analytics.
  • Meta: measures our Facebook and Instagram ads through the Meta Pixel, only if you accept marketing cookies. Meta also uses this data for its own purposes; see Meta's privacy policy.

We may also share data when the law requires it, to protect our rights or prevent fraud, or with a buyer if our business is sold.

International transfers

Some of these providers, including Google, Vercel, Stripe, MailerSend and Meta, may handle data outside the UK, for example in the European Economic Area or the United States. When they do, we rely on UK adequacy regulations (such as those covering the EEA, and the UK Extension to the EU-US Data Privacy Framework for certified US companies) or on safeguards in our contracts with them, such as the ICO's International Data Transfer Addendum. Contact us if you would like more detail.

How long we keep it

  • Uploaded photos and portraits: for as long as needed for previews, share pages and re-sending your downloads. Ask us and we will delete them, unless we need them for an open order, refund or dispute.
  • Download links stop working after 30 days or 10 downloads; we keep the files so we can send you a new link.
  • Order records (email address, what you bought and what you paid): six years after the end of the financial year of the order, as UK tax law requires.
  • Emails with us: as long as needed to deal with your request, or longer if they form part of an order record.
  • Analytics: Pseudonymous usage events are kept in PostHog (EU) and used for up to 1 year; session recordings, made only if you accept analytics cookies, are kept for 30 days. PostHog may keep archived events for longer under its own retention policy, so ask us and we will delete your analytics data. Vercel Analytics keeps only aggregated visit counts.
  • Meta Pixel data: Meta keeps it under its own policies.

Cookies and analytics

  • Strictly necessary (always on): your browser's local storage keeps your portraits and cart between visits, and a festive_consent cookie remembers your cookie choice for 6 months.
  • Vercel Web Analytics (always on) counts page views without cookies or other storage on your device.
  • PostHog analytics: until you accept analytics cookies, PostHog counts page views and clicks on links and buttons but stores nothing on your device and records no sessions. If you accept, it uses cookies and local storage (names starting ph_) to recognise repeat visits and may record session replays of how you use the site, with anything you type hidden.
  • Meta Pixel (marketing): only if you accept marketing cookies. It sets the _fbp cookie (and _fbc if you arrive from one of our ads) and tells Meta about page views, checkouts and purchases.

You can change your choice at any time with "Cookie settings" at the bottom of every page.

Your rights

You have the right to:

  • get a copy of your personal data;
  • have inaccurate data corrected;
  • have your data deleted;
  • restrict or object to how we use it, including anything based on our legitimate interests;
  • receive data you gave us in a portable format;
  • withdraw consent at any time, without affecting what we did before.

We don't make decisions about you by purely automated means that have legal or similarly significant effects. To use your rights, email support@hampton.io. It's free, and we will reply within one month. We may need to confirm your identity first, for example by asking you to write from the email address you used to order.

Complaints

Please contact us first so we can try to put things right. You can also complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint, by phone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

Children

You must be 18 or over to buy from us. Children should only use the site with a parent or guardian.

Changes to this notice

We update this notice when the way we use personal data changes, and the date at the top shows when it last changed. See also our Terms and Refunds pages.