Last updated 10 September 2026. This explains what we collect when you order a portrait, why, and how to get rid of it.
The short version
- We collect your name, email, the photo you upload, and — for physical orders — a delivery address.
- Your photo is used to make your portrait and nothing else.
- We never sell your data, and we don’t send marketing you didn’t ask for.
- Card details never touch our servers; Stripe handles payment.
- Email us and we’ll delete everything we hold about you.
What we collect
When you start a portrait
Your first name, your dog’s name if you give it, and your email address. We ask for the email at the start so we can send you your portrait, and so you can pick up an unfinished order where you left off.
The photo you upload
Stored on our server and passed to the image model that generates your portrait. It is not published, not sold, and not used in advertising unless you specifically say yes.
Your photo is not used to train anything. The model was trained on Lily’s own paintings before this shop opened, and customer uploads are not added to it. If you don’t complete your order, the photo and the previews are deleted after 14 days.
When you pay
A delivery address for physical orders. Payment is processed by Stripe — your card number goes to them, not to us. We only ever see the last four digits and whether the payment worked.
Automatically
Standard server logs (IP address, browser, pages requested) and, where you arrived from an advert, the campaign that sent you. We use this to know whether our advertising works and to catch abuse.
Why we’re allowed to hold it
To perform the contract you entered into when you ordered; to meet tax and accounting obligations; and, for the analytics above, because we have a legitimate interest in knowing whether the business works. You can object to that last one at any time.
Who else sees it
Only the services needed to fulfil your order:
- Stripe — payment processing
- Hostinger — hosting, where the site and its database live
- Our print partner — receives your artwork and delivery address for physical orders, and nothing else
We do not sell or rent personal data to anybody, for any purpose.
How long we keep it
| What | How long |
|---|---|
| Unfinished orders (photo and previews) | 14 days, then deleted |
| Completed order records | 7 years — tax and accounting |
| Your finished artwork | Kept so you can re-download it, unless you ask us to remove it |
| Server logs | Typically 30 days |
Your rights
Whatever country you’re in, you can ask us to show you what we hold, correct it, delete it, or send it to you in a portable format. Email lily@watercolorbylily.com and we’ll deal with it within 30 days. We won’t ask you why.
If you’re in California, that includes the right to know, delete, and not be discriminated against for asking. We don’t sell personal information, so there is nothing to opt out of.
Cookies
We use a small number of cookies, none of them for advertising:
- One that remembers an unfinished order so you can return to it.
- One that records when a time-limited offer started, so the price you were shown stays the price you’re charged.
- WordPress’s own session cookies.
Children
This shop isn’t intended for under-16s and we don’t knowingly collect their data.
Changes
If this policy changes materially we’ll say so on this page and update the date at the top.
Contact
Watercolor by Lily, Charlotte, North Carolina, USA
lily@watercolorbylily.com
Analytics
We count visits and how far people get through the order form using our own first-party analytics, running on this site. It stores a random visitor id in your browser and records page views and order-form steps. No cookies are set for it, and nothing is shared with Google, Facebook or any other analytics company.