Privacy Policy

Effective Date: September 10, 2026

Petti is operated by Qualia Studios LLC (“we,” “us,” or “our”). This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you use our website, app, and card creation services.

1. Information We Collect

Information you provide

Depending on how you use our services, we collect:

• Account information: Your name, email address, and account credentials if you register with a password.
• Profile information: Your profile picture and other details you choose to provide.
• Card content: Prompts, character names, descriptions, uploaded photos, reference images, and other information you submit to create a card. This may include information about people depicted or described in your content.
• Generated content: Stories, illustrations, character descriptions, and other outputs created from your submissions.
• Communications: Information you provide when contacting support, submitting feedback, or making a privacy request.

Purchases and printed cards. When you buy a card, payment is processed by Stripe. We receive a record of the transaction — amount, currency, and a payment reference — but we never receive or store your card number, expiry date, or security code. Physical cards are not currently offered, so we do not collect a delivery name or postal address and we share nothing with any print or fulfilment partner. If we begin offering them, this policy will be updated before any address is collected.

Information from sign-in providers

If you use a third-party sign-in service, we receive information permitted by that service and your settings:

• Google: Your name, email address, and profile picture.
• Apple: Your name and email address, which may be an Apple private relay address.
• Facebook: Your name, email address, and profile picture.

We use this information to create and authenticate your account and, where applicable, populate your profile. We do not receive your Google, Apple, or Facebook password.

Information collected automatically

We collect device and usage information such as IP address, browser type, operating system, pages visited, interactions with the service, crash reports, and performance data.

We use cookies and browser storage for the purposes set out below. This table lists everything we set ourselves, and the advertising and analytics cookies set on our behalf.

Product analytics

We record which steps of the card-making process you reach — landing on the site, starting a card, choosing a tone, seeing your preview, reaching the paywall, starting checkout. We do this to find where the product is confusing or broken. Each record contains a random identifier, the step reached, a coarse device type (mobile, tablet, or desktop), and which advert or link brought you to the site. It does not contain your name, email address, photographs, the recipient’s details, or the words on your card, and it is never sold or used to target advertising.

2. How We Use Information

We use personal information to:

• Create and manage your account.
• Generate, save, display, and manage your cards.
• Process reference images and produce descriptions or other content used in card creation.
• Process payments and produce and deliver printed cards.
• Respond to support requests.
• Send service-related messages, such as password resets and account notifications.
• Send marketing communications when you have opted in.
• Maintain security, prevent abuse, and troubleshoot technical problems.
• Understand service usage and improve performance.
• Meet legal obligations and enforce our Terms of Service.

We do not use your card content, uploaded photos, or generated illustrations to train artificial-intelligence models.

3. AI Processing and Your Content

Our card creation features use OpenAI to generate story text, character descriptions, and illustrations. To do this we send OpenAI the story details you enter (such as your idea, character names, tone, and age range) and, where you upload a reference photo, that photo itself.

How reference photos are used. An uploaded photo is sent to OpenAI twice over: once for analysis, which produces a written description, and again with each illustration we generate, so that the artwork can be based on the photo rather than only on a description of it. A card therefore sends the photo many times — once per illustration, and again whenever an illustration is regenerated or edited. This is a change from our earlier practice, under which the photo was sent only once and every illustration was drawn from text alone.

Your consent. Because sending a photograph to an AI provider is different from sending a description of it, we ask you to agree to it explicitly before you upload, and we record which version of that statement you agreed to. If you would rather not have a photo sent this way, you can create a card without uploading one — typed character descriptions work without any photo being sent to OpenAI for illustration.

If you delete a photo. Deleting a photo, or its removal by the retention schedule in Section 5, stops it being sent for any future illustration; illustrations we generate afterwards fall back to the written description. It does not withdraw copies already sent, does not change illustrations already made, and does not erase the description.

Model training. We do not use your content to train AI models. OpenAI states that API content is not used for model training by default unless the customer explicitly opts in. On September 8, 2026, we verified that our OpenAI organisation’s optional sharing of inputs and outputs, model feedback, and evaluation and fine-tuning data was disabled.

Provider retention and review. OpenAI’s standard API abuse-monitoring logs may include prompts, responses, and related metadata for up to 30 days, with longer retention where required by law or reasonably necessary to prevent harm. Because a photo is now sent with every illustration, each of those sends may create its own such record. Image inputs are screened for child sexual abuse material; OpenAI states that an image its classifier flags is retained for manual human review even where zero-data-retention or modified abuse-monitoring settings are in effect. Automated classifiers produce false positives, so this can happen to an ordinary family photograph. Our local deletion process does not erase these provider-held records. We do not promise zero provider retention or an absence of human review. See OpenAI’s data controls documentation.

Generated descriptions and illustrations may contain personal information or resemble people shown in uploaded photos. Deleting an original photo does not delete the description or the illustrations produced from it. Section 5 explains retention and deletion.

4. How We Disclose Information

We disclose information as needed for the purposes described in this policy to:

• Service providers: Google (Firebase and Google Cloud — hosting, database, sign-in, file storage), Vercel (website hosting and traffic analytics), OpenAI (story and illustration generation), Stripe (payments), and Resend (email delivery).
• Advertising and measurement: Meta and Google, as described below and in Section 6.
• Legal and safety recipients: Authorities or other parties when required by law or reasonably necessary to address fraud, security incidents, or threats to rights or safety.
• Business transaction participants: Relevant parties in connection with a proposed or completed merger, acquisition, financing, or sale of assets, subject to applicable confidentiality and data-protection requirements.

Card visibility. Your cards are private by default. Nothing you create is visible to anyone else unless you choose to publish it to our public gallery or share a link to it. A shared link can be opened by anyone who has it, so treat it as public. You can make a published card private again at any time from your library.

Advertising-related sharing. We do not sell personal information. When tracking is allowed under Section 6, we use the Meta Pixel and Conversions API for advertising measurement and optimisation. Meta receives browsing and purchase events, page URLs, advertising-cookie identifiers, IP address and browser information. For purchases, we may also send hashed email address, first and last name, and account identifier, together with order value, currency, and card identifier. Hashing helps match records but does not make this information anonymous. We do not include uploaded photos or story text in these advertising events. Under California law this may be considered sharing for cross-context behavioural advertising. You can opt out at any time — see Section 6.

Provider use of information. Meta may combine advertising-event information with information it already holds for ad delivery, personalisation, measurement, and improvement of its services under its Business Tools Terms and Privacy Policy. Meta also describes using business activity to personalise feeds and AI responses in countries where that feature is available, subject to its user controls; see Meta’s explanation. This is separate from processing solely on our instructions. Our Google Analytics configuration disables Google signals and advertising-personalisation signals. On September 8, 2026, we also verified that optional account sharing for Google products and services, modelling contributions and business insights, technical support, and business recommendations was off, and disabled ads personalisation in all regions for our Analytics property. These account controls are separate from our website’s cookie choice. See Google’s explanation of data-sharing settings. We do not represent that every provider is prohibited from all independent uses; payment, security, legal, and service-operation activities may also be governed by the provider’s own terms.

Meta collection controls. On September 8, 2026, we disabled automatic advanced matching and automatic collection of additional page and product information for our Meta dataset, and verified that automatic event collection was off. Our intentionally configured Pixel and Conversions API events, including the purchase identifiers described above, remain subject to the tracking choices in Section 6. These settings do not prevent all of Meta’s independent uses described above.

5. Retention and Deletion

• Account information: Kept while your account remains active, and deleted after you ask us to close it.
• Uploaded reference photos: Deleted from our storage as soon as your card has finished generating, and in any case within 7 days of upload, automatically. A photo normally exists on our systems only for the length of one generation run.
• Generated descriptions: The written description produced from a photo is kept with your card, and is deleted when you delete that card.
• Cards and illustrations: Kept in your library until you delete them. Deleting a card removes its pages, illustrations, and the descriptions used to create them.
• IP addresses used for advertising measurement: Deleted as soon as the measurement has been sent, and in any event within 7 days.
• Product analytics records: Kept for as long as they remain useful for understanding how the product is used. They contain no directly identifying information.
• Purchase and print-order records: Kept as long as needed for accounting, tax, refunds, and customer-support purposes.

Recovery copies. Our production database keeps point-in-time recovery history for 7 days, and our file storage keeps soft-deleted files for 7 days after deletion. We have no scheduled database backups configured. These recovery windows are separate from the retention of live data and from our providers’ own records described above.

We may retain limited information where necessary to comply with legal obligations, resolve disputes, prevent fraud, or enforce agreements. Where an exception applies, we retain only the information needed for that purpose.

Account-deletion requests. You can submit a request below while signed in, or email support@getpetti.com. Deletion is handled by support, not performed immediately by this form. Our target is to complete verified requests within 30 days of receipt; we will respond within the applicable legal deadline, including any shorter deadline. If verification, a permitted extension, or a legal retention exception affects completion, we will explain the reason and timing. Recovery copies expire separately on the schedule above.

Loading account controls…

6. Your Choices and Privacy Requests

You can:

• View or update available profile information in your account settings.
• Delete cards through your library.
• Make a published card private again at any time.
• Request account or personal-information deletion by emailing support@getpetti.com.
• Unsubscribe from marketing emails using the unsubscribe link. Service-related messages may still be sent.
• Manage cookies through your browser. Blocking browser storage for this site also stops the product analytics described in Section 1. Disabling essential cookies may affect functionality.

Advertising and measurement cookies. If you are in the United Kingdom, European Economic Area, or Switzerland, or we cannot determine your country, we ask for your consent on your first visit and none of these technologies run until you accept. Elsewhere they run by default, and you can opt out at any time. Withdrawing is as easy as giving consent:

Depending on your location and applicable law, you may also request access, correction, a copy of your information, or restrictions on certain processing. We may need to verify your identity before fulfilling a request. We will respond within applicable legal time limits and explain any permitted reason we cannot fulfil a request.

7. Additional Regional Information

United Kingdom and European Economic Area

Where the UK GDPR or EU GDPR applies, Qualia Studios LLC is the controller of the personal information described in this policy.

Our legal bases for processing are:

• Contract: Creating and delivering the cards you ask for, and taking payment.
• Consent: Advertising and measurement cookies, and marketing emails.
• Legitimate interests: First-party product analytics (understanding and improving our own service), securing the service, and preventing fraud and abuse. We consider this proportionate because the analytics data is pseudonymous, stays with us, and is not used to target you. You may object at any time by contacting us.
• Legal obligations: Tax, accounting, and other legally required record-keeping.

You may have rights to access, correct, erase, or receive a portable copy of your information, restrict processing, and object to certain processing. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. You may complain to your local data-protection authority.

International transfers. We are based in the United States and our systems store and process information in the United States. If you use the service from outside the United States, your information will be transferred there, where data-protection laws may differ from those in your country.

Transfer safeguards. Providers’ published terms describe safeguards for covered international transfers. OpenAI’s Data Processing Addendum provides for EEA data to be processed through OpenAI Ireland, with onward transfers supported by Standard Contractual Clauses (SCCs) or an adequacy decision, and a UK Addendum for UK transfers. Firebase’s processing terms and Google Cloud’s addendum provide transfer mechanisms and SCCs where applicable. Vercel, Stripe, and Resend also publish contractual transfer provisions.

Qualia Studios LLC accepted Google’s Data Processing Terms for our Google Analytics account on September 8, 2026. They include provisions for covered international transfers, including SCCs where applicable.

These safeguards apply according to the relevant service, recipient, and agreement. A cookie choice does not itself establish a legal mechanism for international transfers. We do not claim that Qualia Studios LLC is certified under the EU–U.S. Data Privacy Framework. Contact support@getpetti.com for information about safeguards applicable to your data or to request a copy, with confidential information redacted where appropriate.

California

If the California Consumer Privacy Act applies to our processing, eligible California residents may have rights to:

• Know about and access personal information collected, used, and disclosed.
• Request deletion and correction.
• Opt out of sale or sharing for cross-context behavioural advertising. We do not sell personal information; our advertising measurement may constitute sharing, and you can opt out using the control in Section 6.
• Limit certain uses and disclosures of sensitive personal information, where applicable.
• Exercise privacy rights without unlawful discrimination.

You can make a request by emailing support@getpetti.com, and you may use an authorised agent acting on your behalf.

8. Children’s Information

Minimum age. You must be at least 13 to create an account or use Petti. We do not require an age-confirmation checkbox or popup, and we do not independently verify users’ ages. Children under 13 must not register or submit information directly.

Adults may submit photos, names, or other information about children to create personalised cards. That information is processed as described in this policy. Please submit information about another person only when you have the necessary authority or permission to do so.

We do not knowingly collect personal information directly from children under 13. If you believe a child has submitted personal information contrary to our age requirements, or you want to request deletion of information about your child, contact support@getpetti.com.

9. Security

We use reasonable technical and organizational safeguards designed to protect personal information against unauthorized access, loss, alteration, and disclosure. No method of transmission or storage is completely secure.

10. Changes to This Policy

We may update this policy as our services, practices, or legal obligations change. We will publish the revised policy with an updated effective date and provide additional notice or obtain consent where required by applicable law.

11. Contact Us

For privacy questions or requests:

Email: support@getpetti.com
Company: Qualia Studios LLC
Address: 8 Green St, STE 8, Dover, DE 19901, USA