Privacy policy

Last updated 25 September 2026

Pumpkin Portrait Stencils ("the service") is run by Nathan Ward, a sole trader in the United Kingdom. This page says what the service does with your information, in plain terms. Questions: [email protected].

What the service is

You upload a photo of a face; the service makes a Halloween-styled portrait from it using an AI image model, then turns that portrait into a pumpkin carving pattern you can print. Doing that means handling a photograph, which is personal information, so here is exactly what happens to it.

What we collect and why

Your email address, to sign you in (we email you a one-time link; there are no passwords) and to keep your patterns and credits attached to your account.
The photo you upload. Its location data and camera details are removed on upload. It is used only to make your portrait and pattern.
The portrait and patterns made from it, so you can see and download them again.
Purchases and card verification: which credit pack you bought and when, and whether you have verified a card. Card details go to Stripe, our payment provider, and never reach us; Stripe gives us only an anonymous identifier for the card, which we keep so that any free credits for verifying a card can only be given once per card.
Feedback you send: your message, rating, the email address you give (or your account's), and the pattern you chose to include, so we can read it and reply. Deleted with your account; otherwise kept until we have dealt with it.
Technical records: server logs with your IP address and the pages requested, kept for security and fault-finding.

We do not use your photos to train anything, do not sell information, and do not show advertising.

Who else handles it

OpenAI (United States) makes the portrait from your photo. Your photo and the portrait are sent to OpenAI's API for that purpose only. OpenAI does not use API data to train its models and keeps API content for up to 30 days for abuse monitoring, then deletes it. OpenAI's data controls.
Stripe takes payments. Stripe's privacy policy.
Resend sends the sign-in emails.
Hetzner (Germany) hosts the server; Cloudflare carries the traffic to it.

Transfers outside the UK are covered by the providers' standard contractual terms.

How long we keep it

Uploaded photos, portraits and patterns: 30 days, then deleted automatically.
Your account (email, credit balance, purchase history): until you delete it.
Server logs: up to 30 days.

Deleting your account

Sign in and use Delete my account at the top of the page. It removes your account, photos, patterns, credits and sign-in sessions immediately. If you cannot sign in, email [email protected] from the address on the account and we will do it. See deleting your account.

Your rights

Under UK data protection law you can ask for a copy of the information we hold about you, ask for it to be corrected or deleted, and object to how it is used. Email [email protected]. You can also complain to the Information Commissioner's Office (ico.org.uk).

Other people's photos and children

Only upload a photo you have the right to use. Photos of children may be uploaded by their parent or guardian; the AI provider applies stricter rules to them and may decline some styles. The service is not intended for use by anyone under 16 on their own.

Cookies

One cookie, used only to keep you signed in. No tracking or advertising cookies.

Changes

If this policy changes, the date at the top changes with it.