Privacy Policy

Effective: September 12, 2026 · Softspawt (“we”, “us”)

This Privacy Policy explains what information we collect when you visit softspawt.com or place an order, how we use it, and who we share it with. Plain language, no legalese tricks.

1. What we collect

• Photos you upload to the customizer (your pet, accessories, references).
• Text descriptions you type in the customizer.
• Order details if you place an order: name, email, shipping address, the design you approved, and the size/options you selected.
• Email address if you submit it on the order-status, waitlist, or contact forms.
• IP address for abuse prevention and rate limiting (per-IP generation cap).
• Basic browser data standard server logs collect (user agent, referer, request path). Optional analytics and advertising data, when enabled through your privacy choices, can include page visits, browser identifiers, traffic source and shopping events.

2. How we use it

• Generate your preview. Your uploaded photo and description are sent to Google's Gemini API to produce the AI preview, then returned to your browser.
• Fulfill your order. We use the approved design, your name, and your shipping address to manufacture and ship the product to you.
• Contact you about your order via the email you provided.
• Send a saved preview when you explicitly request it, followed by one reminder about a day later. Requesting a saved preview does not subscribe you to a newsletter.
• Prevent abuse using rate-limit counters keyed by IP and a global daily cap.
• Measure our website and advertising when you allow the relevant optional category. You can reject this tracking without losing access to previews or checkout.

3. Who we share it with

We use these service providers, including optional measurement providers:

• Google (Gemini API) — receives your uploaded photo + text description to generate the preview. Subject to Google's API privacy terms.
• Vercel — hosts the website and serverless functions.
• Upstash — stores rate-limit counters keyed by a hashed IP address.
• Cloudflare — DNS and inbound email routing for our domain.
• Brevo (Sendinblue) — sends transactional email notifications about your order.
• Stripe — processes card payments. We never see or store your full card number.
• Google Analytics and Vercel Web Analytics — measure visits and website actions when you allow Analytics in your privacy choices.
• Meta (Facebook and Instagram) — receives browser and event information through Meta Pixel when you allow Advertising. Events can include viewing a page, starting a preview, and a verified purchase. Meta may use this information for ad measurement and personalization under its privacy policy.

We do not sell customer information for money. Advertising-related disclosures may be treated as sharing or a sale under some privacy laws. To opt out of our optional advertising tracking, choose “Reject optional” or turn Advertising off in Privacy choices.

4. How long we keep it

• Uploaded photos & AI previews: processed for your session and returned to you. The Gemini API does not retain content for model training per their commercial API terms. We do not store your raw uploaded photo on our servers beyond the request lifecycle.
• Saved preview requests: the reduced-size preview and email address are stored for up to 72 hours so we can send the requested preview and one reminder, then automatically deleted.
• Order records (name, email, address, approved design): retained as long as needed to fulfill the order plus 7 years for accounting and tax purposes.
• Email waitlist signups: kept until you ask to be removed.
• Rate-limit counters: automatically expire (hourly window, 24-hour window).

5. Your rights

You can request a copy of the data we hold about you, ask us to delete it, or correct it. To do so, email hello@softspawt.com with the subject “Privacy request” and we'll respond within 30 days. If you are in the EU/UK, you also have the rights described under GDPR/UK-GDPR including the right to lodge a complaint with your local data protection authority.

6. Cookies & analytics

Optional analytics and advertising scripts are off until you choose to allow them. Analytics and Advertising have separate settings, and accepting one does not require accepting the other. Shopping remains available if you decline both.

• Necessary storage: language preference, security controls, and a temporary checkout design used to resume your purchase. A first-party privacy-choice cookie records your selections for up to 180 days.
• Analytics: Google Analytics cookies (such as _ga) and Vercel Web Analytics help measure pages and actions. Google's use of data is described in its privacy policy.
• Advertising: Meta cookies (such as _fbp and _fbc) can help associate site actions with ads. We also store campaign attribution for the browser session when optional measurement is allowed.

Use Privacy choices here or in the footer to change or withdraw your permission. Withdrawal stops our future optional event reporting and clears accessible first-party cookies for the disabled category; it does not erase data already received by a provider. You can also clear or block cookies in your browser. These choices are specific to this browser.

When your browser sends Global Privacy Control, we keep advertising tracking off even if other optional measurement is accepted. We do not use the older Do Not Track signal as a separate setting; optional tracking still requires your privacy choice.

7. Children

Our service is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us data, email us and we will delete it.

8. Changes to this policy

We'll update the “Effective” date above when this policy changes. Material changes will also be announced via the website or email.

9. Contact

Questions about this policy or your data: hello@softspawt.com.