Privacy Policy

The data controller is CSS International Ltd, trading as Held Portraits, registered in England and Wales (company number 16110027), 85 Great Portland Street, First Floor, London, W1W 7LT, United Kingdom.

CSS International Ltd is registered with the Information Commissioner’s Office, registration ZC199572.

Questions about your data: studio@heldportraits.co.uk.

You give us:

• Your photograph: the picture of the home you upload. Please avoid uploading photos with people in them, especially children. Portraits work best (and privacy stays simplest) when the photo shows just the building.
• Contact and delivery details: email address, and if you order a physical piece, the recipient's name and delivery address.
• Order details: what you chose (edition, size, frame), any gift message, and your correspondence with us.

Handled for us by Stripe: your payment card details. They go directly to Stripe over an encrypted connection. We never see or store them. We receive only confirmation of payment and the last four digits of the card.

Collected automatically: the minimum technical data needed to run the site securely, meaning IP address, browser type, and basic request logs held by our hosting provider. We do not use advertising or cross-site tracking cookies (see section 11).

A photograph of a home can be personal data, because it can identify where someone lives. We treat every uploaded photograph as if it were personal data, regardless of content. It is stored in private storage (not publicly accessible), used only to create your preview and your portrait, shared only with the processors below for exactly that purpose, never used for marketing, never sold, and never used to train AI models, ours or anyone else's.

We do not send newsletters or general promotional emails. If you ask us to save a free preview, we may send one reminder if you do not return. We offer a clear opt-out when we collect your email, and the reminder includes a working unsubscribe link. If you opt out, we keep only the minimum suppression record needed to respect that choice. We will not send a second reminder.

We do not make automated decisions about you that have legal or similarly significant effects.

To create your artwork, your photograph is transmitted securely to OpenAI (USA), whose image model generates the portrait under our artistic direction. This happens through OpenAI's business API, under terms where your photograph is not used to train OpenAI's models. The generated artwork and your photograph are then stored in our private storage to produce your print. A human reviews every portrait before printing.

Only service providers who need it to deliver your order, each bound by a data processing agreement:

We never sell personal data, and we do not share it with advertisers or data brokers. We would disclose data if the law genuinely required it (for example a court order), and only what was required.

Some providers above process data in the United States. Where they do, transfers are protected by the UK Extension to the EU-US Data Privacy Framework (for certified providers) or by the ICO-approved International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses, with supplementary measures where appropriate. Your core data (photographs, artwork, orders) is stored in the UK (London).

• Photographs and print-ready artwork for completed orders: up to 24 months from your last order, so we can offer remakes, replacements and reprints without asking you to start over. Then deleted. You can ask us to delete them sooner at any time (section 10).
• Uploads and previews that never become an order: your photograph and the artwork made from it are deleted 12 months after you last opened your private link, so the portrait is still there when you come back to it. The record that a portrait was made stays, without the photograph. Your email address remains only while you want it: one click in any email removes it for good.
• Order and payment records: 6 years, as UK tax and accounting law requires. These records do not include your photograph.
• Support correspondence: up to 24 months after the matter is closed.
• Marketing suppression records: kept for as long as needed to make sure we continue to respect your opt-out.

Photographs and artwork live in private storage buckets accessible only to our systems. There are no public links to your uploads or masters. All connections use TLS encryption. Payment data never touches our servers. Access to production systems is limited to the people who operate the studio.

No system is perfectly secure. If a breach ever put your rights at risk, we would notify you and the ICO as UK GDPR requires.

Under UK GDPR you can ask us to:

• access the personal data we hold about you;
• correct anything inaccurate;
• delete your data (“right to be forgotten”), including your photograph and artwork files, at any time;
• restrict or object to processing based on legitimate interests, including an absolute right to object to direct marketing; and
• port data you gave us to another service in a usable format.

Email studio@heldportraits.co.uk. No forms, no fee. We will respond within one month. We may need to confirm you are who you say you are before acting.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to sort it out first.

We use only the cookies strictly necessary for the site to work (session state and security). We do not use advertising cookies, cross-site tracking, or third-party analytics that profile you. Because these essential cookies are exempt from consent requirements, you will not see a cookie banner. There is nothing to consent to.

If that ever changes, this policy and the site will be updated first, and anything non-essential will be opt-in.

Our service is for adults. We do not knowingly collect data from anyone under 18. Please do not upload photographs that show children.

We will post any changes here with a new “last updated” date, and for significant changes we will tell you by email if we have an order relationship with you. The current version always lives at heldportraits.co.uk/privacy.