Privacy
policy.

Last reviewed · 2026-05-28

Who is the controller

Printed Weddings is operated by Craig Fearn, a UK sole trader, the data controller for the personal data described in this notice. Contact: hello@printedweddings.co.uk. Registered with the Information Commissioner's Office. The business is below the threshold that requires a Data Protection Officer.

What we collect, why, and the legal basis

We collect only what we need to make and deliver your keepsake. Each data category below maps to the lawful basis under UK GDPR Article 6.

• Email address. To send order confirmation, portrait preview, and shipping updates. Legal basis: performance of a contract (Art 6(1)(b)).
• Shipping address and recipient name. For physical keepsakes. Shared with our print partner so they can deliver to you. Legal basis: performance of a contract (Art 6(1)(b)).
• Personalisation details. Names, dates, vows, and any photograph you upload for a couple portrait commission. Used solely to produce the keepsake you ordered. Legal basis: performance of a contract (Art 6(1)(b)).
• Payment details. Handled directly by Stripe; we do not see or store card numbers. Legal basis: performance of a contract (Art 6(1)(b)).
• Order record and invoice data. Kept for UK accounting and HMRC compliance. Legal basis: legal obligation (Art 6(1)(c)).
• Server logs and rate-limit counters. Anonymised request data used to detect abuse and protect the site. Legal basis: legitimate interest (Art 6(1)(f); the interest is in keeping the service available; it does not override your rights).
• Email you give us before ordering. If you use "email me my preview", or we invite you to review a delivered order, we store your email to send that message. Legal basis: legitimate interest (Art 6(1)(f); the interest is letting you save your design and gathering honest feedback — opt out any time by emailing us).

How long we keep it

• Uploaded portrait photographs: deleted from R2 once your order has been fulfilled and despatched.
• Generated portrait files: retained for 90 days after despatch so reprints are straightforward, then deleted.
• Email address and order record: 7 years from the date of order, for UK accounting requirements (Companies Act / HMRC).
• Server logs at Cloudflare: ~24 hours, rolling.
• Email correspondence: 3 years from last contact, then deleted.
• Email captured via "email me my preview": until you ask us to remove it, or 24 months of inactivity, then deleted.

Who else sees it

We share the minimum personal data needed with the following processors. Each is bound by a contract requiring UK GDPR–equivalent protections.

• Stripe Payments Europe Ltd, payment processing. Operates from Ireland with US affiliates; Stripe relies on Standard Contractual Clauses and the UK–US Data Bridge for onward transfer.
• Gelato AS (Norway), print and shipping. Receives your name, shipping address, and a digital file of your keepsake. Norway is covered by the UK adequacy decision for EEA countries.
• Resend (Resend Holdings, Inc., USA), transactional email delivery. Receives your email address and the body of order/shipping emails. International transfer covered by Standard Contractual Clauses and the UK–US Data Bridge.
• Cloudflare, Inc. (USA / UK PoPs), hosting, edge compute, durable queues, database (D1) and object storage (R2) for any photograph you upload and for order fulfilment orchestration. Receives request metadata (IP, user-agent) for routing and abuse defence. International transfer covered by Standard Contractual Clauses and the UK–US Data Bridge.
• Sentry (Functional Software, Inc., USA), error monitoring. Receives anonymised crash data; personal data is stripped server-side before send.

We do not sell personal data. We do not share it with advertising networks or data brokers.

How we use AI for portraits

If you order an AI couple portrait, the photograph you upload is first checked by an automated content-moderation model, then sent to a generative-image API (currently OpenRouter, routing to an OpenAI image model; moderation routes to a Google model) to produce the painted-style portrait, with a Replicate upscaling pass for print resolution where needed. You see and approve the preview yourself before paying — the printed canvas is produced from that approved portrait by an automated pipeline. No automated decision producing legal or similarly significant effects is taken about you, so UK GDPR Article 22 does not apply. We do not use your photograph or the portrait output to train our own models. Where the upstream API providers' default terms permit them to use submitted content for training, we have opted out where the option is offered.

Cookies

We do not set tracking or advertising cookies. The site uses Cloudflare Web Analytics for aggregate page-view counts; it does not set cookies and does not fingerprint visitors. No consent banner is required because no non-essential cookies are placed.

Your rights

Under UK GDPR you have the following rights. Email hello@printedweddings.co.uk to exercise any of them; we will respond within one month.

• Access — a copy of the personal data we hold about you.
• Rectification — correction of inaccurate data.
• Erasure — deletion ("right to be forgotten"), subject to our legal retention obligations on order records.
• Restriction — temporary freeze on processing while a dispute is resolved.
• Portability — receive your data in a machine-readable format.
• Object — to any processing we carry out under legitimate interest.
• Withdraw consent — where any processing relies on consent (presently we do not rely on consent for any required processing).

If you believe we have handled your personal data unlawfully, you have the right to lodge a complaint with the UK supervisory authority: the Information Commissioner's Office (0303 123 1113).

Security

The site is served over HTTPS with HSTS preload, modern security headers, a human-verification challenge, and per-IP rate limits on the upload and generation endpoints. Payment data never touches our servers. Uploaded photographs are stored privately in Cloudflare Images (accessible only via short-lived signed URLs) and automatically deleted within 30 days; portrait previews are deleted on the same schedule. The final print file is retained with your order record so we can reprint a damaged or lost item. Internal admin access is restricted. We are not able to guarantee absolute security, but we apply industry-standard measures and review them when the threat picture changes.

Children

The service is intended for adult customers. We do not knowingly collect personal data about children. If you believe a child has provided data through our site, please contact us so we can delete it.

Changes to this notice

Material changes will be reflected on this page and dated above. Where a change affects how we use personal data we already hold, we will tell you by email before the change takes effect.

Controller: Craig Fearn, trading as Printed Weddings (UK sole trader). Registered with the Information Commissioner's Office.