Privacy Policy
Effective date: 19 October 2026
Last updated: 19 October 2026
This policy explains what happens to a photograph you upload to The Pet-agon, and to everything else we handle when you buy a dossier or a print. If anything here is unclear, write to us at contact@pet-agon.com and we will answer in plain language.
1. Who we are#
The controller of your personal data is:
Piotr Korzeń
ul. Kalwaryjska 69/9
30-504 Kraków
Poland
Email: contact@pet-agon.com
We have not appointed a Data Protection Officer. Writing to contact@pet-agon.com reaches the person who handles these questions.
2. The short version#
- You upload a photograph of an animal. A model describes what it sees; a second model writes a comic "dossier" from that description; we render the result into a poster and a share card.
- There are no accounts and no passwords. Your dossier lives at a long random web address, and anyone who has that address can open it.
- We set no cookies, and there are no third-party analytics tools, and no advertising trackers in your browser. If the link you followed to us carries campaign labels, we record those labels with your dossier, as section 3.7 describes. If you came from one of our Meta ads and upload a photograph, our server tells Meta so, as section 3.8 describes. Two things are stored or loaded in your browser that you should know about, and section 11 names both: a short list, kept only in your browser, of the files you opened here, and Cloudflare's bot check on the upload page.
- We ask you for no email address. If you buy something, Stripe collects one for your receipt, and we keep it with your order so that we can send you the written confirmation the law requires and find your file again if you lose the link. It is used for those two things and for answering you. There is no mailing list and there are no marketing emails.
- We never use your photograph, or anything made from it, in advertising or on any public channel of ours. We do not ask for permission to do so, because we do not do it.
- We read exactly one piece of metadata out of your photograph: the time it was taken. We never read location data.
3. What we collect, and where it comes from#
3.1 Things you give us#
| What | When | Required? |
|---|---|---|
| The photograph you upload | When you submit the form | Yes, it is the product |
| Your pet's name | On the same form | No |
| Up to three nicknames ("aliases") for your pet | On the same form | No |
We ask for nothing else. There is no name field, no email field and no address field anywhere on our site. If you go on to buy something, Stripe asks you for an email address on its own payment page (see section 3.5).
3.2 Things we create from your photograph#
An automated description of the photograph (species, coat, expression, posture, gaze, and a list of objects visible in the background), and the dossier text written from it. Both are stored alongside your photograph.
The list of background objects is the point of the product. If a person, a room, a document or anything else identifiable is visible in your photograph, it may be described in that list and may end up in the dossier text.
3.3 The photograph's own metadata#
Your photograph is stored as your device produced it, so whatever metadata it already contained is stored with it. That can include camera model, capture time and, on many phones, GPS coordinates.
We read one field and one field only: the capture timestamp
(DateTimeOriginal), which is printed on the dossier as a "surveillance" time
stamp. The code that reads it is built so that it cannot return anything else:
it walks to one fixed tag and stops. Nothing in our system reads, displays,
stores separately, or transmits your photograph's location data, and the posters
and cards we generate for you do not carry your photograph's metadata forward.
3.4 Your IP address#
When you submit the upload form, request an upload slot or start a checkout, your IP address is used to count requests over a 60-second window, so that one visitor cannot flood the service.
That counter lives in a third party's store, and your IP address is part of its
name. The counter is kept in Upstash Redis (see section 5), under a key built
from the path you requested and your IP address as it reached us, for example
rl:v1:/api/checkout:203.0.113.4. It is not hashed and it is not shortened.
Against that key we store one timestamp per request you made inside the window,
and nothing else: no photograph, no dossier, no email address, no identifier
tying the counter to your order.
The counter deletes itself. The whole key carries a 60-second expiry that is reset on each request, so 60 seconds after your last limited request the key and every timestamp under it are gone. Nothing copies them anywhere first.
Your IP address is not written to our own database, and we keep no request logs of our own. The rate-limit counter above is the only place we put it. An earlier version of this policy said the counter was held only in the memory of the server that answered the request. That stopped being true when the limiter moved to a shared store, and this paragraph is the correction.
If that shared store is unreachable, the limiter falls back to an in-memory counter on the server handling the request, which is the older behaviour described above and writes nothing anywhere.
Our hosting and storage providers keep their own operational logs independently of us. See section 5.
This is not the only place your IP address goes. When the bot check on the upload page loads, your browser sends it to Cloudflare as well; see section 11.
3.5 If you buy something#
Payment is taken by Stripe. The card form is Stripe's, on Stripe's systems.
- We never see your full card number, and we never receive it.
- Stripe collects your email address for the receipt and, only if you add a printed poster to your order, a delivery name and postal address. If you buy only the digital file, no address is asked for at all.
- Our own database stores: that the order was paid, when, the Stripe session reference, which paper size (if any) was bought, the email address Stripe collected for your receipt, and the record of the two statements you ticked before paying, meaning the moment you ticked them and an identifier for the exact wording you were shown. Names, postal addresses and card details are not columns in our database at all.
- We keep your email address for two reasons, both part of performing the contract. It is the address we send your order confirmation to, and that confirmation is what consumer law requires us to give you in writing when you ask for a digital file immediately (Terms, section 6a). It is also what turns "I have lost my link" into a lookup instead of a search through Stripe by approximate date. We do not use it for anything else. There is no mailing list.
- We keep the record of what you ticked because we have to be able to show what you agreed to and when, not merely that you agreed to something. An identifier for the wording is stored alongside the timestamp so that the exact two sentences you saw can be produced later.
- To post you a print, a person on our side reads your delivery address in the Stripe dashboard and passes it, with the print file, to our print partner.
3.6 The order confirmation we send you#
When your payment is confirmed we send one email to the address Stripe collected. It contains your dossier link, what you bought, what you paid, the two statements you ticked before paying, and our identity as the seller. Consumer law requires it, it is sent once per order, and it is not a marketing message.
It is the only email we send. There is no mailing list, no newsletter, no abandoned-basket email and no follow-up of any kind. It carries no tracking pixel, no images and no links other than your own dossier address, so we do not know and cannot know whether you opened it.
If you never buy anything, we never have an address for you, and none of this section applies to you.
3.7 Campaign labels in the link you followed#
If you arrived through a link that carries campaign labels (for example
utm_source=tiktok), we store those labels with your dossier so we can tell
which of our posts bring visitors. They say which link you clicked, nothing
else, and they are deleted with your dossier. We also keep daily totals per
label that name no dossier and no person. No cookie or browser storage is used
for this.
Our legal basis is our legitimate interest in measuring our own marketing (Art. 6(1)(f)).
3.8 Visitors who arrive from a Meta ad#
If you arrive through one of our ads on Facebook or Instagram, Meta adds a click
id to the link (the fbclid parameter). If you then upload a photograph, our
server sends Meta Platforms Ireland one message saying that the click led to an
upload. It contains that click id, your browser's user agent string (the line
that names your browser and operating system), the address of our upload page,
the time and a random message id. It does not contain your IP address, your
photograph, your pet's name, your dossier or an email address.
We do this to measure which of our ads lead to uploads, and to improve them. Nothing is stored on your device for it, and we do not keep the click id: it travels in the link and in the one request, and is not written to our database or our own logs. The click id is part of the address of the pages you open, so, like any page address, it does reach the operational logs our hosting provider keeps independently of us (section 3.4). If you did not come from a Meta ad, nothing is sent.
Our legal basis is our legitimate interest in measuring and improving our own ads (Art. 6(1)(f)). Meta Platforms Ireland is a separate controller for its own use of the message, and may use it to decide who is shown our ads. The sending itself is a responsibility we share with Meta, in line with the Court of Justice's Fashion ID judgment (C-40/17) and Meta's Controller Addendum.
4. Why we process it, and on what legal basis#
| Purpose | Legal basis (GDPR) |
|---|---|
| Making the dossier you asked for from your photograph | Art. 6(1)(b): performance of a contract with you |
| Taking payment, issuing receipts, keeping tax records | Art. 6(1)(b), and Art. 6(1)(c) for the accounting records Polish law requires |
| Sending you the written confirmation of your order, and keeping your email address so we can find your file for you | Art. 6(1)(b): performance of a contract with you; and Art. 6(1)(c), because consumer law obliges us to confirm the contract on a durable medium |
| Keeping the record of the two statements you ticked at checkout | Art. 6(1)(c): a legal obligation. We have to be able to demonstrate what was agreed and when |
| Printing and posting your poster | Art. 6(1)(b) |
| Rate limiting, and keeping the service from being abused | Art. 6(1)(f): our legitimate interest in a service that stays up |
| Recording the campaign labels in the link you followed (section 3.7) | Art. 6(1)(f): our legitimate interest in measuring our own marketing |
| Telling Meta that a visit from one of our Meta ads led to an upload (section 3.8) | Art. 6(1)(f): our legitimate interest in measuring and improving our own ads |
| Answering your emails | Art. 6(1)(b) or Art. 6(1)(f) |
We do not build profiles of you. If you came from a Meta ad, Meta may use the upload event to decide who sees our ads (section 3.8). We do not sell data, and we make no automated decisions that produce legal or similarly significant effects for you. The dossier text is machine-generated, but it is a joke about a pet: it decides nothing about anyone.
5. Who else handles it#
We use a small number of service providers. Each of them is meant to handle your data only on our instructions and only for the job we brought them in to do, and the instrument that holds a provider to that is a data processing agreement. We are putting those agreements in place provider by provider, and we are not going to tell you they are all signed until they are.
One provider would sit partly outside such an agreement even when it is signed, and we would rather name it here than leave it in the small print. Cloudflare runs the bot check for us on our instructions, but it also uses what the check sees to improve its own bot detection, and for that second use Cloudflare decides for itself what happens to the data. No agreement of ours covers that half. Section 11 says more.
One more recipient is not a provider of ours at all. If you arrived from one of our Meta ads and upload a photograph, Meta Platforms Ireland receives the upload event described in section 3.8. Meta is a separate controller for its own use of that event, and the sending itself is a responsibility we share with Meta, in line with the Court of Justice's Fashion ID judgment (C-40/17). No data processing agreement of ours covers what Meta does with the event; Meta's own privacy policy does.
| Provider | What they do | Where the data sits |
|---|---|---|
| Vercel | Runs the website and the server code | EU region: Frankfurt, Germany (fra1, on AWS eu-central-1) |
| Neon | The Postgres database holding your dossier record | EU region |
| Cloudflare R2 | Object storage for your photograph and the generated files | EU region |
| Cloudflare (Turnstile) | The bot check on the upload page, described in section 11 | Cloudflare does not publish this. Treat it as possibly outside the EEA — see section 6 |
| OpenRouter | Routes the image-description request to the vision model | OpenRouter publishes no processing region of its own: it is a US company, and it says your data may go to its US servers or to other countries outside the EEA. It hands the request on to a model provider, and we restrict it to providers that retain nothing — on 21 September 2026 every such provider for our model was in the United States. See section 6 |
| Anthropic | Writes the dossier text, and describes the image when the first route fails | United States |
| Stripe | Payments, receipts, and collecting the delivery address | EU/US |
| Amazon Web Services (SES) | Sends your order confirmation email | EU region (Frankfurt, eu-central-1). The message, your email address and the subject line are processed there |
| Upstash | Holds the 60-second rate-limit counters described in section 3.4, keyed on your IP address | Primary region: Frankfurt, Germany (AWS eu-central-1) — see section 6 |
| Gelato | Prints and ships posters | Printed locally in your region |
| Meta Platforms Ireland | Receives the upload event described in section 3.8, only if you arrived from one of our Meta ads. A separate controller for its own use of it | Ireland (EU). Meta may transfer it outside the EEA — see section 6 |
Gelato receives the print file, which contains your photograph, and your delivery address. It receives nothing else from us.
6. Sending data outside the EEA#
Our storage, our database, our hosting and our email sending are in the EU.
Two transfers are unavoidable if you want a dossier at all, and both of them carry your photograph. A third carries it only if you order a print: the print file goes to our print partner, and that is further down this section.
Anthropic, in the United States. It receives a resized copy of your photograph and the description of it in order to write the dossier. That transfer is covered by the Standard Contractual Clauses in Anthropic's data processing agreement.
OpenRouter, and a model provider in the United States. Your photograph has to be described before anything can be written about it, and OpenRouter is what carries it to the model that describes it. What we send is a resized copy with its metadata stripped off first, so no location data and no camera information travel with it. It goes first to OpenRouter, a company in New York, which passes it on to whichever model provider serves the request. Where OpenRouter's own servers handle it, OpenRouter does not say: its privacy policy says only that your personal data "may be transferred to our servers in the US, or to other countries outside the European Economic Area". The model provider we can be more exact about, because we choose the shortlist: we restrict the request to providers that do not retain what they are sent, and on the list we read on 21 September 2026 every one of those providers was in the United States. That restriction is the reason this paragraph can say the United States at all — without it the same request could be served from Singapore or China, by a provider that keeps the photograph for a period nobody publishes. Our own leg of the transfer, to OpenRouter, is covered by the Standard Contractual Clauses in OpenRouter's data processing agreement, in the module that covers a controller sending data to a processor.
Three things about that leg we cannot tell you, and we would rather name them than round them up. Which provider served any given request is decided request by request; we do not record it, and OpenRouter does not publish it per request, so we cannot tell you from our own records which one described your photograph. The transfer mechanism for the second leg, from OpenRouter onward to that provider, is not published provider by provider; OpenRouter says only that it requires its providers to comply with data protection law. And OpenRouter publishes no precise processing region for the interface we use. Keeping this leg inside the EEA was not an option we could take: routing by region is a paid feature of OpenRouter's, and its European endpoint does not serve the model we use at all.
Your order confirmation email is not a transfer out of the EEA. It is sent
through Amazon SES in the eu-central-1 (Frankfurt) region, and that is where it
is processed: the recipient address, the subject line, and both the plain-text
and the HTML body of the message. The sending region is fixed in our code and
cannot be changed by a setting.
One limit to that. AWS documents that the things which hold your address in SES
are regional: the verified sending identity, the sandbox status and the
suppression list of addresses that bounced all "apply to your AWS account only
in the current AWS Region". We have not been able to establish from AWS's public
documentation whether any account-level metadata about our own AWS account (for
example billing or diagnostic records) is held outside eu-central-1, and AWS's
own data-protection guidance warns that free-form fields "may be used for
billing or diagnostic logs". We do not put your address into any such field.
Where AWS does process data outside the EEA under our account, the transfer is
covered by the Standard Contractual Clauses in the AWS GDPR Data Processing
Addendum.
The rate-limit counters in Upstash, which hold your IP address for 60 seconds and
nothing else, sit in a database whose primary region is Frankfurt, Germany (AWS
eu-central-1). We read that off the Upstash console on 21 September 2026. One
limit we would rather state than hide: the database is of the kind Upstash calls
"global", and a global database has a primary region and may have read copies in
other regions. No such copy was listed to us, and we have written down what we
could see rather than the stronger claim we cannot make — the primary region is
Frankfurt, and we cannot promise you that a 60-second counter is never read
anywhere else. If Upstash makes that list visible we will come back to this
paragraph.
Stripe and Gelato may also process data outside the EEA under their own transfer mechanisms.
The bot check is one of these, and it is the clearest of them. Cloudflare does not publish where a Turnstile check is decided. Its own data-localization documentation marks Turnstile as one of the products that cannot be confined to a region, and says there are no regional guarantees for the verification call our server makes afterwards. Cloudflare's privacy policy says it stores information primarily in the United States and the European Economic Area, and relies on the EU-U.S. Data Privacy Framework, falling back on Standard Contractual Clauses where that does not apply. So treat the bot check as a transfer that may leave the EEA. What can leave is the signals listed in section 11 — your IP address, a fingerprint of your browser's secure connection, its User-Agent header and the address of our page. Not your photograph, and not anything you typed.
Meta Platforms Ireland and the upload event. As a separate controller, Meta decides itself whether the event described in section 3.8 leaves the EEA, under its own transfer mechanisms. The event carries the click id and your browser's user agent string. Not your photograph, and not your IP address.
7. People other than you who appear in your photograph#
If someone else is visible in a photograph you upload, whether a person in the background, a hand in the frame or a face in a picture on the wall, then we are processing their personal data too, and we have never spoken to them. GDPR Art. 14 requires us to say so publicly, which is what this section is.
- What we get: their image, as it appears in the photograph, and possibly a description of them among the "objects visible in the background".
- Where we got it from: the customer who uploaded the photograph.
- Why: to produce the dossier that customer asked for. Our legal basis is our legitimate interest (Art. 6(1)(f)) in delivering a product a customer ordered, weighed against the fact that this is a private photograph, handled at small scale, and never published by us.
- What we never do with it: we never use it in advertising, we never publish it, and we never try to identify anyone in it.
- What you can do: if you believe you appear in a photograph someone uploaded, write to contact@pet-agon.com. See section 10: you do not need a link, and you do not need to be our customer.
We also ask our customers, in the Terms, not to upload photographs of other people without their agreement. That request does not reduce the rights of the person in the photograph.
8. How long we keep it#
Deletion runs automatically, on a timer, once a day. The periods below are the ones the job is configured with today; each of them is a setting rather than a law, and if we change one we change this table with it.
| Item | Retention |
|---|---|
| A photograph uploaded but never submitted | About 24 hours, then deleted automatically by a storage lifecycle rule |
| A photograph and dossier where nothing was bought | 90 days from upload |
| The photograph you uploaded, where the dossier was paid for | 30 days from payment. Once your poster and share card have been made, nothing in our system reads the original photograph again, so it goes first and separately. Your files are unaffected |
| The dossier and the files that were paid for | 12 months from payment, so that you can still download them |
| The print file and delivery address held by our print partner | Under their own retention policy |
| Payment and order records (in Stripe, and the paid flag, payment time and session reference in our database) | 5 years from the end of the accounting year, because Polish tax law requires it. Kept even if you ask for deletion. |
| The email address from your receipt, and the record of the two statements you ticked | 5 years from the end of the accounting year, with the order record above, and for the same reason: they are part of the evidence of the contract. Kept even if you ask for deletion. If you ask us to delete your dossier we delete the photograph, the dossier and the files; this record survives, and holds no photograph and no dossier text. |
| The confirmation email in Amazon SES's sending records, and any address of yours on the SES suppression list | Both stay in the eu-central-1 region. AWS publishes no period for its own record of a message we asked it to send, and we have set nothing up that copies those records anywhere else — no tracking of opens or clicks, and no export. The suppression list we can be exact about: an address only goes on it if mail to it hard-bounced or was reported as spam, it exists only in eu-central-1, and AWS's own documentation says an address stays on it until it is removed. If yours is on it, write to us and we will take it off |
| Emails you send us | 24 months |
When a dossier is deleted, the photograph, the poster, the share card and the print files go with it, and its links stop working.
For a dossier nobody bought, "deleted" means the record is removed from our database entirely and its files are removed from storage, leaving nothing behind.
For a dossier that was paid for, the photograph, the dossier text and all of the files are removed in exactly the same way, and what remains is the order record in the row above: that a sale happened, when, for how much, the receipt address and the two statements you ticked at checkout. We are required to keep that for five years and we cannot delete it on request; it contains no photograph, no dossier text and no pet name.
You can delete a dossier yourself, at any time, without asking us. See section 10.
9. Your rights#
Under GDPR you can ask us to:
- give you a copy of the data we hold about you (Art. 15);
- correct it (Art. 16);
- delete it (Art. 17);
- restrict what we do with it (Art. 18);
- hand it over in a portable format (Art. 20);
- object to processing we do on the legitimate-interest basis (Art. 21).
We answer within one month. There is no charge.
10. How to reach your data when there is no account#
We deliberately hold nothing that identifies you as a person. That is good for your privacy and awkward for these requests, and each case works differently.
If you have your dossier link, and you bought something. Open it. At the bottom of the page there is a control marked DESTRUCTION OF FILE. It asks you to confirm, and then it deletes the photograph, the dossier and every file immediately and permanently, with no email to us and no waiting. What survives is the order record described in section 8, and the page tells you that before you confirm.
We treat holding the link as sufficient authority to do this, deliberately. It is the only proof of access that exists in this system, and it is what unlocks the downloads. Asking you to prove who you are would mean collecting identity documents we do not hold and have no business holding, in order to delete a photograph of an animal (Art. 11 and Art. 12(6) GDPR). Deleting is also less dangerous to you than reading, and we already treat the link as enough to read.
If you have your dossier link and did not buy anything. Email contact@pet-agon.com with the link and we will delete the record and confirm. (The self-service control lives on the delivery page, which a free dossier does not reach.) It is deleted automatically after 90 days regardless.
If you have lost the link but you paid. Your dossier link is in the order confirmation we emailed you when your payment was confirmed, so look for it there first. If you cannot find that either, email contact@pet-agon.com from the address you used at checkout, and tell us roughly when you paid. We hold that address on the order, so this is a direct lookup.
If you have lost the link and never paid. We will probably not be able to find your record: nothing ties it to you. Tell us what you can, such as the approximate date and time and what the photograph showed, and we will try. If we cannot find it, we will say so rather than guess, and the record will be deleted on the schedule in section 8 regardless.
If you appear in someone else's photograph. Email contact@pet-agon.com and describe what you can. We will make a reasonable effort to find it. Please note that if you cannot point us at a specific dossier, searching for you would mean looking through other customers' private photographs, which is intrusive in itself, so tell us what you know and we will keep the search proportionate.
A warning about the share link. If you have published your dossier's share address, deleting the dossier stops that page working, but it cannot recall copies other people have already saved, or previews that social platforms have cached.
11. Cookies and tracking#
We do not set cookies. There are no third-party analytics tools, no advertising pixels, no session recording and no embedded social widgets. What we do measure ourselves is which of our links brought a visitor, from the campaign labels in the link itself (section 3.7), and, per label and per day, how many times the home page was opened from a labelled link, how many times it was actually viewed, how many times its upload button was pressed, how many uploads were started, how many dossiers were started and finished, how many orders were paid and how many A4 and A3 prints were ordered. Those daily totals are counts that name no dossier and no person, and nothing is stored in your browser for them. Our typeface is served from our own server, not from a font network.
We do not use the Meta pixel or any Meta cookie either. The one message to Meta described in section 3.8 is sent by our server, not by your browser, and nothing is stored in your browser for it.
The same goes for the one email we send you: no tracking pixel, no remote images, and no link in it other than your own dossier address. We cannot tell whether you opened it.
Two things are not covered by those sentences, and this section describes both.
The list of files opened in this browser. When a dossier is being prepared,
your browser saves a note of it in its own local storage, under the name
petplot.recent-cases.v1, so that the upload page can offer you the way back if
you lose the address. Each entry is the dossier's reference (the random
identifier in its address) and the time this browser first opened it. Nothing
else is saved: no photograph, no name, no email address. The list holds at most
five entries and stops listing each one after the period an unpaid file is kept
(see section 8), removing it from storage the next time the list changes — you
open another file, or press FORGET THESE. It stays in your browser: it is never
sent to us and we cannot read it. Anyone who uses the same browser can see it,
and because the reference is the key to a dossier, they can open those
dossiers. To clear it, press FORGET THESE under the list on the upload page, or
clear this site's data in your browser's settings. Destroying a dossier from
its own page also removes it from the list in the browser you used.
The bot check on the upload page. The upload page loads Cloudflare Turnstile, a check that tells people apart from automated scripts before a photograph is accepted. It is loaded from Cloudflare's own servers (challenges.cloudflare.com) and runs inside the page. To decide, Cloudflare processes signals from your browser and connection, which Cloudflare's Turnstile privacy addendum lists as including your IP address, a fingerprint of your browser's secure connection, the browser's User-Agent header and the site the check is running on. Cloudflare's developer documentation for Turnstile states that it does not access, store or transmit user communications, form entries or other page inputs. When the check passes, our server sends Cloudflare the one-time token and our secret key, to confirm it — nothing about you beyond what the token carries; we do not send your IP address or anything about your photograph. Cloudflare runs the check for us, and also uses the signals, under its own legitimate interests, to improve its bot detection; for that second use Cloudflare decides how the data is used, under its own privacy policy. Cloudflare's own paperwork splits the two the same way: it is our processor for the check, and its own controller for improving its bot detection, and only the first half is inside the agreement we have with it.
What it leaves in your browser. We measured this on our own page rather than take anyone's word for it. After the check passes, this site's storage holds no Cloudflare cookie, no Cloudflare entry in local storage and no Cloudflare database. Cloudflare's cookie policy does name cookies for a feature it calls pre-clearance; that feature is off unless a site turns it on, and we could not turn it on if we wanted to, because it requires the site to sit behind Cloudflare's own network and this one does not. What the widget keeps inside its own frame at challenges.cloudflare.com we cannot see — that frame belongs to another site and our page has no way into it — and Cloudflare does not say.
One limit on that measurement, and it is worth stating plainly: we made it with Cloudflare's published test key, which always passes and never puts an interactive puzzle in front of you. A real visitor can be shown one. We have not measured what an interactive challenge leaves behind, so read the paragraph above as covering the check that passes silently, which is the one almost everybody gets.
Where it happens, and for how long. Cloudflare publishes neither. Its data-localization documentation says Turnstile cannot be confined to a region; its privacy policy says it stores information primarily in the United States and the European Economic Area; and its retention section gives criteria rather than any number of days. That is why section 6 treats the bot check as a transfer that may leave the EEA.
Two more things sit outside our control. Stripe's own pages, which you visit when you pay, set their own cookies under Stripe's policy. And if you share your dossier and someone opens the link from a social platform, that platform's preview crawler will have fetched the preview image.
12. Security#
- Storage is private. Every file is served through a signed link that expires after an hour.
- A dossier's address is a random 122-bit identifier, and the public share address is a second, independent random identifier. Neither can be guessed, and neither can be worked out from the other.
- Because there are no accounts, your dossier's address is the key to it. Treat it like a password. Anyone you send it to can open it. The share address is the one designed to be posted publicly.
- Card data never touches our servers.
13. Children#
The site is not directed at children and is not intended for anyone under 16. We do not knowingly process children's data. If a child's photograph has been uploaded, write to contact@pet-agon.com and we will delete it.
14. Changes to this policy#
If we change this policy we will update the date at the top. If a change is significant, we will describe it here in a short note rather than leave you to compare versions.
25 September 2026. Section 3.7 added: we record the campaign labels in the link you arrived by, on the basis of our legitimate interest (Art. 6(1)(f)). Sections 2, 4 and 11 changed to match.
13 October 2026. Section 11: the daily counts now also include how many times the home page was opened from a labelled link and how many uploads were started.
14 October 2026. Section 11: the daily counts now also include how many times the home page was actually viewed and how many times the upload button on it was pressed.
19 October 2026. Section 3.8 added: if you arrive from one of our Meta ads and upload a photograph, we send Meta Platforms Ireland the click id and your browser's user agent string, on the basis of our legitimate interest (Art. 6(1)(f)). Sections 2, 4, 5, 6 and 11 changed to match.
15. Complaints#
If you think we have handled your data badly, please tell us first at contact@pet-agon.com. Most things are quicker to fix directly.
You also have the right to complain to a supervisory authority. In Poland that is:
Prezes Urzędu Ochrony Danych Osobowych (UODO)
ul. Stawki 2, 00-193 Warszawa, Poland
uodo.gov.pl
If you live in another EEA country, you may complain to your own national authority instead.