Privacy Policy

Effective 25 August 2026 · Version 1.0

Altered Us turns photographs you submit into custom artwork, printed as a physical product. This policy explains what personal information we collect, why, who we share it with, how long we keep it, and the choices you have.

Photographs may contain facial characteristics that can be processed in ways that constitute biometric information under certain applicable laws. Our biometric practices are described in detail in our Biometric Information Retention & Destruction Policy, which forms part of this policy.

Data minimization

We collect and retain only the information reasonably necessary to operate Altered Us, create and fulfil your order, provide customer support, maintain security, comply with law, and protect our legal rights.

What we collect

• Account information — your email address, and authentication information used to sign you in. We do not use passwords for customer accounts; you sign in with a link sent to your email.
• Submitted content — photographs you submit and the description you write of how you would like them transformed.
• Generated artwork produced from your submission.
• Upload metadata — technical details such as image dimensions, recorded so we can assess print suitability.
• Order records — product sizes, order status, approval and revision history, tracking numbers, and carrier.
• Shipping address, collected at checkout so your order can be delivered.
• Payment-related identifiers — transaction and payment identifiers, amount, currency, and a receipt link. We never receive or store your full payment card number.
• Consent records — that consent was given, the version of the consent text shown, the timestamp, and the IP address it was submitted from.
• Technical and log information — IP address, browser and device information, request timestamps, and similar information generated automatically when you use the site, used to operate and secure it.
• Communications — email we send you about your order, records of delivery, and any customer-support correspondence you have with us.
• Security and fraud information — information used to detect, investigate, and prevent abuse or unauthorized access.

Photographs are processed in your browser to remove embedded location (GPS) and other metadata before they are uploaded. We additionally verify this after upload: a photograph that still contains such metadata is rejected and deleted rather than stored. We do not use embedded location information for any purpose.

Why we use it

To create the artwork you ordered, to produce and ship your order, to review orders before generation, to contact you about your order, to provide support, to secure our services and prevent fraud, and to meet our legal, tax, and accounting obligations.

We do not use submitted photographs or generated artwork to train artificial-intelligence models, and our image-processing providers have confirmed that they do not either — they do not retain submitted photographs after processing.

We do not sell personal information for monetary consideration, or use biometric information as an independent data asset. We use photographs and information derived from them only as reasonably necessary to create and fulfil the products and services you request.

We may display generated artwork as an example of our work only with your separate, explicit permission, asked for at the time. Ordering never implies that permission.

Cookies and similar technologies

We use only cookies and similar technologies that are necessary to operate the website, authenticate users, maintain security, and provide requested functionality. We do not currently use advertising cookies or third-party advertising trackers. Our payment provider may set its own cookies on its hosted checkout pages, governed by its own policy.

Who we share it with

We share personal information with the service providers below, only as needed to run this business. Each may also collect its own technical information — such as IP and log data — under its own privacy policy.

• Supabase (United States) — hosts our database and private file storage: your account, orders, submitted photographs, and generated artwork.
• Replicate, running Google's image model — receives your submitted photograph and the description you wrote, in order to generate your artwork. They do not retain your submitted photograph after processing, and do not use it to train artificial-intelligence models.
• Printify and its print providers — receive the final artwork file required to manufacture your product, together with the name and shipping address needed to deliver it. They do not receive your original submitted photograph unless required for a particular service.
• Stripe — hosts checkout, processes your payment, and collects your shipping address, which it returns to us for fulfilment. Card details are handled by Stripe; we do not receive them.
• Cloudflare — serves this website and manages our domain, and processes request and security log information.
• Resend — sends transactional email about your order. Zoho Mail — hosts the mailboxes we correspond with you from.

We may also disclose information where required by law or valid legal process, or to establish, exercise, or defend legal claims.

Business transfers

If Altered Us is involved in a merger, acquisition, financing, reorganization, sale of assets, or similar transaction, personal information may be transferred as part of that transaction. We will provide notice where required by applicable law.

How long we keep it

• Photographs and generated artwork — per the schedules in our Biometric Information Retention & Destruction Policy: submissions deleted on approval, generated artwork retained up to six months solely so you can view and reorder it, and an absolute three-year limit.
• Order, consent, transaction, and support records — retained after the images are deleted, for tax and accounting obligations, to prove that consent was obtained and that our deletion schedule was honoured, for fraud prevention and security, for customer-service history, and to establish or defend legal claims. We retain these records only as long as reasonably necessary for those purposes and as required by applicable law.

Consent records do not contain the submitted photograph or biometric information, although they may contain personal information such as an account identifier, IP address, timestamp, and consent version.

How we protect your information

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration, or destruction. These include:

• private object storage that is never publicly accessible;
• database-level access controls that restrict each customer to their own records;
• encryption in transit;
• an internal review console requiring a credential separate from customer accounts;
• automated, scheduled deletion rather than manual deletion;
• tamper-resistant consent and deletion audit logs;
• secrets held in a managed secret store, never in our code; and
• managed, backed-up database infrastructure.

No method of transmission or storage is completely secure. If we determine that a security incident has affected your personal information, we will provide notices required by applicable law.

Your privacy rights

Depending on where you live and whether applicable law applies to our business, you may have rights to:

• access or obtain a copy of personal information;
• correct inaccurate personal information;
• request deletion;
• obtain information about the categories and purposes of processing;
• opt out of certain sales or sharing of personal information;
• limit certain uses of sensitive personal information;
• appeal a decision regarding a privacy request; and
• avoid unlawful discrimination for exercising applicable privacy rights.

These rights are subject to applicable legal exceptions and limitations.

Separately, and regardless of the above, you can cancel an order from your account at any time before it enters production. Your submitted photographs and any generated artwork are deleted immediately, and if you have paid, you are refunded in full.

How to exercise a privacy right

Contact privacy@alteredus.com. Please identify the nature of your request and provide enough information for us to locate the relevant information. We may request information reasonably necessary to verify the identity of the person making a request and, where applicable, their authority to act on behalf of another person. We will respond within the time required by applicable law.

If you are dissatisfied with our response, you may have the right to appeal, or to contact your state's attorney general or other applicable regulator.

What we do when a request arrives

We will promptly acknowledge the request and, where appropriate, temporarily restrict further processing while we verify the request and determine what action is required by applicable law. Where deletion or cessation of processing is required, we will take appropriate steps to comply, including instructing our service providers where applicable, and we document the request and the action taken.

Once an order has been physically produced we may be unable to recall the printed item, but we can still act on the underlying digital information.

If you appear in a photograph someone else submitted

You may contact privacy@alteredus.com even if you have no account with us. The process above applies, including verification — we may need information reasonably necessary to confirm your identity before acting on a request about someone else's order.

Children and minors

Altered Us does not knowingly provide accounts directly to children under 13, and our accounts are intended for adults.

Our services may process photographs containing minors. If a submitted photograph contains a minor, the person submitting it represents that they are the minor's parent or legal guardian, or that they have obtained authorization from the parent or legal guardian sufficient to submit the photograph and authorize the processing described at upload.

We do not knowingly use biometric information derived from children's photographs for advertising, profiling, AI-model training, or purposes unrelated to fulfilling the customer's order.

Where we operate

Altered Us sells to customers in the United States, and our data is stored in the United States. We do not currently ship outside the United States.

Changes to this policy

If we change this policy we will update the version and effective date above. Material changes to what we collect or how we use it will also be reflected in the consent you are asked to give at the time of submission.

Contact

Privacy questions and requests: privacy@alteredus.com. Order questions: orders@alteredus.com. Security reports: security@alteredus.com.