Privacy Policy

Last updated: 26 October 2026

Who we are

Pictofy is operated by Pictoday (CVR 30059891), Børkop, Denmark. Contact: support@pictofy.app.

Controller or processor?

The role depends on how Pictofy is used:

• Private use: Pictofy (Pictoday) is the data controller for your account, purchases, and the operation of the service. For photos and information about children that you add yourself, you decide the purpose — you must have consent from the holder of parental responsibility, and we process them only to deliver the service to you.
• Institutional use (schools, institutions, municipalities): The institution is the data controller for pupil/citizen data (profiles, photos, schedules), and Pictofy is the data processor, processing only under instruction. We sign a data processing agreement (the Danish DPA's standard template) — contact us at support@pictofy.app.

What we store

• Account information: Email address, password (encrypted), licence/organisation membership
• Purchase history: Credit purchases, subscriptions and physical orders (via Stripe); delivery address on physical orders
• Generated pictograms: Prompt, style, image, metadata
• Photos and characters: Uploaded photos and their generated style variants — both in private, access-protected storage (see below)
• Profiles and schedules: Child profiles (name, optional age, avatar), visual schedules and share links. Profiles can be shared with colleagues you choose

What we do NOT store

• Payment card details (handled by Stripe)
• IP addresses (only temporarily for free generation, deleted after 90 days; country is read at the network edge without third-party lookups)
• Third-party tracking cookies. Product analytics (PostHog, EU-hosted) runs only with your consent; ad measurement (Meta pixel, Google Ads) only with your marketing consent

Photos and children's data

• Original photos are used for photo restyling and character creation with an image model we run ourselves on EU/EEA servers (RunPod; standby: Nebius). Subsequent pictogram generation uses a saved illustrated character reference in OpenAI, with no automatic fallback to the original photo.
• OpenAI receives the image description and, where relevant, the character pixels. For Flare pack quality review, OpenAI also receives the final pictogram pixels and any illustrated pose guide. We do not attach account names, user IDs, profile names, original filenames or image metadata. Do not enter names, contact details or sensitive information in your description. Text processing aims to remove identifying information, but is not a guarantee of anonymisation.
• An illustrated character may still be personal data, for example if recognisable or linked to a profile. OpenAI may process inputs and outputs outside the EU/EEA. API content may ordinarily be retained for up to 30 days for abuse monitoring, subject to exceptions such as legal requirements. We promise neither EU inference nor zero data retention for this processing.
• Uploaded photos and their generated style variants live in private, access-protected storage — never on a public CDN.
• Pictograms made from photos are always private and never used in galleries or marketing.
• You can delete characters, profiles and photos at any time — deleting a profile deletes its schedules, share links, character and photo.
• Only adults (16+) can create an account. If you upload a photo of a child, you must have consent from the holder of parental responsibility. If you discover an account created by a child, contact us.

Preview cards without an account

When the free preview is available, adults can choose a routine and make a character from a photo or our illustrated parts. The sample shows three activities from the chosen routine. We do not ask for names, diagnoses or custom image descriptions. The look can still be personal data if you use it to represent a particular person. The character and cards stay private and are not used in the library or marketing.

Uploading requires you to confirm permission to use the photo. Image metadata is removed before processing. The photo is converted using an image model we run ourselves in an access-protected setup with RunPod on EU/EEA servers. The photo is deleted from our temporary storage after successful conversion when no longer needed. You approve the illustrated character before cards are made. Only the approved character pixels and selected activities are sent to OpenAI to make and review cards; the original photo is not sent to OpenAI. Builder characters are processed in the same way. Account details and network addresses are not sent to the image model. OpenAI does not use API content for training by default, but may retain content in abuse-monitoring logs for up to 30 days, subject to exceptions in its policy. Our delete button does not delete these provider logs.

An essential protected cookie gives this browser access to the preview for up to 24 hours. Access then closes and temporary files are deleted by the next successful automatic cleanup. You can also choose “Delete my preview”. Work already in progress may finish before the last files are removed. We retain one-way preview and network identifiers to limit abuse and costs; these are removed after 48 hours during successful cleanup. We do not store the raw IP address in the preview data.

Routine choices, language, market, selected method and the builder recipe are kept in a versioned draft in this browser tab’s session storage for at most 24 hours. The recipe includes choices such as hair and clothes and may be personal data. The draft restores your choices after reloading or navigating back. Photos, generated images and access tokens are not stored in the draft. “Delete my preview” also removes the draft.

If you go to checkout with your preview, we attach a separate private copy of the character, the completed sample cards and two routine choices to the order so we can deliver the purchase after the preview expires and on another device. The order has its own essential protected cookie for up to 48 hours. The character, images and routine choices are not sent to Stripe. Once payment and your email are confirmed, the copy is transferred to your account and the temporary order copy is cleaned up. A paid order you have not yet opened is retained for delivery; it does not expire with the free preview.

Order copies for abandoned checkouts are cleaned up after payment is confirmed expired and unpaid. Cleanup checks abandoned orders after 48 hours; an order without a payment session can only be closed when no work is running. Order copies are also cleaned up after a full refund or deletion of the owner’s account. “Delete my preview” deletes the free preview, but does not cancel a payment or automatically delete the order copy. Contact us for help with order data.

When you save the preview to your account, we also keep a protected reference cookie for up to 24 hours so this browser can return to your saved result after reloading or signing in. It contains only a random identifier, not images, email or character appearance. The cookie does not grant access by itself: you must be signed into the account that owns the result. Reloading does not extend its lifetime.

If you choose to keep the preview in an account, we ask for your email and send a sign-in link. Only after verified sign-in are the character and cards saved as private account items, with the account’s usual deletion rules. This does not trigger a purchase or marketing consent. PDFs you download stay on your own device. Product measurement still requires your analytics consent; character choices, images and email are not included in preview analytics events, and the page is excluded from session replay.

To monitor the free preview, the server sends separate anonymous operational counts to PostHog in the EU: attempts, admitted and rejected starts, completed and failed previews, and spending limits reached. Each event receives a new random identifier, so events are not linked to a person or browser. These counts use no tracking cookies and contain no user, preview or network identifiers, IP address, email, photos, character choices or image descriptions. Optional product analytics of your journey still requires your analytics consent.

Community and marketing

Pictograms generated from text alone may appear in our library, gallery, or marketing. Pictograms generated from photos (the character and image features) are never used for those purposes.

Sub-processors

We use the following services to deliver Pictofy. For institutional customers, subprocessors are also listed in the DPA's annex, and we give 30 days' notice of changes.

None of the AI services use your data to train models.

SCCs are the European Commission's standard contractual clauses for transfers of personal data. We also assess the recipient country's rules, the actual processing and necessary supplementary measures. Signing SCCs alone does not establish an adequate level of protection. Institutions receive notice of new subprocessors under their data processing agreement.

Data retention

• Account, pictograms, profiles and schedules: as long as the account exists
• Unsaved generations, unused uploaded photos and intermediate image-generation input copies/PNG masters: deleted after 90 days
• IP logging for free generation: deleted after 90 days
• Sent email contents: deleted after 12 months
• On account deletion: account, pictograms, photos, characters, profiles and schedules are removed immediately. Private intermediate files from in-flight image jobs are removed by the next scheduled cleanup, no earlier than one hour after deletion, so running jobs can finish. Bookkeeping-relevant purchase data is retained as required by accounting law

Your rights (GDPR)

• Access your data — contact us for an overview
• Rectification of incorrect data — update it yourself, or contact us
• Erasure — use "Delete account" under Account, or delete individual characters/profiles directly
• Data portability — contact us for an export
• Complaint — you can complain to the Danish Data Protection Agency (Datatilsynet), www.datatilsynet.dk

Security

Data is stored with Supabase in the EU (Frankfurt) with encryption in transit and at rest, row-level access control, and access-protected file storage for photos. Two-factor login (TOTP) can be enabled under Account. In case of a personal data breach we notify affected controllers without undue delay.

Changes

We may update this policy and will announce material changes on this page. Institutional customers are notified directly of changes to the sub-processor list.

Contact

Questions about personal data: support@pictofy.app