Privacy Policy

Last updated: 2026-10-08 · Regal Paws (petportraithq.com), operated by KunStudio.

1. Information We Collect

We collect minimal data to operate Regal Paws:

Photos you upload: the pet photo you upload, used solely to generate your portrait (and the watermarked preview described below).
Preview limit data: when you ask for the watermarked preview, a random device ID in a cookie, a one-way (SHA-256) hash of your IP address, and per-day counters.
Analytics data (via Google Analytics 4): device and browser type, pages visited, approximate region (Google Analytics 4 does not log or store IP addresses), and interaction events. Collected through cookies and similar identifiers.
Information you provide: only if you contact us or submit a form (e.g. email address).
Payment data: processed securely by PayPal; we keep the buyer email PayPal returns (or the one you type) for the result copy email described below. We do not store your card or bank details on our servers.

2. How Your Photos Are Handled

Uploaded photos are transmitted securely (HTTPS) to our AI processing provider fal.ai and stored on fal's media storage in order to generate your result. We do not keep copies of your photos on our own servers, we do not use your photos to train AI models, and we never sell or share them. See the fal.ai Privacy Policy for the provider's handling. To request deletion of an uploaded photo or generated portrait, contact us at the address below and we will process the request with our provider.

If PayPal holds your payment for review. While a payment is pending, your browser keeps the order number, the request needed to finish your order and a copy of the photo you uploaded in its local storage on your own device (not on our servers) for up to 7 days, so the page can finish your order when PayPal releases the payment, even if you close the tab. It is removed as soon as the order completes or ends. You can clear it any time by clearing this site’s data in your browser.

Watermarked preview (before payment). If you press the preview button, your photo is sent to fal.ai at that moment — before you pay — to paint one portrait in the style you chose, using the same model as the paid portrait. The preview is not a free portrait: our server downloads the result only to shrink it to about 512 pixels on its longest side, burn a visible “PREVIEW” watermark across it and send your browser that small JPEG. The address of the full-resolution portrait stays on our server and is not sent to your browser until you pay. If you then pay for the same photo and style, that same portrait is delivered (it is not generated twice). We keep a preview record (the address of the portrait, the style and a fingerprint of your photo, no image data) in our hosting key-value store for 6 hours and then it is deleted automatically. The portrait itself is hosted by fal.ai as described above, so it exists there even if you never pay.

Preview limit. To stop abuse, each device and each IP address can request only a few previews per day, and the site has a daily total. For this we set a cookie named ks_pv holding a random device ID (kept up to one year) and keep, for two days, counters keyed to that ID, to a one-way SHA-256 hash of your IP address (we do not store the IP address itself) and to the day. A hash of an IP address is still pseudonymous data, not anonymous. The counters hold no photo.

3. Cookies & Tracking

We use analytics cookies (Google Analytics 4) to understand usage and improve the service. These are non-essential. We do not use advertising cookies. Cookies collect device type and browsing behavior (Google Analytics 4 does not log or store IP addresses); retention follows the setting on our Google Analytics property, currently 2 months for event-level data. You can block cookies via your browser settings. The preview step also sets one functional cookie, ks_pv (random device ID, up to one year), used only to apply the daily preview limit; if you block it, the limit is applied by IP address and site-wide instead.

Cookie choice (EEA, UK and Switzerland). If you visit from the European Economic Area, the United Kingdom or Switzerland, a banner at the bottom of the page asks for your choice. Google Analytics storage stays off (Google Consent Mode “denied”) until you press Accept; Decline keeps it off. Visitors elsewhere are not shown the banner and Google Analytics runs as described above. Your choice is saved in your browser’s local storage (ks_cc) and in the ks_consent cookie (one year), so every page of the site uses the same choice. You can change it at any time with Change cookie choice. If you decline or withdraw, we delete the Google Analytics cookies (_ga and _ga_*) already set in your browser. While Google Analytics storage is off, Google may still receive cookieless pings about page views and events (no analytics cookies are set and no persistent identifier is stored in your browser).

4. How We Use Data

To provide and improve Regal Paws, analyze aggregate usage, and respond to inquiries. We do not sell or share your personal information for cross-context behavioral advertising.

5. Third Parties

fal.ai — AI image processing. See fal.ai Privacy Policy.
Google Analytics — usage analytics. See Google Privacy Policy. Google processes data as described in its policy.
PayPal — payment processing. See PayPal Privacy Statement.
Cloudflare — hosting and security.

6. Your Rights

EU/UK (GDPR): You have the right to access, correct, delete, or restrict processing of your data, and to withdraw consent at any time. Non-essential (analytics) cookies are used only with your consent where required.

California (CCPA/CPRA): You have the right to know, delete, correct, and opt out of the sale/sharing of personal information. We do not sell personal information and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of; you may also use your browser's privacy controls. To exercise rights, contact us below.

Other regions: We apply these protections to all visitors regardless of location.

7. Data Retention

Your order record (PayPal order number, product, status, portrait link, the buyer email addresses described below and, for framed prints, the shipping address PayPal gives us) is kept for 90 days and then deleted automatically. Preview records and preview-limit counters are kept for 6 hours and 2 days respectively, as described in section 2. Our servers keep no copy of your photo or portraits. Files our image provider (fal.ai) holds stay under fal.ai’s own storage settings: we set no expiry and run no deletion job, so we cannot state a deletion date (fal.ai’s documentation says request inputs and outputs are kept for 30 days by default). Email us the order ID to have them deleted; we will request it from fal.ai. Event-level analytics data is retained for 2 months — the period currently set on our Google Analytics property; aggregate reports remain after that. Contact/inquiry data is kept only as long as needed to respond, then deleted.

Result copy email (after purchase)

After you pay, we email you one copy of your results and your order details (payment confirmation, PayPal order number and the link to your portrait). The recipient is the address you type in the optional email field next to the PayPal buttons or, if you leave it empty, the email address of your PayPal account as returned to us by PayPal. We use the address only to send this message and do not keep it in our order records, except that it is stored in your order record for the 90 days stated in section 7. To enforce a daily limit and avoid duplicate sends we keep, for 90 days, a marker that a copy was sent for the order (it holds a shortened one-way hash of the address, not the address) and, for 2 days, a list of order numbers per address hash. The message is sent through our Gmail account (Google), so a copy stays in that mailbox's sent folder until we delete it; email us to have it deleted. The link points to a file hosted by our image provider and may expire. If a copy cannot be delivered (for example during a Gmail outage, or when one address has already received copies of several other orders today), the address and the composed message are kept for up to 7 days so we can resend it by hand, then deleted automatically; nothing is resent automatically.

Feedback, referral and share buttons

Feedback button. If you use it, the message you write, the optional email address you type, the feedback type, the page you were on, the first 160 characters of your browser’s identification text (User-Agent) and your country are sent to KunStudio’s own feedback endpoint (sajuapp.app, run by us). They are saved in a file in a GitHub Gist controlled by us (GitHub, Inc., United States) that keeps the most recent 500 entries with no other time limit, and the message, page and email are forwarded to the operator in a Telegram message. Do not put anything confidential in the message. To have an entry deleted, email us.
Referral code. This runs whenever a page with the referral widget loads, whether or not you click anything. Your browser creates a random visitor ID (kept in local storage as ks_vid; the referral code in the link you followed may be kept as ks_inbound_ref) and sends it with the product page to KunStudio’s referral endpoint (sajuapp.app). The endpoint combines the ID with your IP address and browser type into a one-way SHA-256 key (the IP address itself is not stored), issues you a referral code and records the code, the key, visits and conversions in a file in the same GitHub Gist. It holds no name or email. You can clear the ID in your browser; email us to have a record deleted.
Share buttons. When you press a share button the site sends a one-line ping (product and channel, no content) to KunStudio’s own endpoint (sajuapp.app) to count shares. The share itself goes to the service you pick.

8. Contact

For any privacy request or question: [email protected] (KunStudio). We respond within a reasonable timeframe.

← Back to Regal Paws

Operator alerts and international transfers (added 2026-10-07)

Operator alerts. When a paid order succeeds, fails or needs attention (for example a failed delivery, a payment check flag or a failed result email), our server sends the operator a Telegram message (Telegram) with the PayPal order ID, the product code, the amount and a short reason. It contains no photo and no text you typed. Telegram processes it on servers in various countries.

Framed prints (not offered yet). If a framed print is ordered, the shipping address PayPal returns is stored in the order record and passed to Printify, Inc. (United States) and its print partner to make and ship it (privacy policy); we cannot state their retention period.

Korea (PIPA Articles 26 and 28-8). The providers named in this policy (our image provider, PayPal, Google, Telegram and Cloudflare) process data on our behalf outside Korea, mainly in the United States, over the internet at the moment you use the feature that needs them (upload, preview, payment, generation, email). The items sent, the purpose and the retention are the ones described in this policy; you may refuse by not using that feature, but the service cannot be provided without it. Privacy officer (개인정보 보호책임자): Hong Deokhun (홍덕훈), 070-8018-7832, [email protected]. You may ask to view, correct, delete or suspend processing of your personal information, or withdraw consent, at any time.

KunStudio (쿤스튜디오) · Representative: Hong Deokhun (홍덕훈) · Business Registration No. 552-59-00848 · Mail-order business report No. 제2026-경북경주-0237호 (경주시장, reported 2026-05-20) · 25-52, Jenaemosan-gil, Oedong-eup, Gyeongju-si, Gyeongsangbuk-do, Republic of Korea · Tel 070-8018-7832 · [email protected]