Privacy Notice
Last updated: 29 September 2026 · Version 2026-09-29
Data controller: ABiao (sole proprietor, trading as BIGBROSTUDIO). This notice covers orders, accounts, chat, subscriptions, analytics and the photographs processed to create your artwork.
1. Information we collect
When you order, sign in, send a message or subscribe, we process information you provide, which may include:
- your email address, name and optional contact details;
- service, style or restoration type, package, delivery option and subject count;
- your brief, requirements and correspondence;
- your pet, people, old photographs and reference images;
- order status, preview-approval deadline, whether a reply was received, payment-notification channel, payment evidence, refund or dispute and delivery records;
- login identifiers, hashed network address and necessary security signals.
The site uses Cloudflare Turnstile to distinguish people from automated traffic. Our application database stores only a hashed IP address for short-term rate limiting, not a plain IP address. Hosting and delivery providers may still process basic access logs for security, abuse prevention and operations.
2. Purposes and legal bases
We use information to perform your order and contract, answer enquiries, create and deliver artwork, process payment, refunds and support, prevent abuse and protect the site, comply with accounting or legal duties, and — where you consent — send updates or display artwork. Depending on your jurisdiction, the legal bases may include contract performance, consent, legitimate interests and legal obligations.
- to answer enquiries and confirm scope, price and turnaround;
- to produce a preview and send it for approval before payment;
- to send approval-deadline, no-reply and payment-link notices and retain the related processing record;
- to create, revise, quality-check and deliver the artwork;
- to handle payment, refunds, disputes, after-sales and necessary records.
3. Photos, generative AI and artwork files
Your photographs, previews and final files are stored in private Cloudflare R2 storage and can only be accessed by an authorised administrator through a protected interface. We use them for the portrait, restoration, revisions, quality control, delivery and support for that order. We do not proactively use them to train models, for unrelated development or for unrelated commercial purposes.
Previews shown before payment contain a repeating BIGBROSTUDIO watermark and are compressed into a smaller review file. The complete final file is stored separately and remains locked until payment. This prevents unpaid files from being used directly without preventing you from reviewing composition, subject and the main visual result.
As disclosed in the Terms, we may use generative AI for assisted generation, followed by human refinement and quality control. If processing requires an external AI or technical provider, files are provided only as necessary for that order. We require providers to process data under contract and their privacy terms, but a provider's retention period remains governed by its own terms. If you do not want generative AI used, state that in the order notes and we will confirm whether the brief can be accepted.
4. Cookies and tracking
The site does not use advertising cookies to profile visitors and does not include third-party advertising or review widgets. Turnstile and Cloudflare may use essential security cookies or similar technologies. Resend is used for order notifications and subscription emails under its own privacy policy.
5. Third-party services and international processing
The site uses Cloudflare for hosting, acceleration, the D1 database, private R2 storage, Turnstile and access logs; Resend for order and subscription email; PayPal for payment and refunds; and, where required for production, contracted AI or image-technology services. PayPal processes payer information under its own privacy policy. We do not store full card numbers or PayPal passwords in our database.
These providers may process data in other countries or regions as necessary to provide their services and use contractual, security or compliance safeguards. We use them only where directly related to order fulfilment, payment or site security.
6. Retention and automated deletion
Order correspondence, status logs and payment records are kept for a reasonable after-sales, accounting and dispute period. For orders marked completed, cancelled or refunded, a daily system job deletes customer source photographs from R2 and removes the related file records, with a target of completing deletion within 30 days after the order ends. Exceptions apply where a dispute remains open, a legal retention duty applies, or you expressly ask us to retain files for a future order.
Preview and final-file download access is governed by the expiry configured in the admin system; files are deleted or archived when no longer needed. Subscription details are kept until you unsubscribe, after which we may retain a minimal suppression record. Infrastructure logs and Turnstile security data are retained according to provider configuration and security requirements.
7. Your rights
Where applicable law provides them, you may request access, correction, deletion or restriction, object to legitimate-interest processing, withdraw consent, request a portable copy, or refuse public display of artwork. For any request related to a specific order, please leave a message directly on your order tracking page; you may also submit a request through the online order page marked “privacy request” with your order number. We will respond within the applicable period. You may also complain to your local data-protection or consumer authority.
8. Analytics
We record anonymous visit data such as page path, referring domain, device type, browser, language, country or region and visit time. We do not collect your name, email address, order content or photographs, and we do not use cookies for cross-site tracking.
Visitor identifiers are generated by one-way hashing of network and browser information with a daily-rotating key. Detailed events are kept for 90 days, hourly data for 30 days, and daily or dimensional aggregates for three years. If DNT / GPC is enabled, the site skips this analytics.
9. Security, minors and changes
We use access controls, private object storage, rate limiting and security checks, but no internet transmission or storage is absolutely secure. The service is intended for people able to make their own purchasing decisions; minors should order with a guardian's consent and assistance. Material changes to this notice will be identified by a new date and version.
10. Contact us and order communications
For file deletion, privacy inquiries or data requests concerning a specific order, please leave a message directly on your order tracking page so we can locate and handle your request promptly. For general inquiries not tied to an order, you may reach us through our on-site customer service chat.