Privacy

We use Google Analytics 4 and first-party checkout reports to understand visits, photo preparation, checkout, payments, and agent API/MCP usage. Measurement includes random identifiers, page categories, device/browser information, upload format and size/resolution ranges, crop choices, product quantities, coupon savings, payment method, wallet type, network/token, general error categories, and confirmed purchase/refund totals. We do not send photo contents, filenames, delivery/contact fields, account identifiers, wallet addresses, card details, private links, credentials, or signatures to Google Analytics.

Updated October 25, 2026.

Email updates and preferences

We use your contact address and order details for confirmation, shipping, and support emails. Delivering these messages requires processing the recipient address and message contents through contracted email services. Marketing emails require an opt-in. You can change this preference in your account or unsubscribe using the link in a marketing email. We store your preference, consent record, and delivery status separately from website analytics.

Information used to fulfill your order

PhotoPrintAgent receives your sign-in identifier and available profile details, uploaded photos, crop choices, and delivery/contact information. We use this information to prepare quotes, fulfill orders, and provide support. When you sign in, we prefill checkout with the contact and delivery details from your most recent order. You can change them before ordering.

Photos and records are stored in the United States. We automatically calculate pricing using your print selections and delivery address. Price estimates use the destination and public sample artwork. After you confirm print permission and continue to checkout, we share your photos and contact details with contracted printing and delivery services as necessary to prepare and deliver your order. New card, Apple Pay, and Google Pay payments are handled by Square’s secure payment form embedded in PhotoPrintAgent; card details do not pass through this application’s server. Earlier Stripe orders retain their original payment records for status checks and support.

Guest checkout does not require an account. A private token controls access to the guest’s photos and orders; an order-specific checkout link lets the buyer pay and check status. Guest order access and checkout links expire after 30 days. Keep these credentials private.

Support requests

When you use our support form, we collect your name, reply email, topic, optional order reference, and message to help you. Requests are sent to our support team using our email service. Form records are retained for up to 90 days; support email correspondence is retained as needed to resolve your request. Message contents and contact details are not sent to Google Analytics.

Order security and abuse prevention

For website, API, and MCP order requests, we keep private security records linking the order to the authenticated account or guest identity, authentication method, non-secret agent-key or OAuth connection references when available, request time and identifier, action, response status, and the version of the order terms accepted. We also record the network peer IP, reported forwarding IP addresses, browser or agent User-Agent, reported site origin, and optional client-reported MCP agent name and version from request headers or a recent authenticated connection initialization. A matching initialization is retained for up to 30 days to associate later calls with that reported client; shared credentials may be used by more than one client. These network and client details can be incomplete or spoofed; they are not proof of a person’s identity or location.

We use these records for order support, fraud and abuse investigations, security, and lawful requests. They are restricted to authorized operations and are not sent to Google Analytics or included in customer-facing order or MCP responses. Security logs do not copy order artwork, delivery details, prompts, complete request bodies, passwords, authentication tokens, card data, or payment signatures. The underlying order and payment records remain separate. Essential security logging continues when you opt out of analytics.

Security request records normally become eligible for deletion after 180 days and are removed by scheduled cleanup. Relevant security records may be kept longer under a documented legal or investigation hold and return to cleanup after the hold is released. Authorized administrators must provide a case reference and reason to export these records or change a hold; those actions are recorded. Older orders may not have this information, and deleted records may not be recoverable.

Cooperation with lawful requests

We cooperate fully with valid, lawful requests from courts, law enforcement, regulators, and other competent authorities, and comply with legally binding process. Before disclosing information, we review the request’s authenticity, legal basis, jurisdiction, and scope. We provide only information in our possession or control that disclosure is required or permitted by applicable law. A request alone does not authorize unrestricted access to customer data.

Depending on the request and applicable law, relevant records may include account and order information, uploaded content, delivery details, payment records, and private order security logs. We may preserve relevant records for a valid preservation request, legal hold, or lawful investigation. Where required or permitted by law, we may report suspected unlawful activity or disclose relevant information to protect people from serious harm, report child exploitation, or protect the security of the service. We may notify affected users where legally permitted and appropriate; notice may be withheld when prohibited by law or when it would compromise an investigation. Send legal and privacy inquiries to support@photoprintagent.com.

Retention and access

Uploaded photos remain stored until deleted or an account-removal request is processed. Photos can be used in new orders for 30 days. Order and account records are retained for fulfillment and support. Contracted storage, printing, delivery and payment services may retain processing records under their own retention policies. API keys grant access to your account’s photos and orders; revoke unused keys.

Wallet payments

Crypto payments use public blockchain transactions. Wallet addresses, transaction amounts, and transaction history are public. Photos and delivery addresses are not intentionally included in the payment transaction.

Address suggestions

When you type a delivery address, Google Maps receives the search text to suggest matching addresses. You can also enter your address manually. Google handles this information under its Privacy Policy.

Analytics and checkout progress

Google Analytics uses a random browser identifier and analytics cookies with a 60-day lifetime. Google processes measurement data under its Privacy Policy. Advertising storage, personalized ads, and Google signals are disabled. Our first-party checkout sessions are kept for up to 30 days. Server delivery records expire after seven days; anonymous opt-out suppression records expire after 90 days. Order records may retain an anonymous measurement reference for confirmed payment reporting.

Browser Do Not Track and Global Privacy Control disable measurement. You can turn off analytics below; this preference persists on this browser, removes its Analytics identifier/cookies, deletes the current checkout progress session, and suppresses queued events associated with that identifier. Previously delivered reports are not deleted by this setting. API and MCP clients can send DNT: 1 or X-Analytics-Disabled: 1 to opt out; tool arguments, uploaded contents, and credentials are never included in analytics.

Campaigns and offers

Campaign links may save a campaign identifier in this tab for 30 minutes and record an anonymous visit. We honor Do Not Track and Global Privacy Control for visit recording. Campaign attribution and coupon savings can be attached to an order for marketing reports. Anonymous visit records expire after 30 days. Coupon eligibility uses hashed email counters to enforce per-customer limits. No contact lists are uploaded by the direct-mail preparation tool.

Your choices

We use Analytics for product and checkout measurement, with advertising features disabled. Removing an unsubmitted photo requests deletion from our storage if it was already uploaded. Photos attached to orders require a support request for deletion. For account deletion or a privacy request, email support@photoprintagent.com.