kept & co.

Privacy policy

DRAFT — requires review by a Cyprus-qualified lawyer before publication.

Privacy Policy — Kept & Co.

Last updated: 21 September 2026

Kept & Co. ("we", "us", "Kept & Co.") makes personalised pet-memorial products. This policy explains what personal data we collect when you use keptandco.eu, why, how long we keep it, and the choices you have. We've tried to write it in plain language rather than legal boilerplate — if anything is unclear, email us at hello@keptandco.eu and we'll explain.

Who we are

Philippos Aristotelous, trading as Kept & Co. (sole trader), address {{ADDRESS}}, VAT number {{VAT_NO}} (collectively, "Kept & Co."). Contact: hello@keptandco.eu.

What we collect, and why

Data Why we collect it Legal basis
The photo of your pet you upload To generate your artwork and print your product Performance of our contract with you (Art. 6(1)(b) GDPR)
Your name, delivery address, email, phone (if given) To take your order, deliver it, and contact you about it Performance of our contract with you
Payment details Handled entirely by Stripe, our payment processor — we never see or store your card number Performance of our contract with you
Order history and support messages To help you if something goes wrong, and to meet our legal record-keeping duties Performance of our contract; legal obligation
Email address, for marketing (only if you don't opt out) To let you know about new products similar to what you bought Our legitimate interest, under the "soft opt-in" rule in Cyprus law (Law 112(Ι)/2004, s.106(2)) — you can opt out at any time, free, with one click

A note on photos of people. Occasionally a pet photo includes a person in the background. We only use the photo to generate your pet's portrait — we don't run facial recognition, and we don't try to identify anyone else in the picture. If a photo you upload contains an identifiable person and you're not comfortable with that, please crop the photo before uploading, or let us know.

We do not use your data to make any automated decision that has a legal or similarly significant effect on you, and we don't sell your data to anyone.

Who we share it with

We use a small number of trusted companies to run Kept & Co. Each one only gets the data it needs to do its job:

  • OpenAI (United States) — generates the stylised artwork from your uploaded photo.
  • Stripe — processes your payment. Stripe may see fraud-prevention signals during checkout on its own hosted payment page.
  • Printify, and its production partner MWW On Demand (Germany) — print and ship your order. Printify is based in the United States; the physical printing happens in the EU.
  • Supabase — hosts our database and your uploaded files, in the EU (Frankfurt).
  • Vercel — hosts our website.
  • Resend — sends you order and account emails.

Where a company is based outside the EU (OpenAI, Printify, and some support functions used by our EU hosting providers), we rely on one of two safeguards recognised under GDPR: the company's certification under the EU-US Data Privacy Framework, or Standard Contractual Clauses. As of this policy's last update, Stripe, Vercel and Resend are certified under the Data Privacy Framework; we use Standard Contractual Clauses with OpenAI and Printify.

We never share your data with anyone for their own marketing purposes.

How long we keep things

We keep data only as long as we need it:

  • If you start designing a product but don't finish, we delete your uploaded photo and design after 14 days of inactivity.
  • Artwork variants you didn't choose are deleted 14 days after you approve your final design.
  • Your original uploaded photo is deleted 30 days after your order is delivered.
  • The approved print file for your order is kept for 12 months after delivery, so we can help with a reprint if something goes wrong — after that, a new claim may need you to re-upload your photo.
  • Order and invoice records are kept for 6 years, as Cyprus tax law requires.
  • If you asked us to email you about similar products, we keep your email for that purpose until you unsubscribe.

You can ask us to delete your photo sooner at any time — email hello@keptandco.eu.

Your rights

Under GDPR, you can ask us to: give you a copy of your data; correct it; delete it; restrict how we use it; move it elsewhere; or object to how we use it. To exercise any of these, email hello@keptandco.eu. You can also complain to the Cyprus Commissioner for Personal Data Protection (dataprotection.gov.cy) at any time.

Cookies

We use only what's strictly necessary to run the site and checkout — see our Cookie Policy for details. No banner asking for consent is shown, because we don't use any cookie that needs it.

Changes to this policy

If we make a material change to how we handle your data, we'll update this page and, where the change affects you directly, let you know by email.

Contact

hello@keptandco.eu — Philippos Aristotelous, trading as Kept & Co., {{ADDRESS}}.