Privacy policy
Last update: 2026-04-21
At Eterna we handle your data with the minimum necessary and with transparency. This document explains what data we collect, for what purpose, with whom we share it, and what rights you have.
1. Data controller
- Legal name: Cabrera Feijoo Consulting
- Tax ID: CHE-271.164.828
- Address: Avenue Alexandre-Vinet 3, 1815 Clarens, Switzerland
- General email: hello@eterna.dog
- Privacy email: hello@eterna.dog
2. Data we collect
Depending on your interaction with us:
| Category | Data | When we collect |
|---|---|---|
| Contact data | Name, email, postal address, | When you place an order |
| Payment data | Last 4 digits + card brand — we never access the full number (processed by Shopify/Shopify Payments) | Purchase |
| Pet photo | The image you upload for the portrait | When you create the portrait |
| Browsing data | Approximate IP, device type, pages visited | When visiting the site |
| Email preferences | Newsletter subscription email | If you subscribe |
3. Purposes and legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Process your order, generate the portrait, print and ship it | Contract performance (Art. 6.1.b) |
| Order communications (confirmation, preview, shipment) | Contract performance |
| Invoicing and accounting/tax obligations | Legal obligation (Art. 6.1.c) |
| Customer support | Contract performance and legitimate interest |
| Newsletter and marketing | Consent (Art. 6.1.a), withdrawable in one click |
| Aggregated site usage analysis | Legitimate interest, pseudonymised data |
4. What we do with your photo
Important for transparency. Your photo is processed as follows:
- It's uploaded encrypted (HTTPS) to our Cloudflare R2 storage (Europe region).
- It's sent to fal.ai (provider of the Flux Kontext model) to generate the portrait. fal.ai does not retain it for training; it's infrastructure-as-a-service.
- The generated portrait is stored with the order to enable reprinting or incident resolution.
- At 30 days from delivery, the original photo is automatically deleted. The generated portrait is kept for the contractual relationship duration + tax retention periods.
We never:
- Train our own models with your photos.
- Sell or share photos with third parties.
- Publish your pet's portrait in our gallery without explicit consent.
5. Data sharing
Only with processors necessary to provide the service:
| Provider | Data shared | Purpose | Location |
|---|---|---|---|
| Shopify Inc. | Order, payment, contact data | Online store and payment gateway | Ireland/EU + subprocessors |
| Cloudflare | IP, uploaded photo, generated portrait | Storage and CDN | Europe (R2 EU region) |
| fal.ai | Photo + prompt + portrait | AI generation | USA (SCC agreement) |
| Gelato APS | Address + portrait | Printing and shipping | EU (Norway + EU hubs) |
| Email provider (Klaviyo) | Email + order data | Transactional emails | USA (SCC agreement) |
Each under GDPR data processing agreement.
6. International transfers
- fal.ai, Klaviyo (USA): transfers made under EU Commission Standard Contractual Clauses (SCC).
- Cloudflare, Shopify, Gelato: data mainly processed in EU; subprocessors with equivalent safeguards.
7. Retention
| Data | Period |
|---|---|
| Original uploaded photo | 30 days after order delivery |
| Generated portrait | Order lifetime + warranty (24 months after delivery) |
| Order and invoicing data | 6 years (tax obligation) |
| Newsletter email | Until you unsubscribe |
| Technical logs (IP, user agent) | 12 months |
8. Your rights
You have, at any time, the right to:
- Access: know what data we hold.
- Rectification: correct inaccurate data.
- Erasure ("right to be forgotten"): ask us to delete your data when no longer necessary.
- Restriction: ask us to pause processing while we verify something.
- Portability: receive your data in a standard format.
- Objection: object to processing based on legitimate interest.
- Not to be subject to automated decisions: AI portrait generation is made at your request and under your supervision (you approve before printing); it's not a decision producing legal effects on you.
- Withdraw consent to newsletter at any time (one click in email).
To exercise them, write to hello@eterna.dog. We respond within 30 days max.
9. Complaints
If you believe we don't handle your data correctly, you can complain to the supervisory authority:
- Your EU country: your national data protection authority
- Switzerland: Federal Data Protection and Information Commissioner (FDPIC), https://www.edoeb.admin.ch
10. Security
We apply reasonable technical and organisational measures:
- HTTPS/TLS encryption site-wide.
- Encrypted backups.
- Access control to data (authorised personnel only).
- Access log on personal data.
No measure is infallible. If we detect a breach with risk to your rights, we'll notify you within 72 hours.
11. Cookies
See cookie policy.
12. Changes
We update this policy when our practices change. The current version is published at https://eterna.dog/privacy. If we introduce substantial changes, we'll notify you by email (if you're a customer) or via a visible banner on the site.