Privacy
Policy.

01

What we collect

When you use Puzzably, we collect the following categories of personal information:

Account and identity: Your name and email address, provided when you create an account or place an order.

Shipping address: Collected at checkout to fulfill and ship your order.

Payment information: Processed by Stripe. We receive a tokenized confirmation of payment; we do not store your full card number, CVV, or expiry date.

Prompt text: The text prompt you submit to generate your puzzle image. This is stored so we can reproduce or reference your design if needed.

Uploaded photos: If you choose to upload a photo (for example, a pet, family photo, or personal image) to use as the basis for your puzzle design, that image file is collected and stored. See Section 03 for full details on how photos are handled.

Usage data: Anonymized analytics about how pages are used (e.g., page views, session length). See the Cookies section below.

02

AI image generation and third-party processing

Puzzably uses a third-party AI image provider called Replicate to generate the designs for your puzzles. Replicate runs Flux AI models to turn your text prompt or uploaded photo into an image.

What this means for your data: When you submit a prompt or upload a photo, that content is transmitted to Replicate’s systems outside of Puzzably’s infrastructure. Your prompt text and/or image file leaves our systems and is processed by Replicate to produce your design. Replicate is a sub-processor bound by its own privacy policy, which you can read at replicate.com/privacy.

We do not send payment information, shipping address, or account credentials to Replicate. We only send the creative content (prompt text and/or photo) needed to generate the image.

Prompt and image storage: After the image is generated, we store the prompt text and the resulting generated image in our own database (hosted by Supabase) so we can reproduce or reference your design if you contact us about your order. Uploaded source photos are stored separately; see Section 03 for retention details.

03

Photo uploads and images of people

Some Puzzably features allow you to upload a photo, which may include images of identifiable people (for example, a portrait of yourself, a family member, or a pet). Here is how we handle those uploads:

Where photos are stored: Uploaded photos are stored in Supabase Storage, a cloud storage service. Files are stored with access controls that restrict them to your account. Supabase’s infrastructure is hosted on AWS.

Processing before storage: When you upload a photo, we re-encode it and strip EXIF metadata such as location and device information before it is stored. Only this processed copy is kept. The original file as uploaded is not retained.

How they are used: Your uploaded photo may be sent to our cloud AI provider, Replicate, to create your design. When an order is placed, the production file and necessary order information are shared with our print provider. Both use your photo solely to create and fulfill your order. We do not sell uploaded photos or use them to advertise to other customers.

Retention: Source uploads and generated images are currently retained in Puzzably’s cloud services while needed to create a design, fulfill an order, provide support, or meet legal obligations. We are verifying and implementing an automatic deletion schedule before paid ordering opens. Service providers may keep temporary processing copies or backups under their own policies. You may request deletion through our contact form.

Deletion requests: To request deletion of a specific uploaded photo or all photos associated with your account, send us a message through our contact form with the subject “Photo deletion request.” We will verify the requester, remove data we are not required to retain, ask applicable service providers to delete their copies where supported, and explain any legal, fraud-prevention, backup, or active-order exception.

Your responsibility when uploading photos of others: If you upload a photo that includes an identifiable person other than yourself, you represent that you have the legal right and any necessary consent to use that image for this purpose. Please do not upload photos of other people without their knowledge and permission.

04

Children

Puzzably is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you are under 13, please do not use the service or submit any personal information.

If you are a parent or guardian and believe that a child under 13 has provided us with personal information, please contact us through our contact form. We will delete the information promptly.

Uploading images of children: Users must not upload photos of children unless they are the parent or legal guardian of the child and have full rights to use the image for this purpose. By uploading a photo of a child, you confirm that you have the necessary rights and consent to do so, and that you accept full responsibility for that upload.

We do not use uploaded photos of children for any purpose other than generating the specific puzzle image requested by the uploading user.

05

How we use your data

We use the data we collect to:

Fulfill your order: Pass the recipient’s name, shipping address, and order details to our print-on-demand partner (Printify, Inc., or in some cases our legacy partner Prodigi) so your puzzle is made and delivered.

Process payment: Pass your payment details to Stripe for secure processing.

Communicate about your order: Send order confirmation, production updates, and tracking information to your email address via Resend.

Generate your image: Send your prompt text and/or uploaded photo to Replicate to produce the AI-generated image for your puzzle.

Improve the product: Analyze aggregated, anonymized usage data to understand how the Studio and website are used.

Marketing (optional): If you have opted in, we may send occasional product updates. You can unsubscribe at any time via the link in any email.

06

Who we share data with

We only share your data with the service providers necessary to operate Puzzably. We do not sell your personal information to any third party.

Each sub-processor is bound by their own privacy policy and applicable data protection law. Links to their privacy policies are in the table above.

07

Retention

We retain your account and order information for as long as your account is active and for a reasonable period afterward to comply with legal obligations, resolve disputes, and enforce our agreements.

Uploaded photos: Retained for up to 12 months after your last order, or until you request deletion, whichever comes first. See Section 03 for deletion instructions.

Generated images: The final AI-generated puzzle image is retained for the life of the order record (to support reprints and dispute resolution) and for a reasonable period afterward.

If you request deletion of your account, we will delete or anonymize your personal information within a reasonable time, except where we are required to retain it by law (for example, financial records for tax compliance).

Prompt text associated with a completed order may be retained in anonymized form for product improvement purposes.

08

Cookies and analytics

We use cookies and similar technologies to keep you logged in and to understand how visitors use the site. Our analytics do not build advertising profiles and we do not sell your data to advertising networks.

We also set a first-party cookie named pz_attr that remembers which marketing link or search brought you here, meaning the source, medium, campaign, and landing page, for up to 90 days. If you complete a purchase, a short summary of that campaign data is copied into your payment record with Stripe so we can tell which marketing efforts led to a sale. This cookie is not shared with advertising networks and does not on its own identify you.

You can disable cookies in your browser settings. Disabling session cookies will prevent you from staying logged in.

09

SMS and text messaging

We never text customers. If you buy a puzzle from us, every message you receive from us is email. Order confirmations, print approval and shipping updates are all email. No customer phone number is ever used for marketing or added to a messaging list.

We operate one toll-free number for internal operational alerts. It has exactly one recipient, the owner of Puya Ventures LLC, on a mobile number he entered himself in our application configuration. There is no subscriber list and no public sign-up, because there is no one else to sign up. With no number configured the messaging code does nothing at all.

Those alerts are triggered automatically by system events: a paid order, a fulfillment failure that needs manual attention, a new cart, and a low balance on the account that powers image generation. They carry an order reference and an amount, never a customer name, address or payment detail. Identical alerts are de-duplicated, so a repeating fault cannot turn into a flood of messages.

Frequency varies with order volume and currently runs at roughly one to two messages per week. The recipient can reply STOP to any message to stop them, or reply HELP for help, and removing the configured number ends sending at the source. Message and data rates may apply. Carriers are not liable for delayed or undelivered messages. We do not sell, rent or share mobile numbers with anyone, and no mobile number in this system is shared with third parties for marketing.

10

Your rights

Depending on where you live, you may have rights over your personal information. We aim to honor these rights for all customers, regardless of jurisdiction.

California residents (CCPA/CPRA): You have the right to know what personal information we collect, to request deletion of your data, to opt out of the sale of your personal information (we do not sell it), and to non-discrimination for exercising these rights.

EEA, UK, and Swiss residents (GDPR and equivalents): You have the right to access, correct, or delete your personal data; to restrict or object to processing; and to data portability. You also have the right to lodge a complaint with your local data protection authority.

To exercise any of these rights, send us a request through our contact form. We will respond within 30 days. We may need to verify your identity before acting on a request.

11

Security

We use industry-standard security measures including HTTPS encryption in transit and access controls on our database. No method of transmission over the internet is completely secure. If you believe your account has been compromised, contact us immediately through our contact form.

12

Changes and contact

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date above. For material changes, we will notify you by email.

Questions, requests, or concerns? Send us a message. We read every one.