Privacy Policy

1. Overview

EverTiles ("we", "us", "our") operates the EverTiles platform, which enables pet owners to generate AI-styled portraits of their pets and purchase them as digital downloads or physical MIXPIX® tiles.

This Privacy Policy explains what personal data we collect, why we collect it, how long we keep it, and what rights you have over it. It applies to all users of our website and services, regardless of location.

EverTiles is headquartered in Israel, a jurisdiction recognised by the European Commission, the UK ICO, and Swiss authorities as providing an adequate level of data protection. If you are located in the EU, UK, or EEA, data transfers to Israel occur on this adequacy basis.

We process personal data in compliance with the Israeli Privacy Protection Law, 1981 (and its 2023 amendments), and, where applicable, the EU General Data Protection Regulation (GDPR) and UK GDPR.

2. What personal data we collect

We collect only the data necessary to provide the Service.

We do not collect sensitive personal data (e.g. health data, financial account numbers, biometric data) and do not knowingly collect data from children under 18.

3. How we use your data

We use the data we collect to:

• Create and manage your account and authenticate your identity
• Generate AI-styled pet portraits from your uploaded photos
• Process payments and fulfil digital and physical orders
• Coordinate production and shipping with MerchOne and provide tracking updates
• Communicate with you about your orders and respond to support requests
• Detect and prevent fraud, abuse, and security incidents
• Improve the quality and reliability of our Service through aggregated analytics
• Comply with our legal obligations

We do not use your pet photos or generated portraits to train AI models, and we do not sell your personal data to third parties for marketing purposes. We may send you transactional emails (order confirmations, shipping updates, receipts). We will only send marketing communications where you have opted in, and you may opt out at any time.

4. Who we share your data with

We do not sell or rent your personal data. We share data only with the following categories of third parties, and only to the extent necessary for the stated purpose:

• Lemon Squeezy — our payment processor. Receives order and billing information to process transactions. Subject to its own privacy policy and PCI-DSS compliance obligations.
• MerchOne — our print-on-demand fulfilment partner. Receives your selected portrait image(s) and shipping address to produce and dispatch physical MIXPIX® tiles.
• AI infrastructure providers — your uploaded pet photo is transmitted for portrait generation and is not retained by the provider beyond the generation request.
• Hosting and infrastructure providers — cloud services used to operate the platform, operating under appropriate data processing agreements.
• Legal and regulatory authorities — where we are required by law, court order, or regulatory obligation to disclose data.

In the event of a merger, acquisition, or sale of assets, personal data may be transferred to the acquiring entity, subject to the same protections described in this Policy.

5. Retention

• Account data: retained for the duration of your account and deleted within 90 days of account closure, unless legal obligations require longer retention.
• Pet photos: retained only as long as needed to deliver your order. Typically deleted within 30 days of your last session, unless you have active purchased portraits linked to them.
• Unpurchased generated portraits: automatically deleted 30 days after generation.
• Purchased portrait files: retained in your account for as long as your account is active.
• Order and payment records: retained for 7 years to comply with applicable financial and tax record-keeping obligations.
• Support communications: retained for up to 3 years from the date of the last communication.

6. Your rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Rectification: request correction of inaccurate or incomplete data.
• Erasure: request deletion of your data, subject to legal retention obligations.
• Portability: receive your data in a structured, machine-readable format.
• Restriction: request that we restrict processing of your data in certain circumstances.
• Objection: object to processing based on legitimate interests.
• Withdraw consent: where processing is based on consent, withdraw it at any time.
• Lodge a complaint: file a complaint with the Israeli Privacy Protection Authority or your local supervisory authority.

To exercise any of these rights, contact us at the address in Section 11. We will respond within 30 days. We may need to verify your identity before processing your request.

7. Cookies & tracking

We use a minimal set of cookies and similar technologies to operate the Service:

• Essential cookies: required for authentication, session management, and security. These cannot be disabled without breaking core functionality.
• Analytics cookies: used to understand how users interact with the Service (e.g. pages visited, session duration). Data is aggregated and not linked to individual identities where possible. You may opt out via your browser settings.

We do not use advertising or third-party tracking cookies. We do not engage in cross-site tracking or sell browsing data to advertisers.

8. Children's privacy

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a person under 18, we will delete it promptly. If you believe we have inadvertently collected such data, please contact us immediately.

9. International data transfers

EverTiles is based in Israel. When we share data with third-party service providers (Lemon Squeezy, MerchOne, cloud infrastructure), your data may be transferred to and processed in countries outside Israel, including the United States and the European Economic Area.

We ensure that any such transfers are protected by appropriate safeguards, including:

• EU Standard Contractual Clauses (SCCs) where applicable
• Transfers to jurisdictions with an EU adequacy decision
• Data processing agreements with all third-party processors

Israel is recognised by the European Commission as providing an adequate level of data protection, meaning transfers from the EEA to Israel are lawful without additional safeguards.

10. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. When we make material changes, we will update the effective date at the top of this page and, where appropriate, notify you by email or prominent notice on the platform.

Your continued use of the Service after a revised Policy takes effect constitutes your acknowledgment of the changes.

11. Contact

If you have questions about this Privacy Policy, wish to exercise your data rights, or want to raise a concern about how we handle your personal data, please contact us:

• Email: privacy@evertiles.com
• Response time: within 5 business days

If you are located in the EU or EEA and are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority. Israeli residents may contact the Israeli Privacy Protection Authority (PPA).