Cake Portrait Privacy Policy

Last updated October 11, 2026

10951811 Canada Inc. ("we", "us" or "our") operates Cake Portrait. This policy explains how we handle information on cakeportrait.com, app.cakeportrait.com and the associated online services. Your work is private in our service; you choose what to export or share. Selected content is sent to our cloud and AI providers when you request online features, as explained below.

This website

Our public website and portal use Cloudflare to deliver and protect requests. Cloudflare processes ordinary connection information such as IP addresses, requested pages and browser information. We do not add advertising trackers or third-party analytics scripts. The portal uses essential session cookies for account access; the public website does not offer advertising or analytics cookies. Contact links open your email application. Cloudflare's infrastructure and security processing is described in its Privacy Policy.

Account and service information

The portal uses email and password accounts verified by Supabase. We use your email address, account identifier and authentication records to protect your library and associate requests and credits with you. Passwords are handled by Supabase Auth. Browser sessions use secure, HttpOnly, same-site cookies; session tokens are not stored in browser local storage or sent to OpenAI. Public signup confirmation and recovery email delivery are not enabled during the current early-access period.

We store submitted requests, selected settings and instructions, work and collection identifiers, generation status, outputs and credit usage. Work names, notes, pictured sizes, manually entered prices and collection details may sync to your private cloud library. Include only the information you need. This web app does not use guest sign-in or Sign in with Apple.

Photos and information on your device

We receive the image files you select for online processing, including cake photos and optional cake, backdrop or photographic-style references. Original uploaded files can contain camera or location metadata as well as visible identifying information. The server prepares image copies without their original camera metadata before sending them to OpenAI; the original file in private storage can still contain that metadata. We do not request device location or browse your entire photo library.

Bakery identity, Instagram handle, website, logo, watermark settings, brand colours and edited captions are saved in this browser's local storage. Saving these details or importing a logo does not by itself upload the logo. References selected for an online request can be uploaded. Content retained for an earlier request may remain associated with it even if you change local settings. Browser-only details do not automatically sync to another device.

Watermark rendering, resizing and content-pack exports run in your browser. Exported files can include the branding and details you choose. Downloaded or shared copies are subject to your device settings and the receiving service's privacy practices.

What is sent to OpenAI

OpenAI processes the selected content needed for the AI feature you request. Photo planning and editing can include your cake photo, chosen backdrop, cake or style references, saved staging guidance and written instructions. Cake ideas can include your brief and selected references or an earlier concept. Captions can include the selected finished photo, its source where applicable, work name, notes, pictured size and caption voice.

When you request caption suggestions, your saved bakery name and Instagram handle are included as caption inputs. Your saved logo and website are not added as profile fields. Numeric manual prices are excluded from caption model input; a price written in a note, brief or image can still be included with that content.

Do not submit unnecessary client names, contact details, payment details, confidential records or sensitive personal information. Obtain any permission needed from people whose information appears in your images or requests. AI results may reproduce input information; review them before sharing.

Your choices and consent

The portal explains photo sharing and requires the photo-processing permission checkbox before submitting a cake for AI editing. You choose the source photo, references and instructions. Requesting ideas or captions sends the relevant brief, selected content and described profile fields to the AI provider. You can decline new processing by not submitting another request, while using available saved work and export tools.

To withdraw consent for processing already associated with your account or request deletion, contact us below. Withdrawal applies to future processing where consent is its legal basis and may prevent features that need it. It cannot recall information already sent to a provider or erase copies shared elsewhere. Withdrawal does not itself cancel a subscription.

Purchases and support

Paid web checkout is not active at present. When activated, the checkout will identify the payment provider, price, currency, billing period and applicable taxes before purchase. We will use account-linked purchase and transaction records to verify entitlements, allocate credits, handle refunds and prevent duplicate fulfilment. Full payment-card details will be handled by the payment provider, not collected in the Cake Portrait portal.

If you contact support, we receive your email address, correspondence and any details or attachments you supply. We use them to respond, investigate and keep a record of resolution. Email services also process that correspondence. Do not send passwords, session tokens or full payment-card details.

Why we use information

We use information to provide requested features, keep your private work available, authenticate access, sync eligible content, manage purchases and credits, answer support requests, diagnose failures, prevent fraud and abuse, and meet legal obligations. Our providers may receive ordinary connection information, including IP addresses, request times and technical error information, to deliver and protect their services. Request and usage records help us recover interrupted work and avoid duplicate charges.

Cake Portrait has no third-party advertising or cross-app tracking SDKs. We do not sell personal information or share it for cross-context behavioural advertising. Sending selected content to a provider to fulfil an AI request is service processing, not advertising sharing. We do not use your private photos or designs in public marketing without separate permission.

Service providers and other disclosures

Cloudflare delivers and protects the public website and portal requests. Supabase provides authentication, database and private file storage. Google Cloud runs the application services and task processing. OpenAI provides AI assessment, planning, image generation and caption generation. A payment provider will process payments only when checkout is activated and identified to you. Providers receive information needed for their roles and may use subprocessors under their agreements.

Access by us is limited to people who need it to operate the service or handle a request. We may disclose information as required by law, to protect rights or safety, or investigate fraud and security incidents. Relevant information may be transferred with a business reorganization or transfer, subject to applicable privacy law and required notice or consent.

Information may be processed or stored outside Quebec or Canada, including in the United States. Local laws can allow authorities to access it. We remain responsible for personal information entrusted to providers and apply safeguards required by applicable law.

AI training and provider retention

OpenAI's API policy excludes model training by default unless the customer opts in. Standard abuse-monitoring content may remain for up to 30 days, with legal and safety exceptions. Image safety reviews and prompt caching can also retain data. Disabling response storage in our text requests does not guarantee zero retention. See OpenAI's data controls for current practices.

Retention and deletion

We keep hosted photos, requests and library records while needed to provide your saved work and related services. Contact support to request removal of individual items. Archiving a collection does not delete the work it contains. Files used by other work or accepted requests may remain until no longer needed.

Delete your account in Your studio → Your photos & account → Delete my account. Access stops immediately, and background cleanup scrubs hosted personal content, removes private photos and soft-deletes the authentication identity. Cleanup retries temporary provider failures and removes files submitted through briefly valid upload links in a later pass. The portal clears this account's browser preferences and session cookies. Limited pseudonymous identity, purchase, credit-consumption and cost records remain to handle purchase rights, refunds, disputes and repeated-credit prevention. Contact support about remaining paid credits; deleting an account does not refill used credits or restore deleted photos.

Clearing browser storage or signing out does not delete hosted work or cancel a subscription. Hosted deletion does not erase exports, copies sent to other services or data on other devices. Backups and provider safety records may expire later than active files. We do not promise immediate erasure from every system; contact us for retention details relevant to your request.

Security

We use HTTPS for online connections, account-scoped access controls, private cloud storage and temporary links for media access. Device access and your chosen sharing destinations also affect confidentiality. No storage or transmission method is completely secure. Contact us promptly if you suspect unauthorized access.

Your privacy rights

Depending on the law that applies, you may request access to your personal information, correction, deletion, withdrawal of consent, or a portable copy of eligible information. You may also have rights to object to or restrict certain processing or to request cessation of dissemination or de-indexing where applicable. We do not make decisions with legal or similarly significant effects about you solely through AI.

Send a request to the contact below with "Cake Portrait privacy" in the subject line. We may request proportionate information to verify your authority without collecting unnecessary information. We respond within applicable legal deadlines, normally within 30 days for Quebec access and correction requests. We will explain any lawful exception or refusal and applicable review rights. You may use an authorized representative where allowed and will not be penalized for exercising a privacy right.

You can raise a concern with Quebec's Commission d'accès à l'information or the Office of the Privacy Commissioner of Canada, as applicable. Other jurisdictions may have their own supervisory authority. Rights under California, European or other privacy laws apply where their legal requirements are met; ordinary provider processing is not described here as a sale of information.

Children and policy changes

Cake Portrait is intended for adults aged 18 and over. We do not knowingly collect personal information from children. Contact us if you believe a child has supplied personal information so we can investigate and take appropriate action.

We will update this policy when our practices change and provide notice of material changes through the app or another appropriate channel. Where a change requires consent, we will obtain it before the new processing. The updated date identifies the current version.

Contact for privacy requests

Person in charge of the protection of personal information — 10951811 Canada Inc.

1502 Rue Noel Lareau, Chambly, Quebec J3L 5M7, Canada

Email: floral.studio@outlook.com. Include "Cake Portrait privacy" in your subject line.