Your photographs, handled carefully.

The Little Hero Company (“we”, “us”) operates the website at thelittleherocompany.com. For privacy questions, contact hello@thelittleherocompany.com.

• The photograph you upload - used to generate your portrait preview. We delete our stored upload within 24 hours.
• The generated portrait - kept long enough to show your preview and, if you order, to deliver the digital file or fulfil the print.
• Your shipping address and name - collected at checkout for physical print orders.
• Your email address - used for order confirmations, delivery updates, downloads, preview recovery links, and service messages.
• Payment details - handled by Stripe. We do not store your card details.
• Basic usage and fraud-prevention data - including a session ID and hashed IP data used for fair-use limits and abuse prevention.

To create a preview, your uploaded photo and the selected scene instructions are sent to our image-generation provider, currently OpenAI API. The provider processes that data to return the portrait. We do not opt in to provider training using your photos or generated portraits.

We store the output only for the periods described below. Provider-side retention and abuse-monitoring controls are governed by the provider's API data policies.

• We never sell your data to third parties.
• We never use your photos to train AI models.
• We do not send your original uploaded photo to our print partner; print fulfilment receives the final rendered portrait.
• We do not load analytics or advertising pixels unless you accept them.

We use trusted providers to deliver the service:

• OpenAI API - image generation.
• Stripe - payment processing.
• Prodigi - poster/canvas printing and fulfilment, for paid physical orders.
• Resend - transactional email delivery.
• Cloudflare R2 - image storage.
• Supabase - application database.
• Google Analytics and Meta Pixel - analytics and advertising measurement, only after consent.

• Uploaded photos: up to 24 hours in our storage, then deleted.
• Unpaid generated previews: deleted from public preview storage after the cleanup window used by the site.
• Rendered portrait for physical print orders: up to 90 days, so we can reprint if needed.
• Order records: 7 years for UK accounting records.
• Preview lead email addresses: kept so we can recover previews, connect repeat attempts, and answer support questions.
• Order email addresses: kept for service history unless you ask us to delete them and we no longer need them for legal records.

Under UK GDPR you have the right to access the personal data we hold about you, correct it, or ask us to delete it. Email hello@thelittleherocompany.com with your order number, if you have one, and we'll action the request within 30 days.

If you think we're mishandling your data, you can also complain to the UK Information Commissioner's Office (ico.org.uk).

We use first-party cookies and browser storage for essential functionality, including sessions, currency, admin login, and your cookie preference. Analytics and advertising cookies only load after consent. See our cookies page for details.

If we change anything material in how we handle your data, we'll update this page and, where reasonable, email you.

Last updated: 14 June 2026