Privacy Policy · Curb Appeal Studios

What we collect

Photos you upload (of your house, and of your pets if you add them), and the previews and portraits we make from them. Original photo files can include details your phone adds, such as when and where the photo was taken. We don’t use those details, the copies we send to be painted have them removed, and the original is deleted on the schedule below.
Your email address, which we ask for before showing free previews, to order, or to ask about agent accounts — plus whether you ticked the box for holiday reminders.
Order details: your name, email, shipping address, what you bought, how you cropped it, gift notes, and when you approved your prints.
Payment details go straight to Stripe on its checkout page. We see the amount, whether it went through, and the last digits of the card — never the full card number.
Agent requests: your name, work email, brokerage, state and license number if you give them, and anything else you type into the forms on our agents pages, along with which page you used. We use these to check your real-estate license (for example, against public license lookups) before sending a free download, and to follow up about agent accounts.
Technical information: your IP address (used to limit free previews and stop abuse), a random session ID stored in a cookie, your browser type, and standard server logs.
Which ad brought you here: if you arrived from one of our ads, the campaign tags in that link (for example “utm_source=google”), saved with your upload, email and order so we can tell which ads work. Not if you decline analytics or your browser sends Global Privacy Control.
Analytics, unless you decline: pages you visit, how you got here, your device and browser, and an approximate location that Google works out from your IP address.
Anything you send us by email.

How we use it

To make your previews and portraits, check that photos are suitable, and prepare print files.
To take payment, calculate sales tax, and print and ship posters.
To send emails about your order: confirmations, download links and shipping updates.
To send holiday cutoff reminders — only if you opted in.
To keep the service fair and safe: bot checks, free-preview limits and fraud prevention.
To answer your questions and fix problems.
To understand which pages help people, and which of our Google, Facebook, Instagram and Reddit ads lead to orders — unless you decline analytics.
To meet legal, tax and accounting requirements.

We never use your photos, previews or portraits to train AI models, and we never use them in marketing without your permission.

Who helps us run the service

We share information only with the companies that help us provide the service, and each one gets only what it needs for its job:

Supabase — our database and photo storage, in the US.
Google Gemini API (paid tier) — checks uploaded photos and paints the portraits. Google’s terms for the paid tier say it doesn’t use this content to improve its products; it may keep it for a limited time to detect abuse.
Replicate — enlarges your portrait to print size after you order.
Stripe — takes payments and calculates sales tax (Stripe Tax).
Printful — prints and ships posters. It receives the print file, your name and your shipping address.
Resend — sends our emails.
Cloudflare — runs our domain’s DNS and Turnstile, the check that tells people from bots when you upload.
Google Analytics 4 and Google Ads — measure site use and which ads lead to orders, unless you decline analytics.
Meta (Facebook and Instagram) — the Meta Pixel measures which of our Facebook and Instagram ads lead to visits, sign-ups, checkouts and orders, unless you decline analytics. When you order, our server tells Meta about the purchase (its value, plus your email address and postcode in hashed, scrambled form, your IP address and browser type) so Meta can match it to the ad you clicked. Meta may also use this information to decide who sees our ads.
Reddit — the Reddit Pixel does the same for our Reddit ads, unless you decline analytics. Reddit may also use this information to decide who sees our ads. We don’t send Reddit your email or other contact details.
Vultr — hosts our servers in the US.

We may also share information if the law requires it, to protect people from harm or fraud, or as part of a sale or merger of our business (in which case this policy keeps applying to your information).

We do not sell your personal information.

Cookies and browser storage

Necessary — always on, because the site doesn’t work without them:

cas-sid — a cookie holding a random ID that ties your uploads, previews, free tries and orders to your browser, so you don’t need an account. It can’t be read by scripts on the page and lasts one year.
cas-theme — a cookie set when you arrive through one of our Halloween links (including the Halloween page for agents), so the site keeps its Halloween look. It expires at the end of October 31. It is also set, along with cas-date, by our internal theme preview tool.
cas-cart — kept in your browser’s local storage (not a cookie). It holds your cart and isn’t sent to us until you check out.
cas-consent — kept in local storage. It remembers whether you declined analytics or closed the notice with OK.
Cloudflare Turnstile — reads browser signals to check you’re a person when you upload a photo.
Stripe — sets its own cookies on its checkout page to prevent fraud.

Analytics — on unless you click Decline or your browser sends Global Privacy Control:

Google Analytics cookies (names starting with _ga) tell visits and visitors apart. Google sets them to last up to two years.
The Meta Pixel cookies (_fbp, and _fbc after an ad click) tell visits from our Facebook and Instagram ads apart. Meta sets it to last about three months. The pixel never loads on order pages, whose addresses are private.
The Reddit Pixel cookie (_rdt_uuid) does the same for visits from our Reddit ads. Reddit sets it to last about three months, and it never loads on order pages either.
We use Google Consent Mode. Unless you decline or your browser sends Global Privacy Control, it turns on analytics storage, plus ad storage and ad user data so we can tell which of our Google ads led to an order (when you order, we send Google the order number and amount, linked to your analytics ID). Google ad personalization stays off.
You can change your mind any time with “Cookie settings” at the bottom of our main pages, or in the “Do not sell or share” section below. Declining switches analytics and the Meta and Reddit pixels off and deletes their cookies on our site; nothing more is sent to Google, Meta or Reddit from your browser after that.

How long we keep things

Photos and previews with no order: deleted 30 days after upload.
Pet photos: deleted 30 days after upload, whether or not you order (your pets stay in the portrait and print files).
Photos, previews and print files for an order: kept for one year after the order, so we can resend files and handle reprints, then deleted.
Download links work for 30 days after they’re sent.
Order and payment records (what you bought, the amount, tax and shipping address): kept as long as tax and accounting rules require.
Emails for holiday reminders: kept until you unsubscribe or ask us to delete them.
Agent requests: kept for as long as we need them to verify your license, honor a free download and follow up about agent accounts — and no longer than two years — or until you ask us to delete them.

Want something deleted sooner? Email hello@curbappealstudios.com any time. If an order is still being printed or shipped, we’ll tell you how deleting affects it.

Emails

We always send emails you need for an order: confirmations, download links and shipping updates.

When you give your email for free previews, we email you those previews and one reminder about them a day later. Other marketing emails, such as holiday cutoff reminders, go only to people who ticked the opt-in box. Every one of these emails has an unsubscribe link, and unsubscribing doesn’t affect order emails.

Your privacy rights

Wherever you live, you can ask us what we have about you, ask us to correct it, or ask us to delete it.

California residents (CCPA, as amended by the CPRA) have the right to:

Know what personal information we collect, use and disclose, and get a copy of it.
Delete personal information we collected from you.
Correct inaccurate personal information.
Opt out of the “sale” or “sharing” of personal information (see below).
Limit the use of sensitive personal information. We only use it to provide the service, so there’s nothing further to limit.
Not be treated differently for using any of these rights.

In the last 12 months we collected these categories: identifiers (name, email, IP address, session ID); customer records (shipping address and order details); commercial information (what you bought); internet activity (site use, unless you opt out of analytics); approximate location (from your IP address, and possibly precise location in the details of an original photo file); and visual information (photos of homes). We get it from you, your browser, and the service providers listed above, and use it for the purposes described in this policy.

Residents of other states with privacy laws — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon and others — have similar rights to access, correct, delete and get a portable copy of their information, and to opt out of targeted advertising, sale and profiling. We don’t sell information or profile you in ways that have legal or similarly significant effects. Unless you opt out, the Meta and Reddit pixels let Meta and Reddit use your visit to show and measure our ads, which some state laws treat as targeted advertising; Decline, Cookie settings or a Global Privacy Control signal opts you out.

To make a request, email hello@curbappealstudios.com from the address you used with us (or include your order number) so we can confirm it’s you. An authorized agent can ask on your behalf with your written permission. We’ll respond within 45 days. If we turn down a request, you can appeal by replying with “Appeal” in the subject line, and we’ll explain our decision.

Do not sell or share my personal information

We don’t sell personal information, and we never have.

California law counts some analytics and advertising tools as “sharing” even when nothing is sold. Google Analytics measures our site and which of our ads lead to orders; the Meta and Reddit pixels do the same for Facebook, Instagram and Reddit ads, and those companies may use them to decide who sees our ads. They are on unless you opt out: click Decline on the notice, or switch them off at any time with Cookie settings.

We also honor Global Privacy Control. If your browser sends that signal, analytics and the Meta and Reddit pixels stay off and we treat it as a request to opt out.

You can also opt out by emailing hello@curbappealstudios.com.

Children

Curb Appeal Studios isn’t meant for children under 13, and we don’t knowingly collect information from them. If you think a child has given us personal information, email hello@curbappealstudios.com and we’ll delete it. We don’t sell or share information about anyone under 16.

Keeping information safe

Everything travels over encrypted connections. Original photos and full-size portraits are kept in private storage that only our systems can reach. Watermarked previews are stored at long, hard-to-guess links so they load quickly on your screen. Only the people who run the service can see order details.

No system is perfectly secure. If a breach affects your information, we’ll tell you as the law requires.

We process and store information in the United States.

Changes to this policy

When we update this policy we’ll change the date at the top. If a change is significant, we’ll also post a notice on the site or email customers we have an address for.

Contact us

Email hello@curbappealstudios.com — a person reads every message.

Or write to Frequency Labs, LLC, PO Box 619, Blackwood, NJ 08012.