Privacy Policy

Overview

Pics.Direct is operated by Pics Direct, based in Orillia, Ontario, Canada. This policy explains what personal information we collect, why, who we share it with, how long we keep it, and how you can see, correct or delete it.

Who is responsible for your information

Pics Direct is responsible for the personal information we handle. Our Privacy Officer looks after privacy questions and requests:

Privacy Officer, Pics Direct
hello@pics.direct

Information we collect

• Your phone number. It is your account. We use it to receive your photos and to text you about your orders.
• Photos you send us, by text message (MMS or RCS) or by uploading them on your order page, plus the print-ready copies and photo book files we make from them.
• Messages you send us and the messages we send you.
• Shipping details: the name and address of each person you send prints to.
• Payment details. You enter card details directly into Stripe, our payment processor. We never see or store your full card number. Stripe sends us the billing name, address and email you give it, and a reference to any card you choose to save.
• Order history: what you ordered, prices, discounts, payment status and shipping and tracking updates.
• Consent records: when you sign up for texts, we record the time, your IP address, your browser's user agent and the consent wording you agreed to.
• Website usage: pages you view and actions you take on our websites, collected by the analytics and advertising tools described below and in our Cookie Policy.

How we use your information

• To make, ship and track your prints
• To take payment, calculate sales tax and handle refunds
• To text you about your orders and answer your questions
• To keep proof that you agreed to receive texts
• To understand how people use our service so we can improve it
• To measure whether our ads work
• To prevent fraud and meet our legal, tax and accounting duties

We do not sell or rent your personal information.

Who we share it with

We share personal information only with the service providers below, and only what each one needs. Each one handles it under a contract with us and its own privacy policy.

• Twilio (United States) sends and receives our text messages (SMS and RCS). Twilio receives your phone number, the content of messages between you and us, and any photos you send by text.
• Stripe (United States) processes payments. Stripe receives your card details, your phone number (Stripe uses it to keep your customer record), billing details and the amount you pay. Stripe Tax receives your shipping address to calculate sales tax. If you choose Link, Apple Pay, Google Pay or a pay-later option such as Klarna or Affirm, that provider receives your payment details under its own privacy policy, and pay-later providers may check your eligibility.
• Prodigi (United Kingdom) prints and ships your order. Prodigi receives the print files made from your photos, and Prodigi and the shipping carriers it uses receive each recipient's name and shipping address. Prodigi chooses which of its print labs makes your order. Its labs are in the United Kingdom, the European Union and the United States. Prodigi does not receive your phone number.
• Amazon Web Services hosts our websites and stores our data, including your photos, in the United States (us-east-1, Northern Virginia).
• PostHog (United States) provides product analytics. PostHog receives the pages you view, how you click and move through our pages, your browser and device type, your approximate location (from your IP address), and events about your orders (for example, order placed or shipped, the amount and the destination country). This may include recordings of how you use our pages, with typed inputs hidden. It is linked by a random-looking ID that we generate from your phone number with a key only we hold. PostHog never receives your phone number. Before October 2026, PostHog also received phone numbers; we have deleted them.
• Google Analytics (Google, United States) measures website traffic. It receives pages you view, your browser and device type, your approximate location (from your IP address), how you found us, and on order pages, the value and contents of your cart and order.
• Google Fonts (Google, United States). On pics.direct, our fonts load from Google's servers, which receive your IP address and browser details. It sets no cookies.
• Meta (Facebook and Instagram, United States) measures our ads. On pics.direct, the Meta Pixel reports the pages you view and when you sign up. When you sign up, our server also sends Meta, through its Conversions API, your IP address, your browser's user agent and Meta's own browser cookies. Meta uses this to match the sign-up to an ad you may have seen.
• Anthropic (United States) helps us understand questions you text us that our automatic replies don't recognize. We send only the words of that message. We do not send your phone number, address, order details or photos. If you type personal details into the message itself, those words are included.

We may also disclose information when the law requires it, for example in response to a valid court order.

Your phone number

Your phone number goes only to the service providers who help us run Pics Direct: Twilio, to send and receive our texts, and Stripe, to take payment. No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. We never sell or rent your phone number.

Text messages (SMS and RCS)

• Our texts are about your orders: confirmations, links to your cart, shipping updates and replies to your questions
• Message frequency varies with your own orders. If you never order, you only get the welcome message
• Message and data rates may apply. Your mobile carrier sets these, not us
• Reply STOP to any message to stop texts, or HELP for help

Your photos

• We use your photos only to make and ship your prints and to show them to you on your order page
• We never use your photos for advertising or marketing, and we never send them to an AI service or use them to train AI models
• Photos are stored privately. Your order page shows them through short-lived links. Our team and the providers above who need them (Twilio for photos you text us, Prodigi for printing) can access them, and anyone with your order link can see your photos while the link is valid, so only share it with people you trust

How long we keep it

• Photos in paid orders are deleted automatically 90 days after they were uploaded. This includes the original photo, the print-ready copy and any photo book file.
• Photos in carts you don't pay for are deleted automatically 30 days after upload (originals) or 60 days after upload (print-ready copies and photo book files).
• Older photos. Some photos uploaded before we turned on automatic deletion may still be stored. Email us and we will delete yours.
• Order records (what you ordered, shipping details, amounts and payment status) are kept for as long as we need them for tax, accounting and legal reasons. We don't delete them automatically.
• Message history between you and us is kept so we can support your orders. We don't delete it automatically. You can ask us to.
• Consent records are kept while you are signed up for texts, and afterwards for as long as we may need to show you agreed.
• Our providers keep their own copies under their own policies. For example, Twilio keeps message records and photos sent by text, Stripe keeps payment records it is required to keep by law, and Prodigi keeps order and print records. Analytics data is kept by PostHog, Google and Meta under their retention settings and policies.

Information processed outside Canada

We are in Canada, but our providers store and process your information in other countries: the United States (Amazon Web Services, Twilio, Stripe, PostHog, Google, Meta, Anthropic and some Prodigi labs), the United Kingdom (Prodigi and some of its labs) and the European Union (some Prodigi labs). Information held in another country is subject to that country's laws, and courts, law enforcement or national security authorities there may be able to access it. We use these providers under contracts that require them to protect your information.

How we protect it

• Information is encrypted when it travels between you, us and our providers, and our photo storage is encrypted at rest
• Photo storage is private. Order pages use signed links that expire
• Only our team can use our admin tools, and we give providers only what they need
• Card details are handled by Stripe, never by us

No system is perfectly secure. If a breach of security creates a real risk of significant harm to you, we will notify you and the privacy regulators as the law requires, and keep a record of the breach.

Your rights and how to use them

You can ask us to:

• Tell you what personal information we have about you and give you a copy, in a commonly used electronic format
• Correct information that is wrong or incomplete
• Delete your information. We may need to keep some records, such as payment and tax records, where the law requires it, and we will tell you if so
• Withdraw your consent. Reply STOP to any text to stop messages. For anything else, email us. If you withdraw consent we need to fill an order, we may not be able to complete it

To make a request, email the Privacy Officer at hello@pics.direct. We may ask you to confirm the request from the phone number on your account so we know it's you. We will respond within 30 days.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada. If you live in Quebec, you can also complain to the Commission d'accès à l'information du Québec.

Children

Pics.Direct is not intended for children under 13, and we do not knowingly collect personal information directly from children.

Changes to this policy

We may update this policy. We will post the new version on this page with a new "Last updated" date.

Contact us

Privacy Officer, Pics Direct, Orillia, Ontario, Canada
hello@pics.direct