Privacy Policy

1. Who we are. KNK Consulting LLC, 8465 W. Sahara Ave., Suite 111, Unit #1441, Las Vegas, NV 89117. Contact: hello@graydrop.com. We are the data controller for the personal data described here.

2. What we collect.

We do not use cookies for tracking or advertising. We do not run advertising trackers. We do not sell personal data.

Our analytics sets no cookie and stores nothing on your device, so there is no consent banner to click. It records a page view — the page, the referrer, and general device type — and cannot identify you or follow you to other sites. The only cookies we set are strictly necessary ones: a rate-limiting identifier on the preview form and, if you buy, a short-lived session for your order.

Bot protection. We use Cloudflare Turnstile in invisible mode on the portrait form to stop automated abuse. Turnstile collects limited technical signals from your browser to distinguish humans from bots; it does not track you across sites and is not used for advertising. See Cloudflare’s Turnstile Privacy Addendum.

3. Legal bases (GDPR/UK GDPR). Performance of a contract, for processing your images to deliver your order. Explicit consent, for processing images containing biometric or special-category data. Legitimate interests, for security, fraud prevention, and aggregate analytics. Legal obligation, where applicable.

4. Biometric and special category data. Photographs of identifiable people may constitute biometric or special-category personal data in some jurisdictions. We process such data only with your explicit prior consent, only to generate the portraits you request, and never to identify, verify, or recognise any individual.

We do not create, derive, store, or retain facial recognition templates, face embeddings, face geometry scans, or biometric identifiers of any kind. Our processing produces images only.

See our Biometric Data Policy for the full retention and destruction schedule.

5. Sub-processors. To provide the Service we transmit your images to:

We have instructed our AI providers that submitted content must not be used for model training, and we use API tiers configured accordingly. International transfers rely on Standard Contractual Clauses or the EU–US Data Privacy Framework where applicable.

6. Retention and deletion. There are two separate clocks and they are not the same. The photograph you upload is automatically and permanently deleted within 24 hours, along with any portrait that was never purchased. The portrait you buy stays downloadable for 30 days and is then deleted. Deletion is automated; it is not dependent on you requesting it.

7. Your rights. Depending on where you live you may have the right to access, correct, delete, port, restrict, or object to processing of your personal data, to withdraw consent at any time, and to lodge a complaint with your data protection authority. California residents additionally have rights under the CCPA/CPRA, including the right to know, delete, correct, and opt out of sale or sharing — we do not sell or share personal data as those terms are defined.

Exercise any right by emailing hello@graydrop.com. We respond within 30 days and do not charge or discriminate for exercising rights.

8. Children. The Service is for adults 18 and over. We do not knowingly collect personal data from anyone under 18. Photographs may contain images of children, uploaded by an adult who has confirmed they are the parent or guardian or have that parent or guardian’s consent. If you believe a child’s data has been submitted improperly, contact hello@graydrop.com and we will delete it promptly.

9. Security. Encryption in transit and at rest, strict access controls, metadata stripping on upload, short-lived signed download links, automated deletion, and rate limiting. No system is perfectly secure, and we cannot guarantee absolute security.

10. Changes. Posted here with a revised date; material changes notified by email where we hold one.