Last updated: October 20, 2026

undirectedthought (“I”, “me”) is based in Toronto, Ontario, Canada. This policy explains what happens to your information when you commission a portrait. It’s written to follow Canada’s privacy law (PIPEDA).

The short version: I use your selfie only to make your portrait, and I delete it after delivery. I never sell it, and I never train any AI model on it myself.

What I collect

• Your selfie: the photo you upload at checkout, and any replacement photo I ask you for.
• Proof of age, only if I ask for it: a photo of a government ID. It’s used only to confirm you’re 18 or older. I ask you to cover everything except your photo and date of birth. It’s deleted as soon as I’ve checked it, it’s never sent to any AI tool, and I keep only a note that your age was verified.
• Your contact and billing details: your name, email address and billing address, from the checkout form.
• Your order details: the style, month, price, and when you ordered and paid.
• Your choices and consent record: which checkout boxes you ticked (18+ and photo consent, final sale, privacy, no art direction / no redos, and the optional gallery box), plus the time, your IP address and your browser type. I keep this as proof of what you agreed to.

I don’t see or store your card or PayPal account details. PayPal handles those.

Why I collect it

• To make and deliver your portrait.
• To email you about your order: your delivery link, or a request for a new photo if yours can’t be used.
• To take payment, and to keep the business records the law requires.
• To keep a record of your consent and your gallery choice.
• If you opt in, to show your finished portrait in the undirectedthought gallery.

I don’t sell your information, and I don’t use your photo for anything other than your commission.

How your portrait is made, and who handles your information

Each portrait is a centaur collaboration (Cory Doctorow‘s term): a human and AI working together, with the human directing. I upload your selfie to third-party AI image generation tools myself and paint your portrait from it there.

While your selfie and portrait are on those tools, they may be processed and stored outside Canada, under each tool’s own terms and privacy policy. I never sell your photo, and I never train any AI model on it myself.

Other services that help:

• PayPal: takes your payment and receives the details needed to process it.
• ScalaHosting (my web host): stores the site, your order and your files on its servers.
• Email: when you order, a copy of your selfie is emailed to my private studio inbox so I can work from it. I delete that copy after delivery.

Some of these services are outside Canada, including in the United States, so your information may be processed there and be subject to those countries’ laws.

How it’s kept safe

Your selfie and your portrait are stored in a private folder on the server that’s blocked from public web access. You reach your portrait only through your private link, and that link expires after 30 days.

How long I keep it

• Your selfie and my working files are deleted from the site automatically 72 hours after your portrait is delivered. The emailed copy is deleted from my inbox after delivery.
• A replaced photo is deleted as soon as you upload its replacement.
• A declined photo (one that shows someone else, shows anyone who appears under 18, or contains nudity or sexually explicit content) is deleted right away.
• If an order is cancelled, refunded, or the payment fails, all private files for that order are deleted right away.
• Your finished portrait is deleted 90 days after delivery. If you opted in, the portrait shown in the gallery stays up until you opt out.
• Order, billing, tax and consent records are kept for 6 years, as Canadian tax rules require.

The gallery is opt-in

Your portrait only appears in the public undirectedthought gallery if you tick the optional box at checkout. Your selfie is never shown. To opt out at any time, email info@undirectedthought.com. Your portrait comes down within 7 days.

Your choices and rights

You can ask to:

• see the personal information I hold about you,
• correct it,
• withdraw your consent, or
• have it deleted.

Email info@undirectedthought.com and I’ll reply within 30 days. If you withdraw consent before your portrait is made, I can’t complete the commission. Some records, like the order and payment record, have to be kept for legal reasons, but your photo and portrait can always be deleted.

If you’re not happy with how I’ve handled your information, you can contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.

Age

Commissions are for people 18 and older only. I don’t knowingly collect photos of anyone under 18, and I delete any photo of someone who appears to be under 18.

Cookies, newsletter and site statistics

• Cookies: the shop (WooCommerce) uses small cookies to remember your cart and keep you signed in through checkout. At checkout, PayPal sets its own cookies under its own policy. My security plugin (Wordfence) uses cookies and logs visitor IP addresses to protect the site from attacks.
• Site statistics: I count visits with WP Statistics, which runs on my own server. It anonymizes and hashes IP addresses, and I don’t use third-party analytics or advertising trackers.
• Newsletter: if you sign up to the newsletter (MailPoet), I keep your email address to send it. You can unsubscribe from any newsletter at any time.
• Contact form and spam checks: messages sent through the contact form are stored on the site and emailed to me. Comments and form messages may be checked for spam by Akismet (Automattic).

Changes

If this policy changes, I’ll update the date at the top.