Privacy Policy
Last updated: 2026
Who we are
Walnut Grovez Inc (the "Company", "we", "us") operates Make Photos 1 at https://makephotos1.com (the "Site" and the "Service"). We are the controller of the personal information described in this policy. You can reach us at [email protected], by phone on +1 (888) 875-0960, or by post at 5307 N Eagles View Drive, Lehi, UT 84043, USA.
This policy explains what information we collect when you visit the Site or use the Service, why, who we share it with, how long we keep it, how we protect it, and the rights you have over it.
Information we collect
Account information. When you create an account we collect your name, email address, phone number and billing address, and a password that we store only as a one-way hash.
Payment information. Payments are taken by our payment processor, which collects your card number, expiry date and security code directly. We never store the full card number or the security code. We keep only a payment reference, the card brand, the last four digits and the expiry month and year, so we can show you which card is on file, send receipts and handle refunds.
Orders, subscriptions and support. We keep a record of what you bought, when, for how much, the status of each order and subscription, refunds, and the emails we have sent you. If you contact us, we keep the correspondence.
Information specific to the Service. The Service stores the content and settings you create in it. The product pages on this Site describe what that is; where the Service processes anything beyond ordinary account data, this policy says so in the section "Information specific to this Service" below.
Information collected automatically. When you use the Site we record your IP address, browser and device type, the pages you request, the time of each request and, for security, failed login attempts. This is server log data; we do not run third-party analytics or advertising trackers on the Site.
Cookies. We use a small number of cookies that are necessary for the Site to work: a session cookie that keeps you logged in, a cookie that protects forms against cross-site request forgery, and a short-lived cookie that carries a message from one page to the next. Our network provider may set a security cookie to tell real browsers from automated traffic. None of these is used for advertising or sold to anyone. You can delete or block cookies in your browser, but the Site cannot keep you logged in without them.
How we use information
We use personal information to: provide the Service and your account; take payment, send receipts, renewal notices and other billing messages; answer questions and provide support; keep the Site secure and prevent fraud and abuse; comply with legal, tax and accounting obligations; and, only if you ask for them, send product news. We do not sell personal information, rent it, trade it, or share it with anyone for their own marketing.
Where European or UK data-protection law applies, our legal bases are: performance of our contract with you (the account, the Service, billing and support); our legitimate interests in running, securing and improving the Service; compliance with legal obligations; and your consent, for any optional communication, which you can withdraw at any time.
Who we share information with
We share personal information only with the providers we need to run the Service, each bound by a contract that limits what they may do with it:
- Payment processing. Our payment processor receives the details needed to take and refund payments. Card data goes to the processor, not to us.
- Hosting and storage. The Service, its database and any files you store in it run on Amazon Web Services in the United States (US East, Northern Virginia). Database backups are stored in the same region.
- Network security and delivery. Cloudflare sits in front of the Site, providing DNS, TLS and protection against attacks, and therefore sees the traffic between your browser and the Site.
- Email delivery. The provider that delivers our transactional email (receipts, notices, alerts, password resets) processes the recipient address and the message.
We also disclose information when the law requires it, to establish or defend legal claims, to protect the rights and safety of our customers or others, and, if the business is sold or merged, to the new owner under the same commitments.
A current list of these providers is available from [email protected] on request.
Information specific to this Service
Make Photos 1 is a design studio, so beyond account and billing data it stores what you create in it:
- Designs: the full content of every canvas you save, including the text you typed and the images it uses, plus a preview image.
- Uploads: the photos, logos and graphics you upload (PNG, JPEG, WebP, GIF or SVG, up to 15 MB each) and the images the AI generates for you. Your photos may show people; you are responsible for having the right to use them. Uploads are kept in our private storage and served only to you, through your own session; the staff who run this site can open them when they help you or investigate a problem.
- Brand kits: the colours, fonts and logo you save.
- Usage records: which AI tool was used, when, and the size of the request, for plan limits. These records hold no prompt or text, but an AI image is saved under a name made from the first words of your prompt.
Who processes this content. Your photos and designs are not sent to any AI provider. When you use a text action, the text of the selected box goes to Anthropic (Claude models); when you generate an image, your prompt goes to OpenAI, which returns the image. Each processes it under its API terms as our processor; we do not use your content to train AI models and we send nothing for marketing. The editor loads fonts from Google Fonts as you browse or use them, which shows Google your IP address. Payment, hosting, backups, network delivery and email are the providers named above.
How long it is kept. Designs, uploads and brand kits stay in your account until you delete them, including after a plan ends. A design you trash is deleted permanently, with its preview, 30 days later; an upload or brand kit you delete goes at once. Usage records are kept with your account. Closing your account: email [email protected] and we delete your account, designs and uploads within 30 days, keeping only the billing records the law requires us to hold.
How long we keep information
- Account information: for as long as your account exists, and for up to 30 days after you ask us to close it, so we can complete the closure and honour refund requests.
- Orders, payments, receipts and refunds: for as long as accounting, tax and payment-dispute rules require after the transaction.
- Support correspondence: for up to two years after the last message.
- Server logs and security records: for up to 90 days.
- Email delivery records: for 90 days.
- Backups: encrypted database backups are kept for up to 14 days and then overwritten; information deleted from the Service disappears from backups on that cycle.
When a retention period ends we delete or anonymise the information.
Security
All traffic between your browser and the Site is encrypted (TLS). Passwords are hashed with a modern algorithm and cannot be read by us. Card numbers never touch our systems. Access to production data is limited to the people who operate the Service and is logged. If we become aware of a breach of security that affects your personal information, we will notify you and, where the law requires it, the relevant supervisory authority without undue delay, and within 72 hours where that timescale applies.
International processing
The Service is hosted in the United States and may be supported from other countries. If you use it from the European Economic Area, the United Kingdom or elsewhere, your information is transferred to and processed in the United States. Where that transfer needs a legal safeguard we rely on standard contractual clauses or an equivalent mechanism with our providers.
Your rights
You can ask us to: tell you what personal information we hold about you and give you a copy; correct it; delete it; restrict or object to how we use it; and provide it in a portable format. You can withdraw consent to any optional communication at any time. If you are in the European Economic Area or the United Kingdom you also have the right to complain to your data-protection authority. If you are a California resident, you have the right to know what personal information we collect, use and disclose, to request its deletion or correction, and not to be discriminated against for exercising these rights; we do not sell or share personal information for cross-context behavioural advertising, so there is nothing to opt out of.
How to make a privacy request
Email [email protected] with the subject "Privacy request", from the address on your account, saying what you would like us to do. We may ask you to confirm your identity. We answer within 30 days, free of charge, and explain our reasons if we cannot do what you ask.
Children
The Service is not directed at anyone under 18 and we do not knowingly collect information from them. If you believe a child has given us personal information, contact us and we will delete it.
Changes to this policy
We may update this policy. The date at the top shows the current version. If a change is material we will email the address on your account before it takes effect.
Contact
Walnut Grovez Inc
5307 N Eagles View Drive, Lehi, UT 84043, USA
Email: [email protected]
Phone: +1 (888) 875-0960 (Mon–Fri, 9am–6pm)
