Privacy
What this site collects, why, and how to have it deleted. Last updated 16 October 2026.
This is a portfolio copy of Pensel. It places no orders, sends no email and saves nothing you type at checkout or in the contact form, and it collects no usage statistics. The notice below describes the live store; the cookie section also lists the cookies this demo adds.
Who is responsible
Majd Jamal is the data controller for this site. Pensel is a personal, non-commercial demonstration, and there is no company behind it.
Majd Jamal
Stockholm, Sweden
hello@majdjamal.se
What is collected and why
Generating an artwork
What: Your written description (prompt), generated image, session ID and guest ID. Pensel also records a salted hash of your IP address: a coded value used instead of the address itself.
Why: To paint the picture, to show it to you and keep it in your session, and to enforce the 20-generation demo limit and prevent abuse.
Legal basis: Article 6(1)(b) covers creating artwork at your request. Article 6(1)(f) covers Pensel’s legitimate interest in enforcing the demo limit and keeping the service available to everyone.
Ordering a poster
What: Your name, delivery address, email address, phone number, the items you order, any discount code you apply and the language of the page when you order.
Why: To print and deliver the poster and to send you the confirmation email with the artwork attached, in that language.
Legal basis: Article 6(1)(b), for fulfilling your poster order.
Discount codes
What: A discount code you apply is stored with your order. If a code is wrong, Pensel records the failed attempt against a salted hash of your IP address and of your session, never the address itself.
Why: To give you the discount, and to stop codes being guessed: after five wrong codes the field pauses for a while.
Legal basis: Article 6(1)(b) for applying the discount to your order. Article 6(1)(f) covers Pensel’s legitimate interest in preventing abuse of discount codes.
The contact form
What: Your name, email address, your message and the language of the page.
Why: To reply to you. Your message is saved on the server and emailed to Majd Jamal.
Legal basis: legitimate interest in answering people who write in (Art. 6(1)(f)), since you asked for a reply.
The public gallery
What: The artwork itself, with no name, no email and no prompt.
Why: To show what Pensel can create. Your name, email address and prompt are not displayed with the artwork.
Legal basis: legitimate interest in demonstrating the site (Art. 6(1)(f)).
Choosing the language
What: Your IP address. Pensel checks it on its own server against RIPE NCC’s public list of IP address ranges registered in Sweden.
Why: To choose Swedish for visitors in Sweden and English for everyone else. Only the result of the location check is used; your IP address is not stored for this purpose.
Legal basis: legitimate interest in showing the site in a language you can read (Art. 6(1)(f)).
Usage statistics
What: The pages you view and their order, how long each stays on screen, how far you scroll, click positions, and which buttons or links you click. For clicks on other elements, Pensel records the click position and element type, such as an image. Pensel also records your browser window size, page language, device category (phone, tablet or computer) and the website that linked to your first page.
It also records creation steps, artwork requests, poster views, cart additions, checkout steps, orders and language changes. Alongside each event, only your chosen format, style, size or language is included, never the text you enter. Each visit receives a random ID held only in the open tab.
Why: To see which pages help people and which buttons they cannot find, so the site can be made better.
Legal basis: legitimate interest in understanding how the site is used so it can be improved (Art. 6(1)(f)).
Application logs record what the server does and contain no email addresses. A separate activity log links actions to a salted hash of your IP address, not the address itself.
Pensel collects no card numbers, bank details or billing information.
Pensel collects and stores usage statistics on its own server, without cookies or persistent storage on your device. A random visit ID stays in the open page and disappears when you reload it or close the tab. It is not reused to link visits.
The statistics contain no IP addresses, user-agent strings or browser fingerprints. They exclude text you enter in prompts, delivery forms and contact forms, as well as artwork labels on the Create page that repeat your prompt.
To opt out, turn on Do Not Track or Global Privacy Control in your browser. Pensel collects no usage statistics when either signal is present. The statistics are never sold or shared.
Who processes it
The following service providers process data for Pensel:
- Microsoft Azure hosts the site, stores images and delivers order confirmation emails with your artwork attached. These services run in an EU region.
- Your description is sent to OpenAI’s image service (API), which creates the image. Under OpenAI’s API terms, the content is not used to train the company’s models.
- Gelato prints and delivers posters. I place each print order manually and provide your name, delivery address, phone number and artwork file. The site does not send these details to Gelato automatically.
Your name, delivery address, email address and phone number are processed only within the EU/EEA. Posters can be delivered to EU countries, Iceland and Norway.
Your prompt is sent to OpenAI, L.L.C. in the United States to generate your image. This is the only data Pensel transfers outside the EU/EEA. Pensel does not add your name, address or email address to the request.
OpenAI participates in the EU–U.S. Data Privacy Framework. Under OpenAI’s API terms, your prompt is not used to train its models.
Your data is not sold, rented or handed to advertisers. The usage statistics are counted by this site on its own server; no analytics company, advertising pixel or third-party script is involved.
How long it is kept
Data is deleted automatically each day according to the schedule below. Each period runs from the date specified for that type of data.
- Delivery details (name, address, email address and phone number) are removed from order records 90 days after the order date. The order record remains without those details.
- Contact messages are deleted 90 days after they are sent.
- Records of wrong discount codes are deleted 30 days after the last attempt. They are linked to salted hashes of your IP address and session, not the address itself.
- Activity log entries are deleted 180 days after they are recorded. Each is linked to a salted hash of your IP address, not the address itself.
- Records that enforce the 20-generation limit are deleted 180 days after their last use. They are linked to a salted hash of your IP address.
- Usage statistics (pages, time on screen, scrolling and clicks) are deleted 13 months after they are recorded, long enough to compare a month with the same month a year earlier.
- Application logs are kept for 30 days, then deleted. They record server operations and contain no email addresses.
- Artworks and the descriptions that created them are kept for as long as this demo runs.
The automatic deletion schedule does not cover my email inbox. I receive copies of order confirmations, including delivery details, and contact messages so I can arrange printing and reply.
These emails have no fixed retention period. I delete them as soon as you ask.
You can ask for any of it to be deleted sooner. Write to hello@majdjamal.se and it will be removed.
Your rights
You can ask for access to your data, for it to be corrected or erased, for its use to be restricted, and for a copy in a portable format. You can object to processing that rests on legitimate interest. Write to hello@majdjamal.se and you will get an answer within 30 days.
If you are not happy with how it is handled, you can complain to the Swedish supervisory authority, Integritetsskyddsmyndigheten (IMY), imy.se.
Children
This demonstration is for adults and is not directed at children. Please do not order a poster if you are under 18.
Changes
This notice is updated whenever Pensel changes the data it collects. The date at the top shows the latest update: 16 October 2026.
Questions about your data are welcome at hello@majdjamal.se.