Privacy and cookies

Last updated 30 October 2026.

This page explains what Picarm collects, why, and how to control it. Plain English, no dark patterns.

Who we are

Picarm is operated by Picarm Ltd, a company registered in England & Wales under company number 16209795, whose registered office is at 20 Wenlock Road, London N1 7GU. You can reach us at hello@picarm.com. We are the data controller for the personal information described on this page.

What we collect on the www.picarm.com pages

The pages on www.picarm.com (the home page, the guides and these legal pages) ask you for nothing. Google's tags load on every visit, but in the UK, EEA and Switzerland they start with cookies switched off, and until you click Accept on the cookie banner they set no cookies and send Google only cookieless signals (Google's "Consent Mode").

Our own page measurement, sent only to us: how long a page was in use, how far down it you scrolled, how long it took to load, which of our links and buttons you clicked, whether you arrived from one of our ads, and your screen size class. It never reads anything you type. Without your consent it stores nothing on your device and each page is measured on its own; with your consent (in the UK, EEA or Switzerland, after Accept) it also keeps an id for this browser tab, and the ad click id Google adds to the address, so we can see which of our ads lead to an order. The legal basis is our legitimate interest in knowing which pages and ads work; the records hold no name, email address or IP address and are kept for up to 90 days.
Microsoft Clarity: as described for the counter below, and only loaded if you have consented (in the UK, EEA or Switzerland).
Google Ads, loaded with Google Tag Manager: it tells us which of our ads bring people to the site, and lets us show ads to people who have visited before. What it records is your page views. We do not send it your name or email address.
Other Google measurement tags that we load through Google Tag Manager, such as Google Analytics, for aggregated traffic and engagement figures.

What we collect when you order through the counter (www.picarm.com/app)

You can order without an account. If you use the counter, we collect:

Your photographs and your brief: the photos you add, the services and options you choose for each, and any notes. They are uploaded to us as you add them, so that we can price and prepare them, and they are stored on Microsoft Azure.
Checkout details: when you check out, Stripe collects your email address and payment details, and for orders in US dollars your billing address (for sales tax). We receive your email address, the order reference, the amount and the currency; Stripe handles your card details directly and we never receive them. Stripe is the controller for the card data itself; see Stripe's privacy notice.
Free samples: the photograph you send and the email address you give us, so that we can send the finished photograph back.
Emails about your order: we use your email address to send you order updates and links to your orders. We do not add you to a mailing list.
Microsoft Clarity: behavioural analytics including session replay (mouse movement, clicks, scrolls, page interactions), browser and device information, and an approximate location based on IP address. Microsoft acts as our processor; some of its processing happens outside the UK and is covered by the UK extension to the EU–US Data Privacy Framework or the UK International Data Transfer Agreement. Only loaded if you have consented (in the UK, EEA or Switzerland).
Google Ads: as on the www pages, plus, on a completed order, the order reference, the total and the currency, so we know which ads lead to orders. We do not send your name, your email address or any hashed version of them, and Google never sees your photos or your card details. Only loaded if you have consented (in the UK, EEA or Switzerland).

What we collect on app.picarm.com (account customers)

You can use the editor without creating an account. Anything you do while you are trying it out stays in your browser; nothing is sent to our servers until you decide to check out.

If you check out and place an order, we collect:

Account and authentication: your business email, a password (hashed), and authentication tokens. Handled via Microsoft Entra (formerly Azure AD).
Order details: your business email, the short note you give us about why you are using Picarm, the photos you upload, the editing options you choose, order metadata, and the processed images we deliver back. Stored on Microsoft Azure for as long as your account is open plus a short retention window for support and accounting.
Payments: as for the counter, through Stripe.
Microsoft Clarity and Google Ads: as for the counter, and only loaded if you have consented (in the UK, EEA or Switzerland).

On every part of Picarm

Operational telemetry: server-side logs (request paths, response codes, error stacks, IP addresses) so we can keep the service running. The legal basis is our legitimate interest in operating a reliable service.
For what Google does with the data once it reaches it, we and Google are jointly responsible; see Google's privacy policy.

We do not sell your data, and we do not use it or your photographs to train AI models.

How long we keep things

Analytics signals (Clarity, Google Analytics): up to 13 months from your last visit, then refreshed if you give consent again.
Advertising signals (Google Ads): up to 13 months, and shorter for most of the cookies involved; see the list below.
Order records: 6 years, for tax and accounting.
Account data on app.picarm.com: while your account is active.
Photographs in a cart you never check out, and free-sample photographs: until we delete them. Email us if you would like them deleted.
Server logs and telemetry: typically 90 days.

Your rights

Under UK GDPR and the Data Protection Act 2018 you can ask us to see, correct, delete, or export your personal data, restrict or object to how we use it, or withdraw consent at any time. Email hello@picarm.com. We aim to respond within a month.

You can also complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113.

Cookies

We only set cookies, and store things in your browser, for things that need them.

Strictly necessary (no consent required, used regardless):

connect.sid: your session on the counter and on app.picarm.com.
picarm_consent_v1 (browser storage): remembers your cookie choice so we do not ask again. One choice covers www.picarm.com and the counter.
picarmJewelleryResume and picarmJewelleryOrders (browser storage, on the counter): let your cart and your orders reopen on this browser after your session ends, for up to 14 and 7 days respectively.

Analytics cookies:

_clck, _clsk (Microsoft Clarity, first-party) and MUID, ANONCHK, SM (Microsoft, third-party): behavioural analytics and session replay on the counter and app.picarm.com, up to 13 months.
_ga, _ga_<ID> (Google Analytics, where loaded): traffic statistics, up to 13 months.
picarm_visit_v1 (browser storage for this tab only, cleared when the tab closes): our own page measurement's visit id and the ad click id, so a visit from an ad to an order can be followed. In the UK, EEA and Switzerland only set once you accept, and removed if you reject.

Advertising cookies (Google Ads), on www.picarm.com, the counter and app.picarm.com:

_gcl_au (Google, first-party): links an ad click to an order so we can tell which ads work, 90 days.
IDE, test_cookie (doubleclick.net, third-party): ad measurement and retargeting, up to 13 months.

If you are visiting from the UK, EEA or Switzerland, none of these analytics or advertising cookies are set until you opt in on the banner, and Microsoft Clarity is not even downloaded until then. Google's tags do load, with cookies switched off, and send only cookieless signals until you opt in. Outside those regions, our analytics and advertising tools may set them by default in line with local rules; you can still opt out at any time with the button below, the Cookies button in the corner of the page, or your browser settings. Declining tells the tags to stop using cookies from then on; to remove cookies that are already set, clear them in your browser.

Changes

If we change anything material we will update the "Last updated" date and, where appropriate, ask you again on your next visit.