Private upload
Customer-selected photos are uploaded directly to a private Vercel Blob store over HTTPS. They are never placed in the public website directory and the private object URL cannot be opened without authorization. The built-in sample photo does not upload a customer file.
Purpose
Uploaded images are used to review visible details, prepare a preview, produce the personalized figure, and provide customer support. When AI preview generation is enabled, selected private source photos and customization instructions are sent server-to-server to OpenAI. The API key is never exposed in the browser, and the generated result returns to the same private storage session.
Controlled access
Upload permissions are short-lived and limited to one randomly generated pathname, supported image types, and 10 MB. The server verifies the uploaded file signature before accepting it. Temporary viewing links expire after five minutes; permanent public photo URLs are not used.
Retention and deletion
Customer source photos are scheduled for automatic deletion 30 days after upload. Customers can remove a photo before checkout from the customization page. An active support, fraud, dispute, or legal requirement may require a separately documented retention decision.
Requesting deletion
After checkout, request earlier deletion at support@memoryfigure.com and include the Shopify order number. Do not attach additional sensitive photos unless requested through a secure channel.
Your responsibility
Upload only photos you have permission to use. Avoid government IDs, medical documents, payment cards, intimate images, or unrelated personal information.