Is it safe to pay for a chat analysis? Where the card goes

Paying for a Portraitor chat analysis on the website sends your card details into Stripe’s own form and never to Portraitor’s servers, according to its privacy policy, version 1.3. What is kept: Stripe holds your email address, card details and billing country, and Portraitor keeps a payment record for seven years that the policy says contains no name, no email address and no card details.

This is a narrower question than whether the chat itself is safe to hand over, which is covered in what happens when you upload your chat history. Here the subject is the card number, the email address and the record of the purchase: where each one goes, who keeps it, and whether any of it can be tied back to the conversation you analysed. The privacy policy and the terms of service, both version 1.3 of 30 September 2026, answer most of that in specific terms, so this page follows the payment through them in the order it moves.

The card number goes into Stripe’s form, not Portraitor’s

The payment step on the Portraitor home page is labelled Secured by Stripe and says: “All your card and bank details are held by Stripe. We never see them and we never store them.” The two prices offered there are $10 for a single portrait and $19 a month for ten.

The privacy policy states the mechanism behind that sentence in three places. Section 9 says card details are collected by the payment processor’s own form and never reach Portraitor’s servers. The register of third parties in section 5 says card details go from your browser directly to Stripe. Section 2 says that on the website Portraitor receives confirmation of payment and a transaction reference only, and does not receive or store your card details at any time.

So the claim is not that Portraitor protects your card number carefully. It is that Portraitor is never given it. What happens to the number after that is a question about Stripe. Stripe’s own security documentation says a PCI-certified auditor certified it as a PCI Service Provider Level 1, and that card numbers are encrypted at rest with AES-256. That is Stripe describing itself; Portraitor’s pages do not repeat it or add to it.

The terms add the commercial details of the charge. Section 6 says website prices are stated in United States dollars and are the same in every country, that no tax is added at checkout, and that if your card is issued in another currency your bank performs the conversion and may apply its own charges.

What crosses the payment gateway on the way to Stripe

The card number is the one item that goes straight from your browser to Stripe. Two other things travel a slightly longer route, and the policy names it.

The register lists Cloudflare as running the payment gateway that routes payment requests to Stripe, so that no payment credentials are held on Portraitor’s own servers. When you make a purchase, it says, your email address and the details of that purchase pass through that gateway. Your card details never pass through it.

Your email address is asked for at checkout for two stated reasons: so that Stripe can issue your receipt, and so that your portrait can be delivered. The policy says Portraitor passes it to Stripe and keeps no copy, that the address is held by Stripe, and that Portraitor retrieves it from Stripe only at the point of delivery without copying it into its own records. The register’s entry for Stripe reads: email address, card details, billing country, and describes Stripe as holding the only copy of your email address.

Stripe is also present before you decide to pay. Section 5 says the payment processor’s script is loaded on all pages of the site rather than on payment pages alone, and collects device information for fraud prevention. The cookie table in section 6 lists a Stripe fraud prevention cookie lasting up to a year. If cookies on the site are the concern, which cookies a chat analyser sets goes through the full list.

What comes back to Portraitor, and the seven year record

Saying that Portraitor stores nothing about a payment would be wrong, and the policy does not say it. Its retention table in section 7 lists what is kept and for how long.

Payment records are kept for seven years, because tax law requires it, and the table says they hold no name, email address or card details. Payment confirmations are kept for 30 days, for verifying that each payment is applied once and only once. The receipt delivery outcome, meaning whether the receipt email was accepted and when, is kept with the payment record and held with no address. The hosting provider copies the database roughly daily and keeps each copy for about a month, so a deleted record can persist that long in the copies.

Your own browser keeps some of it as well. Section 2 says your portrait history is stored in your browser together with the email address last used for billing or delivery. While a monthly purchase is being completed, the browser also keeps a short record holding the subscription reference and a single use confirmation value, so that your Pass code can still reach you if the page reloads; the policy says that record holds no card details, no email address and no Pass code. Clearing your browsing data for the site removes all of it.

Section 13 states the practical upshot from the other side. If Portraitor is required by law or by a court to disclose information, the most it says it can produce is payment records identifying no one, Pass records containing nothing identifying, and fault records with network addresses in irreversible form.

Why the payment and the conversation are never filed together

This is the part that is specific to how Portraitor is built. The payment path and the conversation path are kept apart by design, and the policy states each half in checkable terms.

There are no user accounts. A single portrait is bought as a guest, and a Pass is an anonymous code that the policy says is not associated with your name or email address; Portraitor says it is unable to identify the person using one, and stores the Pass code only in an irreversible form. How the Pass works without an account covers that arrangement in full.

On the conversation side, names, email addresses, telephone numbers, postal addresses and credentials are replaced with placeholders in your browser before anything is sent. The masked text is held only for as long as generation requires and is never written to the database, the backups or the logs.

Put the two together and there is no account to join them. The party that knows who paid, Stripe, is listed in the register as receiving your email address, card details and billing country, and nothing of the conversation. The analysis provider is listed as receiving the masked conversation text, and nothing about payment. What Portraitor keeps afterwards is a payment record with no name, email or card on it, and no conversation at all. Every third party in the register is read through on its own page.

Two honest qualifications belong in the same paragraph as that claim. The register lists the hosting provider, Hostinger, as receiving everything that passes through the service, plus your portrait and email address when it sends the email. And the point of delivery is the one moment the two paths touch: Portraitor fetches the checkout address from Stripe and the portrait is emailed to it. The policy says neither the address nor the portrait is kept by Portraitor afterwards.

One portrait leaves no card on file, a Pass does

Whether a card stays on file depends on which of the two purchases you make, and the terms say so directly.

For a single portrait at $10, section 6.1 says payment is taken before generation, the purchase does not recur, and Portraitor retains no payment method for future billing. If you only ever buy single portraits, no further sum is charged.

For the Pass at $19 a month, section 6.2 says you authorise Portraitor to charge your payment method on purchase and on the corresponding date each month until you cancel. That means a payment method stays stored with Stripe for as long as the Pass is active. The terms also refer to the billing address held by the payment processor, which is where notice of any price change on an existing Pass would be sent. When you cancel, Portraitor says it instructs the payment processor to remove your stored payment method, and if you later resume the Pass a card is collected again only when the next renewal falls due. How the monthly Pass renews walks through the cycle.

Two other cases change the path. Section 7.2 of the terms says that if a portrait cannot be generated, or the masking on your device cannot complete, nothing is transmitted and the charge is reversed automatically; the refund rules cover the rest. In the iPhone app, Apple takes the payment instead of Stripe. The policy says Apple sends Portraitor a signed purchase record listing the product, price and currency, the time of purchase, the transaction numbers, the App Store country and whether it was a test, and does not send your name, email address, Apple Account or card details. The email address you give in the app is not passed to Stripe or Apple and is not stored on Portraitor’s servers.

What the pages do not say about your payment

The pages answer where your payment details go. A few questions a careful buyer would ask are not answered on them, and this page does not fill them in.

How long Stripe keeps your email address, card details and billing country is not stated on Portraitor’s pages. The register says each third party processes data under its own privacy policy and links to Stripe’s; the retention is Stripe’s to state, not Portraitor’s.

What a website payment record contains, field by field, is not listed. The retention table says what it lacks, which is a name, an email address and card details. For App Store purchases the policy enumerates the record’s contents; for website purchases it does not, so whether the record notes anything about the portrait it paid for is not something the pages say.

Whether the device information Stripe’s script collects on ordinary pages is later joined to a purchase is not described. The policy gives its purpose as fraud prevention and says nothing further.

Section 8 says the personal data associated with you is held by the payment processor and can be erased there on request. It does not describe how Stripe handles that request. And section 9 closes with the policy’s own caveat: no method of transmission over the internet is entirely secure, so absolute security cannot be guaranteed. Whether that is safe enough is your judgement to make; the pages give you the facts to make it with, not a verdict. For what the money itself buys, the cost of a chat analysis is set out separately.

Frequently asked questions

Frequently asked questions

Your card goes to Stripe, your masked chat goes to the analysis, and the record Portraitor keeps between them carries no name, no email address and no card number.

Sources

1. Portraitor, Privacy Policy, version 1.3, 30 September 2026, sections 2, 5, 7, 8, 9 and 13.
2. Portraitor, Terms of Service, version 1.3, 30 September 2026, sections 6 and 7.2.
3. Portraitor home page, payment step and prices.
4. Stripe, Security at Stripe, Stripe documentation.