Who is responsible
The data controller is [not filled in yet], registered under number [not filled in yet] at [not filled in yet]. Write to [email protected] about anything on this page.
What we collect, and why
Only what each thing actually needs:
- To send you an order — your name, delivery address, phone number and e-mail. The phone number is for the courier; without one, parcels come back.
- To take payment — nothing. Card details are entered on our payment provider's own page and never reach this shop. We are told whether the payment succeeded.
- For an account — your name, e-mail address, a hashed password, and the delivery details you chose to save.
- For a design — the drawing itself and any picture you added to it.
- When you write to us — your e-mail address, your subject line, your message, and the internet address it was sent from.
- To keep the site working — a session identifier, your language choice and your light or dark preference. See the cookie page.
Internet addresses
An account keeps the last five internet addresses it has been signed in from, with the time. A message you send keeps the one address it came from.
This is to spot an account being passed around and to recognise the same person writing under several names. It is not used to build a picture of where you go, and the list is capped at five on purpose: the sixth pushes out the first, so it can never grow into a record of your year.
You can see your own five on your account page. Closing your account deletes them.
What we do not collect
There is no analytics on this site, no advertising network, and no tracking of you between websites. The robot check on the contact form measures how long its puzzle took and whether the page was touched; it does not read your canvas, your fonts, your graphics card or anything else that would identify you.
The legal basis
- Performance of a contract — everything needed to make and deliver your order.
- Legitimate interests — keeping the shop secure and answering your questions.
- Legal obligation — keeping invoices and accounting records for as long as tax law requires.
- Consent — where we ever ask for it, such as publishing a design you chose to share.
Who else sees it
As few as possible, and only what they need to do their part:
| Who | What they receive | Why |
|---|---|---|
| Our print partner | Your name, delivery address, phone number and your design | They make and post your item. They may not use it for anything else. |
| Stripe | Your e-mail address and the amount | They take the payment. Your card details go to them and not to us. |
| Our hosting provider | Whatever is stored on the server | They run the machine the shop is on. |
Sending data outside Europe
Some of the above are outside the European Economic Area, and a print partner is chosen for being near you — which for an order going to America means an American workshop. Where that happens, the transfer rests on the European Commission's standard contractual clauses or on an adequacy decision for that country.
How long we keep it
| What | How long |
|---|---|
| Orders and invoices | As long as tax and accounting law requires — in Bulgaria, generally ten years |
| Your account | Until you close it |
| Your designs | Until you delete them, or until your account closes |
| Messages you send us | Two years, then deleted |
| Sign-in addresses | The last five only — each new one pushes out the oldest |
| Baskets never checked out | Cleared automatically |
What you can ask us to do
You have the right to see what we hold about you, to have it corrected, to have it deleted, to restrict or object to what we do with it, and to receive it in a portable form. Write to [email protected] and we will answer within a month.
You can close your account yourself, from your account page. It asks for your e-mail address and your password, and then deletes your sign-in, your saved address, your designs, your basket and any message you have sent us.
Deleting everything is not always possible: an invoice has to be kept for as long as tax law says, whatever either of us would prefer. Past orders therefore survive the account being closed, detached from it, as the accounting records they legally are. We will tell you plainly what we can and cannot remove.
If you think we have handled your data badly, you can complain to the Commission for Personal Data Protection in Sofia (cpdp.bg), or to the authority in the EU country where you live.
Changes
If this policy changes in a way that matters, we will say so on this page rather than quietly editing it.
Last changed August 26, 2026.