Legal
Privacy Policy
We are a small shop. We need your name and address to send you a canvas, and your email to tell you it is on its way. That is the whole of it, unless you tick the optional advertising box. We do not sell your data to anybody, ever.
1. Who is responsible
The controller of your personal data is , . Questions, requests and complaints go to and we answer within a month, usually the same week.
2. What we collect and why
When you order
Your name, email address, delivery address, the details of what you ordered and the personalisation you asked for — the names, the date, the font number and the ink colour numbers.
Why: to make your canvas, send it, and deal with you about it afterwards. Legal basis: performance of the contract between us. Without this data we cannot make or send anything.
When you pay
We never see or store your card number. Stripe collects it on its own page and tells us only that a payment succeeded, along with the last four digits, the card brand, the country and the name on the card, so we can match a payment to an order and handle refunds and disputes.
Legal basis: performance of the contract, and our legal obligation to keep accounting records. Stripe is an independent controller for its own purposes, under its privacy policy.
When you write to us
Your email address and whatever you tell us in the message. Legal basis: performance of the contract if it concerns an order, otherwise our legitimate interest in answering people who contact us.
When you visit the site
Our host records standard server logs — the pages requested, the time, the browser and a truncated network address — to keep the site up and spot abuse. Legal basis: our legitimate interest in running a working, secure site.
We also keep minimal first-party funnel measurement on our own server so we can understand whether advertising clicks lead to pages that load, engagement with the page, the main configurator call-to-action, viewing the configurator or pricing area, product customisation, checkout attempts, a checkout created by Stripe and a completed purchase. Engagement signals may include reaching approximately halfway down the page or keeping the page visible for about thirty seconds. It records the event time, requested path, referring hostname, campaign labels present in the URL, whether a recognised ad-click parameter was present and limited commerce details such as variant, currency, country and value. It does not store a measurement cookie, persistent visitor identifier, network address or browser user-agent, and these first-party records are not sent to Meta, Google Ads or Pinterest.
Google Ads' tag loads when a page opens using Consent Mode v2, with advertising storage, advertising user data and ad personalization denied unless you have explicitly allowed them. Before you consent, Google may receive limited cookieless consent and measurement signals, such as the page visited and technical request information. This limited processing does not set Google advertising cookies. The Meta Pixel and Pinterest Tag do not load before you agree to optional advertising measurement. We store your advertising preference in your browser so we can remember your choice.
The lettering fonts are loaded from Google Fonts, which means your browser asks Google's servers for them and Google sees your network address in doing so. Google describes this in its privacy policy.
Advertising measurement and your choices
A compact panel lets you choose between Only necessary and Allow advertising. Your order works the same either way, and nothing about your price, delivery or service changes if you reject advertising measurement.
For a completed Stripe payment, Google Ads may also receive a purchase conversion signal containing the verified order subtotal, checkout currency and Stripe checkout transaction ID. This is sent under the Google consent settings described above, without the names or other personalisation text on your canvas.
If you allow optional advertising measurement, the Meta Pixel and Pinterest Tag load and Google Ads enables consent-based advertising storage and measurement. Meta, Google and Pinterest may receive technical information generated by your browser and their measurement tools, such as the page visited, browser or device information, network address and advertising identifiers where available. If you complete a paid order, our server may also send Meta and Pinterest conversion events through their server-side APIs. These can include the order value, currency and product variant, hashed contact or location identifiers where available, and technical identifiers used to match the event. We do not send the names on your canvas, your personalisation text or information about your guests to any advertising platform.
Legal basis: your consent for optional advertising storage, tracking and related data use. The legal basis for any limited cookieless signals sent by Google's advanced consent mode should be evaluated for each jurisdiction before enabling this mode there. You can change your choice at any time using Cookie settings in the footer. Changing your choice does not affect anything done before the change.
As of today no Meta tracking pixel is installed on this site. If we add one, it will load only for visitors who have given consent, and this policy will be updated before it does.
A Meta pixel is active on this site. It loads only after consent has been given and records a PageView for consenting visitors so we can measure whether an advert brought someone to the site. Meta's handling of that data is covered by its privacy policy.
3. Who else sees your data
Only the people needed to get a canvas to your door:
- Stripe — to take the payment.
- Our carrier — your name, address and telephone number, so the parcel can be delivered and you can be reached about it.
- Our host — , which serves this site and keeps the server logs described above.
- Our email provider — to send and receive messages.
- Our accountant and the tax authorities — invoices and payment records, because the law says we must keep them.
- Meta — pixel/browser data and, after a paid order, a server-side purchase event; only after you allow advertising measurement.
- Google Ads — limited cookieless consent and measurement signals before opt-in, and additional advertising measurement only after opt-in. Google's handling of that data is covered by its privacy policy.
- Pinterest — Tag/browser data and, after a paid order, a server-side conversion event; only after you allow advertising measurement. Pinterest's handling of that data is covered by its privacy policy.
We do not sell your data, rent it, or hand it to anybody for their own marketing.
4. Data leaving Europe
Some of the services above are United States companies, so your data may be processed outside the European Economic Area. Where that happens we rely on the European Commission's standard contractual clauses, or on an adequacy decision where one covers the recipient.
5. How long we keep it
- Order and invoice records — for as long as accounting and tax law requires, which is normally ten years from the end of the financial year.
- Personalisation text — kept with the order for the same period, so we can reprint if a canvas is lost or damaged.
- Emails — three years after our last exchange, unless they concern a dispute, in which case until it is closed.
- Advertising measurement choice — stored in your browser until you change it through Cookie settings or clear your browser storage.
- Server logs — a short period set by our host, and then deleted automatically.
6. Your rights
Under the General Data Protection Regulation you may:
- ask what we hold about you and get a copy;
- have mistakes corrected;
- have your data erased, where we are not obliged to keep it;
- ask us to restrict what we do with it;
- receive it in a portable, machine-readable form;
- object to processing based on our legitimate interests;
- withdraw consent to optional advertising measurement at any moment through Cookie settings in the site footer.
Email and say which one you want. We do not charge for this and we do not ask why.
If you think we have handled your data badly, please tell us first so we can fix it. You also have the right to complain to the data protection authority in the European country where you live or work.
7. Children
This shop is not aimed at children and we do not knowingly collect their data. Children do press their fingerprints onto these canvases at christenings and birthdays — but those prints stay on your canvas in your home. They never reach us.
8. Security
The site is served over an encrypted connection. Card details never touch our servers. Order records sit in accounts protected by strong passwords and two-factor authentication, and only the people who make and post your canvas can see them.
9. Changes
If we change how we handle data — for instance when we start running adverts — we update this page and change the date at the top before the change takes effect.