Privacy Policy

Who we are

We are a small business based in Latvia, in the European Union, making personalized Christian wall art. This policy applies to this website and to the emails we send about your order. Questions about anything here go to hello@giftedbros.com.

What we collect and why

To take and fulfill an order we collect your email address, your name, your shipping address and, if you give it, a phone number for delivery questions. To make your piece we collect the photo you upload and the personalization text you enter, which can include names, dates, verses and the name of a church, along with the optional field describing the occasion and the person the gift is for. We keep a record of the consents you give, such as agreeing to marketing email or confirming you hold the rights to a photo, together with the date and the wording you agreed to. When you browse the site we record ordinary usage data, such as the pages viewed, where the visit came from and the general region of the visit, as described under Cookies and analytics. We use each of these only for the purpose it was given: taking payment, making and shipping your piece, answering your messages, keeping records we are required to keep, and improving the site.

Payment

Payments are processed by Stripe. Card details are entered on Stripe's own secure form and never reach our servers, so we never see or store a card number. We receive from Stripe only what we need to reconcile the order, such as the amount, the currency, the result of the charge and the last four digits of the card. Stripe handles that data as its own controller under its privacy policy.

Your photos

Photos you upload are held in private, access-controlled storage. The storage is not public and not listable, and a photo is opened only through a short-lived signed link generated for a specific request. The people who can see a photo are the staff assigned to your order and the print partner producing the approved artwork. We do not sell photos, we do not use them to train any model of our own, and we do not use them in marketing unless you separately give permission, for example by checking the consent box on the Share Their Wall page. How long we keep a photo is set out below. Ask us to delete a photo and we delete it; if the order is still in production we will tell you that deleting it ends the order.

Cookies and analytics

Cookies and local storage that the store needs in order to work, such as remembering your cart and your market, are always on.

We keep our own record of visits to this site, using a cookie of our own: the pages viewed, where the visit came from and the general region. It stays with us and is used only to understand and improve the store. Our hosting providers, Lovable and Cloudflare, also record basic statistics about visits for us.

We also use three outside services. Google Analytics shows us how the store is used. Meta measures our Facebook and Instagram ads and helps show them to people likely to be interested: our site tells Meta, through Cloudflare, about page views, pieces viewed, pieces added to a cart, checkouts and purchases, along with your IP address and browser type, but never your name, email address, phone number or postal address. Microsoft Clarity records how pages are used, with all text on the page and in every field masked.

You can turn these three services off at any time on Your privacy choices, and if your browser sends a Global Privacy Control signal we treat it as that choice automatically. Visitors from the European Union, the European Economic Area, the United Kingdom and Switzerland are asked first: these services run only after they accept, and they can change their choice at any time on the same page.

Email

Emails about your order, your proof and your delivery are part of the service you bought and are sent whether or not you take marketing email. Marketing email is opt-in only, and we send it only if you asked for it. Every marketing email carries an unsubscribe link that works immediately, and you can also reply and ask us to stop. Memorial orders never receive promotional content of any kind. We do not sell or rent email addresses.

Sharing

We share personal data only with the service providers who make an order possible: our payment processor, OpenAI, whose image technology creates your artwork from your photo and your words, our print and shipping partners, our email sending provider and our hosting and database provider. Each receives only what it needs. For measurement we also use Google Analytics, Meta and Microsoft Clarity, as described under Cookies and analytics. Some state laws treat sending data to an advertising platform as sharing for targeted advertising; Your privacy choices is how you opt out of that. We may also disclose data where the law requires it. We do not sell personal data.

Why we use your data, how long we keep it, and your rights

Orders (name, email, phone, address, payment status): to carry out our contract with you (GDPR Art. 6(1)(b)), and to keep the records tax and accounting law requires (Art. 6(1)(c)).

Your photo and details for personalized pieces: to create, proof, and print the piece you ordered (Art. 6(1)(b)).

Artwork creation: for the Church Portrait and In His Keeping, your photo and details are sent to OpenAI, whose image technology creates your artwork (Art. 6(1)(b)). OpenAI does not use them to train its models, and may keep them for up to 30 days to monitor abuse before deleting them.

Service emails (order confirmation, proof, shipping): to carry out our contract (Art. 6(1)(b)). Marketing emails: your consent (Art. 6(1)(a)), which you can withdraw at any time.

Occasion reminders: your consent, confirmed by email (Art. 6(1)(a)).

Analytics and ad measurement: your consent where the law requires it, including for visitors in the EU, EEA, UK, and Switzerland; otherwise our legitimate interest in understanding how the store is used (Art. 6(1)(f)). You can opt out at any time on Your privacy choices.

Transfers outside the EU

Some of our providers are based in, or reach data from, the United States or the United Kingdom. These transfers rely on the EU-US Data Privacy Framework where the provider is certified, the European Commission's adequacy decision for the UK, or the Commission's Standard Contractual Clauses. Write to hello@giftedbros.com for details.

How long we keep it

Order and tax records: 5 years, as the law requires, with the minimum personal data.

Your uploaded photos: deleted 90 days after delivery.

Photos from checkouts that were never paid: deleted after 30 days.

When you ask us to delete your data: your account is deleted right away. Details tied to your orders are kept for up to 180 days, only to settle open orders, refunds, and chargebacks, and are then deleted or anonymized. Tax records stay for 5 years with the minimum personal data.

Your rights

You have the right to access, correct, delete, restrict, and port your data, and to object to its use, including to direct marketing at any time. You can withdraw consent at any time without affecting what was done before. Write to hello@giftedbros.com.

You can complain to the data protection authority in your country of residence, your place of work, or where you think the problem happened. In Latvia, that is the Data State Inspectorate.

Your rights and deletion

Deletion is self-service: go to /delete-my-data, enter your email address, and we send a six-digit code to prove the request is yours. The page then shows you exactly what will be erased and what anonymized record is retained before you confirm. No account and no login are needed, and once you confirm we cannot undo it. When we delete an account we remove your name, email address, phone number, shipping address, uploaded photos, personalization text and consent records. What we keep afterward is an anonymized record of the transaction for tax purposes: the order number, the order date, the items ordered, the amounts charged and the city, state and ZIP code the order shipped to, with no name, email address, street address or photo attached.

Children

This store is not directed at children and we do not knowingly collect data from anyone under 13. If you believe a child has given us data, write to us and we will remove it.

Changes and contact

If we change this policy we will update the date on this page and, for a material change, tell customers by email. For a deletion request, use the self-service page at /delete-my-data. For any other privacy question, write to us at hello@giftedbros.com.