Privacy Policy
Draft, pending review by our attorney. It describes how we actually operate today, and we will update this page when the review is complete.
This policy describes how we handle personal data for customers in the United States. It covers what we collect, why we collect it, who sees it and how to have it removed.
Who we are
We are a small United States business making personalized Christian wall art. This policy applies to this website and to the emails we send about your order. Questions about anything here go to the privacy address at the bottom of this page.
What we collect and why
To take and fulfill an order we collect your email address, your name, your shipping address and, if you give it, a phone number for delivery questions. To make your piece we collect the photo you upload and the personalization text you enter, which can include names, dates, verses and the name of a church, along with the optional field describing the occasion and the person the gift is for. We keep a record of the consents you give, such as agreeing to marketing email or confirming you hold the rights to a photo, together with the date and the wording you agreed to. Once you consent to analytics we collect ordinary site usage data, such as the pages viewed and the general region of the visit. We use each of these only for the purpose it was given: taking payment, making and shipping your piece, answering your messages, keeping records we are required to keep, and improving the site.
Payment
Payments are processed by Stripe. Card details are entered on Stripe's own secure form and never reach our servers, so we never see or store a card number. We receive from Stripe only what we need to reconcile the order, such as the amount, the currency, the result of the charge and the last four digits of the card. Stripe handles that data as its own controller under its privacy policy.
Your photos
Photos you upload are held in private, access-controlled storage. The storage is not public and not listable, and a photo is opened only through a short-lived signed link generated for a specific request. The people who can see a photo are the staff assigned to your order, meaning the artist composing your piece, the person reviewing the proof, and the print partner producing the approved artwork. We do not sell photos, we do not use them to train models, and we do not use them in marketing unless you separately give permission, for example by checking the consent box on the Share Their Wall page. We keep a photo while your order is active and afterward with your order record so that a reprint under the Kept Promise is possible. Ask us to delete a photo and we delete it; if the order is still in production we will tell you that deleting it ends the order.
Cookies and analytics
Cookies and local storage that the store needs in order to work, such as remembering your cart and your market, are always on. Non-essential tracking, including analytics and any advertising measurement, stays off until you consent, and if you decline nothing non-essential is loaded. You can change your mind at any time by clearing the site data in your browser or by writing to us.
Emails about your order, your proof and your delivery are part of the service you bought and are sent whether or not you take marketing email. Marketing email is opt-in only, and we send it only if you asked for it. Every marketing email carries an unsubscribe link that works immediately, and you can also reply and ask us to stop. Memorial orders never receive promotional content of any kind. We do not sell or rent email addresses.
Sharing
We share personal data only with the service providers who make an order possible: our payment processor, our print and shipping partners, our email sending provider and our hosting and database provider. Each receives only what it needs. We may also disclose data where the law requires it. We do not sell personal data.
Your rights and deletion
You may ask for a copy of the data we hold about you, ask us to correct it, or ask us to delete it. Deletion is self-service: go to /delete-my-data, enter your email address, and we send a six-digit code to prove the request is yours. The page then shows you exactly what will be erased and what anonymized record is retained before you confirm. No account and no login are needed, and once you confirm we cannot undo it. When we delete an account we remove your name, email address, phone number, shipping address, uploaded photos, personalization text and consent records. What we keep afterward is an anonymized record of the transaction for tax purposes: the order number, the order date, the items ordered, the amounts charged and the city, state and ZIP code the order shipped to, with no name, email address, street address or photo attached.
Children
This store is not directed at children and we do not knowingly collect data from anyone under 13. If you believe a child has given us data, write to us and we will remove it.
Changes and contact
If we change this policy we will update the date on this page and, for a material change, tell customers by email. For a deletion request, use the self-service page at /delete-my-data. For any other privacy question, write to us at the privacy address shown below.
Privacy and legal contact: privacy@giftedbros.com