Privacy policy

Information we collect and why

• Photos and edits you upload: we use your photos only to produce the products you purchase. Draft uploads and crop selections let you prepare your order. We do not send your photos to Google or Meta for advertising.
• Name, email address, phone number and addresses: we use these to administer your order, arrange delivery or collection, communicate about your purchase and respond to your questions. We also use email addresses for our own email marketing until you unsubscribe or an applicable deletion request is fulfilled. Phone numbers are for order administration only; we do not use them for SMS or call marketing.
• Order and payment information: product choices, quantities, prices, order IDs, payment references and payment status help us process purchases, keep accounting records and handle order issues. Payment providers process payment details as part of checkout.
• Browser, device, cookie and usage information: information such as IP addresses, browser and device details, pages visited, referral information and cookie or advertising identifiers helps operate and secure the website and understand site use. Optional Google and Meta tools also use this information for advertising measurement, subject to your advertising choices.
• Draft storage: we store unfinished order details and upload references on our systems and in your browser’s local storage so you can return to an order. Clearing browser storage may remove your local draft information; it does not itself delete information already sent to us.

How long we keep information

• Photos for completed orders: all copies are deleted seven days after dispatch or collection.
• Unpaid abandoned uploads: these are deleted 30 days after the last activity.
• Paid but uncollected orders: these require staff review and are not deleted using the unpaid-abandoned-upload timer.
• Order and accounting records: we keep the minimum records needed for seven years, except where a specific legal obligation or active dispute requires longer retention. This does not mean we routinely retain your photos for seven years.
• Email marketing: we retain email addresses for our own marketing until you unsubscribe or an applicable deletion request is fulfilled. We keep a minimal suppression record to respect your unsubscribe request.

Privacy and deletion requests may be subject to specific legal recordkeeping obligations or an active dispute. We explain any applicable exception when responding to your request.

Who receives information

We disclose information to service providers as needed to operate our business: hosting and storage providers, payment and order-processing providers (including Square and Shopify where used for your order), and email-delivery providers. These services support functions such as storing order uploads, taking payment, managing orders and sending messages.

We may also disclose information when required by law or legal process, or as necessary to protect legal rights, address fraud or security issues, or handle an active dispute. Google and Meta receive advertising-related information as described below when optional advertising is allowed.

We do not sell customer lists for money. Some advertising-related disclosures may nevertheless be considered a “sale” or “sharing” of personal information under applicable privacy laws.

Google and Meta advertising

We use optional Google and Meta advertising tools to understand which ads bring visitors and purchases to our website and to measure advertising performance. These tools may receive browser and device information, IP addresses, page and event information, cookie or advertising identifiers, purchase amounts, currency and order IDs. Meta may also receive hashed email addresses, names and general location details for matching. Hashing transforms a value for matching; it does not make the information anonymous. Photos and phone numbers are not sent for advertising.

You can disable optional Google and Meta advertising and related purchase sharing using Your Privacy Choices / Do Not Sell or Share My Personal Information. This choice does not disable essential payment, security or order processing, or unsubscribe you from email marketing. It does not undo information previously disclosed.

We honor Global Privacy Control (GPC) as an advertising opt-out, including when there is no saved opt-out cookie. GPC overrides a saved choice to allow advertising. We do not respond to the older Do Not Track (DNT) signal; use GPC or our privacy choices page to communicate your advertising choice.

The advertising preference cookie lasts one year and applies to the browser and device where you save it. Clearing cookies may remove your choice, and you should set your preference separately in other browsers or devices. Our US-oriented website permits optional advertising unless you opt out or a GPC signal is active. This is not an international consent framework.

These providers may collect information about your activity over time and across different websites or online services. Learn more about their practices: how Google uses information from sites that use its services and the Meta Privacy Policy.

Email and phone choices

To stop our email marketing, use the unsubscribe link in a marketing email or email hello@tartanmagnets.com with your request. We may still send non-marketing messages needed to administer your order. Advertising preferences and email unsubscribe requests are separate.

We use your phone number only for order administration, not for SMS or call marketing.

Your rights and privacy requests

Depending on where you live and which laws apply, you may have rights to access or obtain a copy of personal information, correct it, request deletion, or opt out of certain advertising-related uses, sales or sharing. California and other state privacy rights depend on the law’s applicability and exceptions; not every statutory right necessarily applies to every business or request.

Email hello@tartanmagnets.com with the subject “Privacy request,” describe what you would like us to do, and include the email address used for your order and an order reference if available. Do not send payment card details. We may ask for information needed to verify your identity or an authorized representative’s authority where appropriate before disclosing or changing information.

We will explain how we can respond under applicable law, including any relevant retention exceptions. You do not need an account or identity verification to use the browser-based advertising opt-out.

Changes to this policy

We will post updated policies on this page and update the effective date above. If a change requires additional notice under applicable law, we will provide that notice.