Privacy policy
What we collect, why, who else sees it, and how to get it removed.
Who is responsible
The data controller is [NOMBRE Y APELLIDOS], tax identification number [DNI CON LETRA], registered at [CALLE Y NUMERO, CP CIUDAD, ESPANA]. For anything on this page, write to [email protected].
Your photograph never leaves your device
This is worth stating first, because it is unusual. The photo you upload is processed entirely inside your own browser. It is never sent to us and we have no way to see it.
What reaches our servers is the result: the nail sequence, the options you chose, and a small image of the finished string art design so you can recognise the piece in your cart. The original photograph stays on your device.
What we collect and why
When you order: your name, email address and delivery address. We need them to make the contract with you, produce the piece and get it to you.
If you open an account: your email address and a password, held by our authentication provider and never visible to us in readable form. An account only buys you order history — you can buy without one.
Your design: the nail sequence, the configuration you chose and the preview image of the finished piece. Without these we cannot make what you paid for.
If you write a review: your name or chosen display name, your email address, your rating and text, and any photos or clips you attach. The email address is used solely to check whether you are a verified buyer, and is never published.
Technical data: your IP address is held briefly in memory to limit abusive request rates. It is not written to any database and disappears when the server restarts.
Photos and clips attached to reviews
Please read this before you upload anything. Media attached to a review is stored in a public location: anyone who knows the address of the file can open it, whether or not the review itself has been approved.
Do not attach anything you would not be comfortable making public. You can ask us to delete it at any time.
Who else processes your data
We keep the list of third parties short, and each one only receives what its job requires.
Stripe handles payment. Your card details go straight to Stripe and never touch our servers.
Supabase hosts the database and the account system.
Resend sends the order emails.
Packlink quotes shipping and passes your name and address to the carrier that delivers the parcel.
Cloudflare routes traffic to the site and protects it from attack.
Photon, an address lookup service run by Komoot on OpenStreetMap data, powers the address suggestions at checkout. What you type into the street field is sent there to fetch suggestions. Typing your address manually without using a suggestion works exactly as well.
Transfers outside the European Union
Some of those providers are established in the United States. Where that is the case, the transfer relies on the European Commission adequacy decision or on standard contractual clauses.
How long we keep it
Order records are kept for as long as commercial and tax law requires us to keep them, which in Spain is six years from the end of the financial year.
Account data is kept until you close the account. Reviews are kept until you or we remove them.
Your rights
You may ask us for a copy of your data, correct it, delete it, restrict or object to how we use it, or receive it in a portable format. Write to [email protected] and we will act within one month.
Deleting an order record is not always possible while tax law still requires us to hold it. If that applies, we will tell you plainly and delete it as soon as we may.
If you think we have handled your data badly, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos, or to the supervisory authority of the country where you live.
Changes to this policy
If we change how we handle your data, we update this page and move the date at the top. Material changes will be announced by email to anyone holding an account.