Privacy Policy

We collect information you provide directly and information gathered automatically when you use our website.

Information you provide:

• Name, email address, and shipping/billing address when placing an order
• Payment information (processed securely through Shopify Payments — we never store card details)
• Pet photos you upload to create your custom portrait
• Messages and enquiries sent through our contact form
• Email address if you subscribe to our newsletter
• Account information if you create a customer account

Information collected automatically:

• IP address, browser type, device type, and operating system
• Pages visited, time spent, and links clicked
• Referring website or search terms that brought you to us
• Cookie and tracking data (see Section 4)

We use your personal data only for legitimate business purposes:

• Fulfilling orders — processing payments, creating your portrait, and arranging shipping
• Customer communication — sending order confirmations, artwork proofs, and shipping updates
• Customer support — responding to questions, revision requests, and complaints
• Marketing (with consent) — sending promotional emails and offers if you've opted in
• Improving our service — analysing usage patterns to enhance our website and product range
• Legal compliance — meeting tax, accounting, and regulatory obligations
• Fraud prevention — detecting and preventing fraudulent transactions

We will never sell your personal data to third parties or use it for purposes beyond those listed above without your explicit consent.

We share your information only with trusted service providers who help us operate our business. All third parties are contractually obligated to keep your data secure and use it solely for the purpose it was shared.

• Shopify — our e-commerce platform (order management, payments, hosting)
• Payment processors — Stripe, PayPal, Apple Pay, and Google Pay for secure payment handling
• Shipping carriers — to fulfil and deliver your order
• Email service providers — Klaviyo or similar, for transactional and marketing emails
• Analytics providers — Google Analytics (anonymised data only)
• Legal authorities — only when required by law or to protect our legal rights

Our website uses cookies — small text files stored on your device — to improve your browsing experience and help us understand how our site is used.

Types of cookies we use:

• Essential cookies — required for the site to function (shopping cart, login sessions)
• Analytics cookies — help us understand page traffic and improve our site (Google Analytics)
• Marketing cookies — used for personalised advertising on platforms such as Facebook and Google (only with consent)
• Preference cookies — remember your settings and preferences

You can manage cookie preferences via your browser settings or through our cookie consent banner. Disabling certain cookies may affect website functionality.

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you
• Correction — ask us to update or correct inaccurate information
• Deletion — request that we delete your personal data ("right to be forgotten")
• Portability — receive your data in a structured, machine-readable format
• Objection — object to our processing of your data for marketing purposes
• Withdrawal of consent — unsubscribe from marketing emails at any time via the unsubscribe link
• Lodge a complaint — contact your local data protection authority if you believe your rights have been violated

To exercise any of these rights, please contact us at privacy@thecanvasstudio.com. We will respond within 30 days.

We take the security of your personal data seriously and implement industry-standard safeguards:

• All data transmitted via our website is encrypted using SSL/TLS technology
• Payment processing is handled by PCI-DSS compliant providers — we never store card numbers
• Access to customer data is restricted to authorised staff on a need-to-know basis
• Our platform (Shopify) undergoes regular security audits and penetration testing
• We conduct periodic reviews of our data handling practices

While we take every reasonable precaution, no internet transmission is 100% secure. In the unlikely event of a data breach affecting your rights and freedoms, we will notify you in accordance with applicable law.

Our website may contain links to third-party websites (e.g. social media platforms, review sites). These sites have their own privacy policies, and we are not responsible for their content or practices. We encourage you to review the privacy policy of any external site you visit.

Our website and services are not directed at children under the age of 16. We do not knowingly collect personal data from anyone under 16 years old. If you believe a child has provided us with personal information, please contact us immediately and we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, regulatory, or operational reasons. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Notify registered customers via email if the changes significantly affect how we use your data
• Display a notice on our website for a reasonable period

We encourage you to review this page periodically. Your continued use of our website after changes are posted constitutes your acceptance of the updated policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please don't hesitate to reach out: