Privacy Policy

Last updated: September 2026

1. Data We Collect

When you create an account or place an order we collect your name, email address, and shipping address. Payment details are handled entirely by Stripe — we never store your card data.

2. How We Use Your Data

  • To process and fulfil your orders
  • To send order confirmations and shipping updates
  • To respond to enquiries submitted via the contact form
  • To comply with legal obligations

We do not sell, rent, or share your personal data with third parties for marketing purposes.

3. Service Providers

We share the minimum data necessary with trusted processors who act on our behalf under data-processing agreements:

  • Stripe — payment processing. Handles your card data directly; we never receive or store it.
  • Resend — sends transactional emails (order confirmations, account verification, password resets).
  • Neon — hosts our PostgreSQL database (account and order records).
  • Upstash — rate limiting; processes IP addresses to protect against abuse.
  • Vercel — application hosting and delivery.
  • Sentry — error monitoring. Configured to scrub personal data before it is recorded.
  • Pimasawa — web analytics, only if you accept it in the cookie banner. It records the pages you visit (without URL parameters) and their titles, the site you arrived from (domain only), campaign tags in the link, and your browser's language and time zone, linked to a random identifier kept in your browser instead of a cookie. Their servers also work out an approximate country and a device type from the connection. Withdrawing consent erases that identifier.

We do not sell, rent, or share your personal data for marketing.

4. Cookies

We use essential cookies for authentication and locale preferences. We ask for your consent before using any non-essential (e.g. analytics) cookies via the banner shown on your first visit; none are loaded until you accept. No advertising cookies are used. You can change or withdraw your choice at any time from the “Cookie preferences” link in the footer, and we ask again every 24 months.

5. Data Retention

We retain order records for 7 years as required by Spanish tax law; when an account is deleted these orders are kept in anonymized form (no name, email or address). Account data is retained until you delete it.

6. Your Rights (GDPR)

Under the GDPR you have the right to access, rectify, erase, or export your personal data. If you have an account you can erase it yourself from Profile → Settings. For any other request, contact us at hola@eveartstudio.com.

7. Contact

Eve Art Studio · Barcelona, Spain · hola@eveartstudio.com