Privacy policy

We only collect what we need to run the shop and fulfil your orders:

• Contact & account details: name, email address, and (if you create one) a hashed password
• Order information: items purchased, order value and history, and the billing details Stripe collects to take payment
• Payment data: handled entirely by Stripe — we never see or store your card number
• Communications: messages you send us and your newsletter consent status
• Technical data: IP address (used briefly for rate limiting and fraud prevention) and basic request logs

We use your data to:

• Process and deliver your downloadable orders and provide your download links
• Send transactional emails (order receipts with your files)
• Provide customer support and respond to enquiries
• Send marketing emails only where you've opted in — you can unsubscribe from any email at any time
• Protect the service (rate limiting, fraud and abuse prevention) and meet our legal obligations

We rely on: performance of a contract (to fulfil your order); your consent (for marketing emails); our legitimate interests (to run, secure and improve the shop); and legal obligation (to keep tax and accounting records).

We never sell your data. We share it only with the processors that operate the service on our behalf:

• Stripe — payment processing
• Resend — transactional and newsletter email
• Vercel — website hosting
• Neon — database
• Cloudflare R2 — secure delivery of your download files
• Upstash — rate limiting

Some of our processors may process data outside the UK. Where they do, we rely on appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) or addendum to the EU Standard Contractual Clauses, or transfers to countries with UK adequacy.

We keep order and invoice records for as long as required by UK tax law (generally six years). Account data is kept until you delete your account; marketing-consent records are kept while you remain subscribed and for a reasonable period after you unsubscribe to evidence your preference.

Under UK GDPR you have the right to:

• Access the personal data we hold about you — you can download it instantly from your account
• Erasure ('right to be forgotten') — you can delete your account from your account page
• Rectify inaccurate data, and object to or restrict processing
• Data portability, and to withdraw consent for marketing at any time

We use only strictly-necessary and functional browser storage — no advertising or analytics cookies. See our Cookie Policy for the detail.

To exercise any of your rights or ask a question, email care@japandihausprints.com. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.