Privacy policy

1. Data controller

PenPath Studio is the data controller for any personal information collected through the website. For data-protection questions, please open a ticket on our contact page.

2. What we collect

We collect only the information we need to fulfil your order and provide support:

• Name, email address, billing address, and delivery address.
• Order details, including the map design choices and custom text you provide.
• Payment confirmation from Stripe (we do not store full card numbers).
• Support ticket messages and any attachments you send us.
• Account information if you choose to create an account.

3. How we use your data

We use your data to process and deliver orders, communicate with you about your order, respond to support tickets, and keep records for tax and accounting purposes. If you opt in, we may also email you about new products or studio updates. You can unsubscribe at any time.

4. Legal basis

We process personal data on the basis of performing our contract with you (fulfilling an order), complying with legal obligations (tax and accounting), and pursuing our legitimate interests (fraud prevention and customer support). Marketing emails are only sent with your consent, which you can withdraw at any time.

5. Who we share data with

We use a small number of service providers to run the site and process orders. These providers act as data processors under our instructions:

• Lovable Cloud - website hosting, database, file storage, and email sending.
• Stripe - payment processing.

We do not sell your personal data. We may disclose it if required by law or to protect our rights.

6. Data retention

We keep order and accounting records for 5 years to meet tax and legal requirements. Support tickets and inactive accounts are reviewed periodically and deleted when no longer needed. You can ask us to delete your data sooner, but we may need to keep certain records where the law requires it.

7. Security

We use industry-standard measures to protect your data, including encrypted connections (HTTPS), access controls on the admin dashboard, and a secure payment flow handled by Stripe. No online service can be completely risk-free, so we monitor the site and review security practices regularly.

8. Your rights

Under UK data protection law and the GDPR, you have the right to access, correct, delete, restrict, or move your personal data, and to object to certain processing. To exercise any of these rights, please contact us through the contact page.

9. Cookies

We only use cookies that are strictly necessary for the site to work, such as keeping your cart and login session. We do not use analytics or advertising cookies. You can manage or disable cookies through your browser settings, but some features may not work without them.

10. International transfers

Some of our service providers may process data outside the UK and EEA. Where this happens, we rely on appropriate safeguards, such as the UK/EU standard contractual clauses, to protect your data.

11. Changes to this policy

We may update this policy from time to time to reflect changes in how we process data. The latest version will always be available on this page.

12. Contact

For privacy questions, please open a ticket on our contact page.