1. Who we are
CarlaPlaysArt ("we", "us") operates this online store at carlaplaysart.com. For any questions about this policy, please use our contact form.
2. What data we collect
- Account data — name, email address, hashed password.
- Google sign-in — if you choose to sign in with Google, we receive your name and email address from your Google account to create and identify your account. We do not request or access any other Google data.
- Shipping data — name and delivery address you save to your account.
- Order data — items purchased, amounts paid, payment transaction IDs, order status.
- Email change log — previous and new address, timestamp (retained for security audit purposes).
- Newsletter subscription — email address and subscription date, if you opt in.
- Custom piece requests — name, email, and the details you submit via the request form.
3. Why we collect it
- To process and fulfil your orders.
- To send you order confirmations and shipping updates.
- To allow you to manage your account and shipping address.
- To send the newsletter, only if you explicitly subscribed.
- To comply with legal and financial record-keeping obligations.
4. Data retention
Account data is retained while your account is active. If you delete your account, your profile is soft-deleted (deactivated) and personal identifiers are removed within 30 days, but order history is retained for a minimum of 5 years for legal and financial audit purposes. The email change log is retained for 12 months. Newsletter subscriptions are retained until you unsubscribe.
5. Third-party processors
We share data only with the following categories of processor, solely to operate the store:
- Database and authentication — stores your account and order data securely (EU region).
- Transactional email — delivers order confirmations and notifications.
- Payment processor — handles payment transactions. The processor's own privacy policy applies to all payment data.
- Hosting and API infrastructure — serves the website and processes API requests.
- Network services — provides DNS and traffic routing.
We do not sell your data or share it with advertisers.
6. Cookies & local storage
We use only strictly necessary cookies and local storage — specifically your authentication session token and your cookie consent preference. We do not use tracking or advertising cookies.
7. Your rights (GDPR)
If you are in the EU or EEA you have the right to:
- Access the personal data we hold about you.
- Request correction of inaccurate data.
- Request deletion of your data (subject to legal retention requirements).
- Request a machine-readable export of your data.
- Object to or restrict processing.
To exercise any of these rights, please use our contact form. We will respond within 30 days.
8. Changes to this policy
We may update this policy from time to time. Material changes will be communicated by updating the date at the top of this page.