Privacy & Cookie Policy

1. Data controller

Thomas Arienti, Italy — operator of Cartacea (cartacea.store). Contact: cartacea.store@gmail.com.

2. Data we collect

• Name, email address and order details, needed to process your purchase and deliver your files.
• Payment data, handled directly by Shopify Payments — we never see or store your card details.
• Approximate country, derived from your IP address, used only to show prices in your currency.

3. Why we use it (legal basis)

To perform the purchase contract (Art. 6(1)(b) GDPR), to comply with tax and accounting obligations (Art. 6(1)(c)), for the essential operation of the site (legitimate interest, Art. 6(1)(f)), and — only where you accept — for ad measurement with the Meta Pixel (consent, Art. 6(1)(a)). We do not sell your data.

4. Service providers

• Shopify — checkout, payments and order management.
• Cloudflare — website hosting, security and delivery.
• Google Drive — hosting of the downloadable files.
• Meta — ad measurement via the Meta Pixel, where allowed (see Cookies).

Some providers may process data outside the EU under appropriate safeguards such as Standard Contractual Clauses.

5. Retention

Order data is kept for as long as required by Italian tax law (generally 10 years), then deleted.

6. Your rights

You can request access, correction, deletion, restriction or portability of your data, or object to its processing, by writing to cartacea.store@gmail.com. You may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or your local authority.

7. Cookies

Essential storage (always on): remembering your chosen currency, the prints in your bundle, and your cookie choice. These are needed for the site to work and don't require consent.

Advertising — Meta Pixel (Meta Platforms Ireland Ltd.): measures page views and shopping actions (adding prints and starting checkout, and completed purchases when you open your download page) together with print IDs, order value, currency, and device/browser data such as IP address and Meta cookies. We use it to measure and improve our ads on Facebook and Instagram. We do not send your name or email to Meta. Meta may transfer data to the United States under the EU–US Data Privacy Framework.

In the EU/EEA, the UK and Switzerland the Meta Pixel only runs if you click "Accept"; elsewhere it runs by default. We keep a record of your choice (accepted or rejected, the date, and the notice version) in your browser. You can change or withdraw your choice at any time with "Cookie settings" at the bottom of every page, or opt out of ad personalisation in your Meta account settings.

The Shopify checkout may set its own cookies to complete your payment. You can also clear or block cookies in your browser settings; some features may stop working.