Privacy
What this site collects, why, who else sees it, and how to get it back or have it erased. Written against the code rather than from a template — if something here is wrong, the code is the thing to correct.
Who is responsible
This site is operated by Immersa team. It is the data controller responsible for the personal data described on this page. For privacy-related requests, contact us at immersateam@gmail.com.
The short version
You can design here without giving anything away: no account, no cookie, no analytics until you say yes. Ordering here needs an address, because a parcel does; ordering on the tablet at an exhibition does not, because that one only asks for your name and one way to answer you. Signing in needs your Google name and email, because a gallery has to belong to somebody. Everything else is optional and asked for at the moment it matters.
What is collected
| What | Why | On what basis | How long |
|---|---|---|---|
| Designs you make | The pattern is generated on the server and sent back to your browser. Nothing about you is attached to it and nothing is kept once the page has it. | Necessary to provide the studio you asked for | Not stored |
| Things your own browser remembers | Your last design, your answer to the cookie banner, whether you have seen the small-screen notice, and — only if you tick the box at checkout — your delivery details. These are stored locally in your browser. The locally stored copy is not sent to us unless you use those details when placing an order. Clearing your browser data removes the local copy. | Necessary, and in your control | Until you clear your browser |
| Google Analytics | Page views, clicks on named buttons, and the steps of the shop — which product was chosen, and how long choosing and filling in the form took. Purchases carry the order number, price and currency. The designs themselves are never sent. | Your consent, and nothing happens before you give it | As set in Google Analytics, 14 months by default |
| Address suggestions | While you type a street name in the checkout, what you have typed so far is sent from our server to a mapping service so it can offer the postcode and city. Your browser never contacts them directly, and answers are cached for an hour so the same street costs one lookup rather than ten. | Necessary to take an order accurately | Cached on our server for one hour |
| Your order | Name, email, telephone if you give one, delivery address, the note you write, and which of email, Telegram or WhatsApp you asked to be contacted on. Alongside it: the design, a picture of it, the price and how it was worked out. An order placed on the tablet at an exhibition asks for less — your name and one way to reach you, and no address at all, because nothing is posted from there and the rest is arranged in the reply. Nothing is paid on that tablet either. | Necessary to perform the contract you entered into | Kept as a business record — see below |
| Emails about your order | Your email address is used to write to you about the order you placed: a confirmation when you place it, and a note when I confirm it, when it goes in the post, and if it is ever cancelled. That is the whole list — there is no newsletter, no marketing, and nothing is sent about anybody else's order. Once an account is deleted the order keeps no address, so nothing can be sent about it at all. | Necessary to perform the contract you entered into | The messages sit with your email provider; the address is kept with the order |
| Payment | If card payment is switched on, you are sent to Stripe's own page. Card numbers never touch this server and are never seen by it. We send Stripe the order number, the amount, a description of the item and your email address; we keep back the payment reference, the amount paid and when. | Necessary to perform the contract | With the order |
| Your account | If you sign in, Google tells us your account identifier, email address and display name. That is all we ask for and all we keep — no picture, no contacts, no access to anything else in your Google account. Your saved designs and the list of your orders hang off it. | Your consent, given by choosing to sign in | Until you delete the account |
| Sign-in cookies | One cookie keeps you signed in for thirty days. A second exists for ten minutes during sign-in to prove the request came from this site. The first holds your account identifier, email and display name, signed so it cannot be altered — but signed is not encrypted, so treat it as readable by anyone with your device. | Strictly necessary for a service you asked for | 30 days, and 10 minutes |
| Designs you share | Pressing Share publishes the picture and the design at a web address anybody holding the link can open. If you are signed in and leave the box ticked, your display name is printed on that page. Nothing is published until you press it. | Your consent, given by pressing Share | Up to a year |
| Server logs | Every request to the site is logged by the web server with the address it came from, the time, what was asked for, whether it worked, and which browser asked. This is how the site is kept running and abuse is spotted. | Our legitimate interest in a working, unabused site | 90 days |
Who else sees it
| Who | What they get | Where |
|---|---|---|
| Sign-in, if you use it. Analytics, if you allow it. | Ireland and the United States | |
| Telegram | Every order, in full — including your name, address and contact details — is sent to the artist as a message. | United Arab Emirates and elsewhere |
| Komoot (Photon) | The part of a street name you have typed, while you type it, for address suggestions. | Germany |
| The email relay | Whatever is in the messages above — your address, your order number and what you bought — passes through the mail server the studio is configured to send through. With none configured no email is sent and nothing passes anywhere. | Wherever that provider runs |
| Stripe | Your email address and the amount, if card payment is switched on and you pay by card. | Ireland and the United States |
| Amazon | Nothing. The book links in About carry a referral tag, and Amazon sees you only if you choose to click one. | — |
Nothing is sold, and nothing is shared for advertising.
How long things are kept
Order and transaction records are retained for the period required by applicable Spanish tax and accounting law. Deleting your account does not delete your orders — it replaces your name, email, telephone and address with "[erased]" and leaves the sale, the price and the date behind. That is the honest position and it is stated here rather than discovered later.
Designs you shared are taken down with your account. A share is a publication, and deleting your account withdraws it: every page you published is removed, along with its picture and the name printed on it. Any link you posted elsewhere will stop working. Left alone, a share expires on its own about a year after you made it.
Everything else goes when you ask. Your profile, saved designs, their pictures and your saved address are removed immediately and permanently.
Your rights
You can ask for a copy of what is held about you, ask for it to be corrected or erased, object to it being used, and complain to a data protection authority. Two of those are buttons rather than requests:
- A copy of everything — sign in, open Profile & privacy, press Download my data. It arrives immediately, as one JSON file.
- Erasure — the same panel, Delete my account. It happens at once, subject to the order records described above.
Anything else, including a request about an order placed without an account, goes to the address above.
Changing your mind about analytics
Refusing is one click, refusing is remembered, and you can change your answer at any time — open About in the toolbar and look under Privacy. The same banner comes back and your new answer replaces the old one. You do not need an account, and you do not have to ask anyone.
Withdrawing stops the counting from that moment and deletes the analytics cookies already in your browser. It cannot reach back: visits that were already counted while consent stood remain in Google's records until they expire on their own schedule, which is the fourteen months listed above.
Where your data goes
The site runs on a small computer in the owner's home, not on rented cloud infrastructure, so orders and accounts sit on a disk there. The services listed above are the only third parties involved, and several of them are outside the European Economic Area — Google and Stripe both operate transfer arrangements for this. Telegram receives order details because that is how the artist is told an order exists.
Complaints
If you think this site has handled your data badly, please write first — it is likelier to be a mistake than a policy. You also have the right to complain to your national data protection authority, wherever in the EU or UK you live.