Privacy Policy

• We collect what we need to make and deliver your order, and not much else.
• Your photographs are stored in a private bucket. There is no public link to them. Even we open them through a time-limited signed URL.
• We do not sell your personal information, and we never sell or license your photographs.
• We do not use your photographs to advertise, to illustrate the site, or to train anything.
• You can ask for a copy of your data, or ask us to delete it, at any time.

Canvas4Seasons LLC operates this website and is the controller of the personal information described here. You can reach us about anything on this page at support@canvas4seasons.com.

This is the part most people want to know about, so here it is in detail.

• Where they go. Your file uploads straight from your browser to private object storage. It does not sit on our web server, and it is never written into our database.
• Who can open them. The storage bucket has no public access. Every view — ours or yours — goes through a signed link that expires: thirty minutes for the thumbnail you see in your account, seven days for the production link in an order email.
• What we do with them. Check them for print quality, prepare them for production, and print them. That is the entire list.
• Who else sees them. Only the people who make your order. Where a production partner is involved, they receive the file for that order and nothing else, and are not permitted to keep or reuse it.
• How long we keep them. For as long as your order might need remaking or reprinting — we work to 24 months — after which they are deleted. You can ask us to delete yours sooner and we will, though we cannot reprint an order afterwards.

• To make, pack and deliver what you ordered.
• To send transactional email — order confirmation, a question about your photo, tracking.
• To let you sign in, see your orders and track them.
• To answer you when you write to us.
• To detect and prevent fraud and abuse, and to keep the site up.
• To meet our tax and accounting obligations.
• To send occasional marketing email — only if you ticked the newsletter box. Every one of those has an unsubscribe link that works.

We do not use your information to build advertising profiles, and we do not run automated decision-making that produces legal or similarly significant effects on you.

For customers in the UK, EU and other regions where this applies:

• Performance of a contract — everything needed to fulfil an order you placed.
• Legitimate interests — keeping the site secure, preventing fraud, and improving what we offer, balanced against your rights.
• Consent — marketing email, which you can withdraw at any time without affecting your order.
• Legal obligation — keeping transaction records for the period the law requires.

We do not sell personal information, and we have not in the preceding twelve months. We share it only with the service providers that make the shop work, each under contract and only for the purpose named:

We may also disclose information where we are legally required to, or to establish or defend a legal claim. If the business is ever sold, customer records may transfer to the buyer, who would be bound by this policy.

Wherever you live, you can ask us to do all of the following, and we will — free, and within 30 days:

• Get a copy of the personal information we hold about you.
• Correct anything that is wrong. Your name, phone and addresses you can also edit yourself in your account.
• Delete your account and your photographs. We may have to keep order records where the law requires it.
• Object to or restrict how we use your information.
• Take your data elsewhere, in a portable format.
• Withdraw consent to marketing at any time.

Write to support@canvas4seasons.com from the address on the account. If you are in the UK or EU and unhappy with our answer, you can complain to your national data protection authority. If you are in California, we do not sell or share personal information as those terms are defined there, and you will never be treated differently for exercising a right.

We keep this minimal. The site uses:

• A session cookie, so that signing in keeps you signed in. Without it, accounts cannot work.
• Local storage in your browser for your cart, so it survives a refresh. It stays on your device and is not sent to us until you check out.

Both are strictly necessary for the shop to function. You can clear them at any time in your browser settings, which will sign you out and empty your cart.

The whole site is served over HTTPS. Passwords are not stored at all — signing in uses a one-time code sent to your email. Access to customer records is restricted at the database level, so a fault in the website cannot show one customer another customer's order. Photographs sit in a private bucket reachable only through expiring signed links.

No system is perfectly secure. If a breach ever affects your personal information, we will tell you and the relevant authority within the time the law requires.

This shop is not for children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, write to us and we will delete it. Photographs of children uploaded by their parent or guardian are, of course, welcome — they are most of what we print.

We operate from the United States, and our providers may process data there and in other countries. Where information is transferred out of the UK or the European Economic Area, it is done under approved safeguards such as the Standard Contractual Clauses.

If we change how we handle your information we will update this page and change the date at the top. Where a change is significant, we will tell customers by email rather than expecting anyone to check back.