Privacy Policy

• How you use our pages. Which pages you visit and which steps you take, for example the painting and size you pick and whether you press "See my puzzle". We tie these to a random visit ID kept in your browser for that visit, plus the ad campaign or site that brought you. We don't store your IP address or device details with this.
• Your email, if you leave it. With it we keep the product and design you chose and the campaign or site that brought you.
• Order details, when you order. Your name, email, shipping address, the photo you upload, your design choices and any message you write. Card payments are handled by our payment processor; we never see or store your full card number.
• Cookies and similar technologies. Our pages use your browser's storage for the visit ID and your privacy choices and, if you ask for a free design, a random device ID that limits free designs to one per person. If you haven't opted out, the Meta Pixel also sets cookies, only for visitors in the United States (see "Do Not Sell or Share" below).

When you try a design on our site, your photo stays on your device. To get your free design, we email you a one-time code to confirm your address. Your photo is uploaded only after you confirm your email and ask for your free design. An AI image service processes it to paint your artwork. We keep it only so you can ask for new versions: it is deleted from our systems when you approve a design, if your order is refunded, or after 7 days if you don't order. Your browser also keeps a copy on your device; clearing your browser's site data removes it.

If you don't order, the unpaid preview, your email and the scrambled device and network keys we use to give one free design per person are deleted after 7 days. We email you about your design (when it's ready, and one reminder a day later, with a small discount), and every one of those emails has an unsubscribe link. Cloudflare Turnstile checks that you're not a bot when you ask for a code. The confirmation code expires after 10 minutes and is kept only in scrambled form, then deleted within a day.

If you order without a free design, your photo is uploaded when you place your order and used only to make your designs: an AI image service processes it to paint your artwork, and we delete it from our systems when you approve a design or your order is refunded. If you don't finish your order, your photo is deleted within 48 hours.

If your order is refunded, your designs are deleted 7 days later. Once you approve a design, the other versions are deleted, and the approved design and its print file are kept for 1 year after your puzzle ships, so we can reprint it if needed. We never use your photos or designs in our marketing or to train AI.

Please only upload photos you have the right to use. If other people are in the photo, make sure they're happy for you to use it, and for children, that you're their parent or guardian or have their permission.

• To run our site, and to make, ship and support your order.
• To email you about your order, or the offer you signed up for.
• To understand which pages, designs and ads work, so we can improve them.
• To measure and improve our ads on Meta (Facebook and Instagram), unless you opt out.
• To prevent fraud and meet legal obligations.

We share data only with companies that help us run Foleina, and only what each needs:

• Hosting and our database (Fly.io), and security and file storage (Cloudflare), which store and serve our site and data.
• Our previous database provider (Supabase) keeps a copy of older data until we delete it.
• Our payment processor (Stripe), for payments and refunds.
• Our printing and shipping partner, which receives your name, shipping address and print file.
• An AI image service, which receives your photo to create your design.
• An email service, to send you emails.
• Meta, through the Meta Pixel and, when you buy, its Conversions API, to measure our ads (see below).

We don't sell your personal information for money. We may also disclose data if the law requires it.

We use the Meta Pixel to see which of our ads lead people to sign up or press "See my puzzle", and to show our ads to people likely to be interested. We load it only for visitors in the United States. It tells Meta about these steps and the price shown (never your email or photo), and Meta may connect this with what it already knows about you. Under California law, this counts as "sharing" your personal information for advertising.

When you buy, our server also tells Meta about the purchase, because payment happens on our payment processor's page where the pixel can't see it. We send the amount you paid, the product you chose, the pixel's cookie IDs, your browser type, and your email in a scrambled (hashed) form that lets Meta match the purchase to the ad you saw. We never send your photo, your design, your message or your address. We do this only for visitors in the United States who haven't opted out.

When you ask for your free design ("See my puzzle"), our server tells Meta about it as a "Lead" event; the "Purchase" event described above is sent only when you pay. It follows the same rules: only for visitors in the United States who haven't opted out, with your email in scrambled (hashed) form and never your photo or design.

You can opt out at any time. We then won't load the Meta Pixel in this browser, or tell Meta about purchases made from it. We also treat a Global Privacy Control signal from your browser as an opt-out, automatically. Your choice applies to the browser you're using, so repeat it on other devices.

If you live in California, you have the right to:

• Know what personal information we have about you, and get a copy.
• Ask us to delete it, or correct it if it's wrong.
• Opt out of us selling or sharing it (see above).
• Not be treated differently for using these rights.

To make a request, email [email protected]. We'll confirm it's you by replying to the email address we have, and respond within 45 days. You can also have an authorized agent make a request for you. We don't use sensitive personal information for anything beyond making your order.

Wherever you live, you can ask us to delete your data the same way.

UK and EU data protection law (the UK GDPR and EU GDPR) gives you further rights. We don't load the Meta Pixel or any other advertising cookies for visitors outside the United States. Our lawful bases for using your information are:

• Performing our contract with you: making, shipping and supporting your order.
• Our legitimate interests: running, securing and improving our site, understanding which pages and ads work, and preventing fraud.
• Your consent: the emails you sign up for. You can withdraw it at any time.
• Legal obligations: for example, keeping tax and accounting records.

Some of the companies we work with process data in the United States and other countries outside the UK. When they do, we rely on safeguards the law recognizes, such as the UK's International Data Transfer Addendum or standard contractual clauses, or the UK Extension to the EU-US Data Privacy Framework.

You have the right to access your information, correct it, delete it, restrict or object to how we use it, and receive it in a portable format (data portability). To use these rights, email [email protected]. You can also complain to the UK Information Commissioner's Office at ico.org.uk, or your local data protection authority.

We may offer a discount, such as 20% off your first order, when you leave your email. In return we keep your email and the design you chose, as described above. We estimate the value of this information to us as roughly the value of the discount, based on what we expect to spend on reaching new customers. Leaving your email is optional. You can withdraw at any time by emailing [email protected]; we'll delete your email and the offer will no longer apply.

• Photos: until you approve a design or your order is refunded; for a free design you don't order, 7 days.
• Unpaid previews, with their email and scrambled device and network keys: 7 days.
• Photos from an order you don't finish: 48 hours.
• Designs: 7 days after a refund; the approved design 1 year after your puzzle ships.
• Emails: if you order or sign up, until you unsubscribe or ask us to delete them (the email of an unpaid preview goes after 7 days, as above).
• Order records: as long as tax and accounting laws require.
• Anonymous page activity: up to 2 years.

Our site is meant for adults. We don't knowingly collect personal information from children under 13. Photos of children should only come from their parent or guardian, or with their permission.

We use encrypted connections and limit who can access your data. No system is perfectly secure, but we work to protect your information.

If we change this policy, we'll update the date above. Questions? Email [email protected].