Privacy Policy

Effective date: February 2025

Welcome to Glintwall ("we", "us", or "our"). We respect your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, and safeguard your information when you use our website and services.

1. Data Controller

Glintwall is the data controller responsible for your personal data. If you have questions about this policy or our data practices, please contact us at contact@glintwall.com.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

Email address
Encrypted password (we never store plaintext passwords)

2.2 Payment Information

When you purchase wallpapers, we collect:

Transaction details (order ID, amount, date)
Payment method information (processed securely by Stripe — we do not store your card details)

2.3 Order and Download Information

We track:

Wallpapers you've purchased
Download history and timestamps
IP address at time of download (for security and fraud prevention)

2.4 Cookies and Technical Data

We use cookies and similar technologies to collect:

Session cookies (to maintain your cart and login state)
Browser type and version
Device information
IP address (for security and checkout processing)
Pages visited and time spent on site

3. How We Use Your Information

We use your data for the following purposes:

Contract performance: To process your orders, deliver digital wallpapers, and provide customer support
Account management: To maintain your account and provide access to your purchases
Security: To detect and prevent fraud, abuse, and unauthorized access
Legal compliance: To comply with tax, accounting, and legal obligations
Service improvement: To understand how users interact with our site and improve our services

4. Legal Basis for Processing (GDPR)

Under the UK GDPR and EU GDPR, we process your personal data based on:

Contract performance: Processing necessary to fulfill your purchase orders
Legitimate interests: Security, fraud prevention, and service improvement (your rights do not override these interests)
Legal obligations: Tax and accounting requirements
Consent: For non-essential cookies (where required)

5. Third-Party Processors

We work with the following trusted service providers to deliver our services:

5.1 Supabase

Database, authentication, and file storage services. Supabase processes data in accordance with their privacy policy and provides data processing agreements. Data may be stored in the EU or US.

5.2 Stripe

Payment processing. Stripe is PCI DSS Level 1 certified and does not share your payment data with us. You can review Stripe's privacy policy at stripe.com/privacy.

5.3 Resend

Email delivery service for order confirmations and account notifications. Resend processes data in accordance with their privacy policy.

5.4 Hostinger

Website hosting services. Hostinger processes data in accordance with their privacy policy.

6. International Data Transfers

Some of our service providers are located outside the UK/EU, including in the United States. When we transfer data internationally, we ensure appropriate safeguards are in place, such as:

Standard Contractual Clauses (SCCs) approved by the European Commission
Data Processing Agreements with processors who provide adequate protection
Reliance on adequacy decisions where applicable

7. Your Rights

Under data protection laws, you have the following rights:

7.1 Right of Access

You can request a copy of the personal data we hold about you.

7.2 Right to Rectification

You can request correction of inaccurate or incomplete personal data.

7.3 Right to Erasure ("Right to be Forgotten")

You can request deletion of your personal data. Note: We may retain certain data for legal, tax, or accounting purposes.

7.4 Right to Data Portability

You can request your personal data in a structured, machine-readable format.

7.5 Right to Restrict Processing

You can request that we limit how we use your data in certain circumstances.

7.6 Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes.

7.7 How to Exercise Your Rights

To exercise any of these rights, please email us at contact@glintwall.com. We will respond within 30 days. There is no fee to exercise these rights unless your request is manifestly unfounded or excessive.

8. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes outlined in this policy:

Account data: Retained while your account is active
Order records: Retained for 7 years (UK tax and accounting requirements)
Payment records: Retained for 7 years (legal and fraud prevention purposes)
Server logs: Retained for 90 days (security and troubleshooting)

After these periods, data is securely deleted or anonymized.

9. Cookies

We use cookies to provide our services. Essential cookies (session cookies for cart and login) are necessary for the site to function. We may use non-essential cookies (e.g., analytics) with your consent.

For more information, see our Cookie Policy.

10. Security

We implement appropriate technical and organizational measures to protect your data, including:

Encryption in transit (HTTPS/TLS)
Encrypted password storage (bcrypt hashing)
Row-Level Security in our database
Signed URLs for secure file downloads
Limited access to personal data on a need-to-know basis

11. Children's Privacy

Our services are not intended for children under 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

12. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated via email or prominent notice on our website at least 14 days before taking effect. Continued use of our services after changes take effect constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this privacy policy or our data practices, please contact us:

Email: contact@glintwall.com
Website: glintwall.com

14. Supervisory Authority

If you are not satisfied with our response to your data protection concerns, you have the right to lodge a complaint with the relevant supervisory authority:

UK: Information Commissioner's Office (ICO) — ico.org.uk
EU: Your local data protection authority