The short version: we collect what is needed to sell you something and send it to you. We run no advertising trackers, we sell nothing about you, and we use your drawings only to cut your drawings.
Who is responsible
awlry is the data controller for this site. For any question, request or complaint about your data, email zoie9402@gmail.com. One address, and a person reads it.
What we collect, and why
Eight situations produce data on this site. Each one produces only what it needs.
| What you do | What we collect | Why we need it |
|---|---|---|
| Browse the site | IP address, browser and device type, the pages you asked for, the time | Ordinary server logs, kept to keep the site up, spot abuse and fix errors |
| Add something to the cart | WooCommerce cookies (listed below) | To remember what is in the cart. Nothing else |
| Create an account | Email address, and a password stored only as a hash (a name, if you add one later) | So you can see your orders and proofs, and reorder |
| Place an order | Name, email, billing and shipping address, phone if you give one, the items ordered, any note you add | To take payment, cut the part, print the label and send the confirmation |
| Pay | A PayPal transaction reference and whether it succeeded | To confirm payment. We never receive your card number |
| Upload a drawing in the custom builder | The file, its filename, and the measurements we compute from it | To quote it and cut it |
| Email us, or send the contact form | Your name, your email address and whatever you write, plus any drawing you attach (PDF, AI, SVG, DXF, PNG, JPG or ZIP, up to 10 MB). The contact form stores the message and the file in our own database and on this server, and emails us a copy of both | To answer you — and, when you send a drawing, to read the outline off it and quote you from that |
| Join the mailing list | Your email address, the date, and a salted hash of your IP address | To send the emails you asked for. The hash exists only to block abuse and cannot be turned back into your address |
What we do not do
- No analytics. There is no Google Analytics, no Matomo, no Plausible and no session recording on this site.
- No advertising or retargeting pixels. No Meta, TikTok, Pinterest or Google Ads pixel.
- No third-party fonts or CDNs. Our fonts, icons and scripts are served from our own server, so simply reading a page sends your IP to nobody but us.
- We do not sell, rent or trade personal data, and we do not build advertising profiles.
- We do not train anything on your drawings.
Your account
An account is optional. You can order without one, and nothing is created unless you fill in the form on the register page.
- What it holds: your email address, a password, and anything you add later — a name, a delivery address, your order history, and the proofs we sent you.
- Your password is stored as a hash, not as text. WordPress hashes it one way, so nobody here can read it back. If it is lost we can only send you a reset link.
- Creating an account subscribes you to nothing. It is not the mailing list and it is not consent to marketing email. If you want the emails, join the list separately.
- You can close the account whenever you like. Ask us and we will delete the account and the drawings attached to it. The order records themselves are kept for the period in the table above, because tax and accounting rules require it — the account goes, the invoices stay.
- The two records are independent. Closing your account does not remove you from the mailing list, and unsubscribing does not close your account.
A drawing you attach to the contact form
If you send us a drawing through the contact form, this is what happens to it. It is stored on this server, outside anything the web can read: the web server refuses the whole directory it lives in, the file is given a random name, and only the person who answers your message can open it from the admin list. It is not published, not measured automatically, not added to any library, and not used to train anything. We read the outline off it by hand to quote you.
The same drawing also travels to us as an email attachment. Ask us to delete the message and both copies go — the stored file and the record. Files over 10 MB are refused by the form; send a link instead and we will fetch it.
The mailing list
If you sign up from the home page, this is what happens.
- Nothing is sent until you confirm. We email you once with a link. Click it and you are on the list; ignore it and you never hear from us again, and the address is not added.
- The list lives in our own database on the same server as the shop. It is not exported to a third-party mailing platform, and no marketing processor receives it.
- Every email carries a one-click unsubscribe link. No login, no “manage preferences” maze.
- Unsubscribing keeps one record: that this address asked not to be contacted. Deleting the row entirely would mean we could not remember to leave you alone. Ask us and we will delete it anyway.
- Joining the list gives you no account. It is not a shop login, it grants no access to anything on this site, and it is stored separately from customer accounts. The two are never merged.
- Your address is used for one thing: sending you the emails you signed up for. It is not sold, shared, profiled or used for anything else.
Cookies
Every cookie on this site is functional. None of them tracks you across other websites, and there is no advertising cookie to consent to. These are the ones that actually get set:
| Cookie | Set when | What it is for | Lasts |
|---|---|---|---|
wordpress_test_cookie | Any visit | Checks that your browser accepts cookies at all | Until you close the browser |
woocommerce_cart_hash | You use the cart | Knows when the cart’s contents have changed | Until you close the browser |
woocommerce_items_in_cart | You use the cart | Knows whether the cart is empty | Until you close the browser |
wp_woocommerce_session_… | You use the cart | Links your cart to your session, so it survives a page change | Until you close the browser |
wordpress_… / wordpress_logged_in_… | You sign in | Keeps you signed in | Until you sign out |
wp-settings-time-… | You sign in | Remembers your admin display preferences | One year |
One more thing belongs here honestly: when you open the cart or the checkout with PayPal as the payment method, PayPal loads its own script and sets its own cookies to run the payment. Those are PayPal’s cookies, governed by PayPal’s privacy policy, and they appear only on those pages.
Who else sees your data
- PayPal — to take the payment.
- The carrier delivering your parcel — your name, address and phone number appear on the label.
- Our email provider — your messages and order confirmations pass through it.
- Our hosting provider — the server that stores the site and its database.
That is the whole list. We do not share data with anyone else except where the law requires it.
Where your data is held
Our server is in mainland China, and the workshop that makes your order is there too. PayPal and our email provider are in the United States. So if you are in Europe or the UK, ordering does mean your data leaves your country. We rely on the standard contractual safeguards those providers publish, and we keep the data to the minimum the order needs.
How long we keep it
| What | How long |
|---|---|
| Server logs | About 30 days, then rotated away |
| Cart sessions and cookies | Until you close the browser |
| Order records | Three years after the order, for accounting and warranty |
| Account details | Until you ask us to delete the account |
| Uploaded drawings | Until you delete them, or ask us to |
| Messages you send us, by email or the contact form | Until the question is settled, then deleted on request |
| A drawing attached to the contact form | Same as the message it came with. Asking us to erase it deletes the file from disk as well as the record |
| Mailing list subscription | Until you unsubscribe, or until you ask us to delete it |
Your rights
Whichever country you are in, we will honour these: to see the data we hold about you, to have it corrected, to have it deleted, to receive a portable copy, to restrict or object to how we use it, and to withdraw consent where consent was the basis. Email us and we will answer within 30 days.
If you are in the EU or UK, you also have the right to complain to your national data protection authority, and you can ask us to stop using your data for anything beyond fulfilling your order.
If you are in California, you have the right to know what we collect, to have it deleted or corrected, and not to be discriminated against for asking. We do not sell or share personal information as the CCPA defines those terms, so there is nothing to opt out of.
Deleting your data and keeping our accounts straight can conflict: we may have to keep an invoice record even after deleting everything else. If that applies, we will tell you what we kept and why.
Security
Card data never reaches our server, because PayPal collects it. Access to order data is limited to the people who need it to cut and ship your order. We keep the software patched and we do not keep data we do not need.
No system is perfect. If there were ever a breach affecting your data, we would tell you and the relevant authority without delay.
Children
This shop is not aimed at children and we do not knowingly collect data from anyone under 16. If you believe a child has given us data, email us and we will delete it.
Changes to this policy
The mailing list described above is covered by this policy. If we add anything else that changes how we handle data — analytics, for example — we will update this page before it goes live, not after.
Contact
Email zoie9402@gmail.com. Put “privacy” in the subject and it goes to the front of the queue.