Privacy Policy

1. Who is responsible for your data

The data controller is e-buy.pro LLC, a limited liability company formed in the State of Delaware, United States of America, trading as Terracottanoon and operating terracottanoon.com.

For anything in this policy, including a request to exercise your rights, contact legal@terracottanoon.com.

2. What we collect

When you place an order

• Your name, email address and delivery address
• A phone number, where you give one — carriers ask for it on some international routes
• Any delivery note you add
• What you ordered: design, size, finish, quantity and the price at the time
• Confirmation from our payment processor that payment succeeded, together with the card type and its last four digits

When you create an account

• Your name and email address
• A password, which is stored only as a cryptographic hash and cannot be read back by us or anybody else
• Any delivery address you save for next time
• Your order history

When you contact us, subscribe or leave a review

• Your name, email address and whatever you write to us
• Your email address, if you ask for our newsletter
• A review you submit, and the name you choose to publish it under

Automatically, when you browse

• Standard server log data: IP address, the pages requested, the date and time, your browser and operating system, and the page that referred you. These logs are used to run and secure the site and to diagnose faults.

We do not collect special category data, we do not ask for your date of birth or any government identifier, and we do not build marketing profiles or infer anything about you from your browsing.

3. If you have bought from us on Etsy

We also sell on Etsy, and we hold records of orders placed with us there: the buyer’s name and address, the items, and the order dates. That data came to us through Etsy as part of fulfilling those orders, and we retain it as our sales records.

When you create an account on this website, we check whether your email address matches one of those past orders and note on your account that you have bought from us before, so that we can recognise a returning customer. It is a single yes-or-no marker. It does not import your Etsy order history into this site, it is not used to advertise to you, and it is not shared with anyone. We do this on the basis of our legitimate interest in recognising our own customers, and you can ask us to remove the marker.

4. Why we use it, and our legal basis

Where the EU or UK General Data Protection Regulation applies, we rely on the following bases.

Performing our contract with you

Taking and confirming your order, taking payment, having it printed and delivered, telling you when it ships, handling a fault or a refund, and running your account.

Complying with a legal obligation

Keeping transaction and accounting records, and responding to lawful requests from authorities.

Our legitimate interests

Preventing fraud and abuse, keeping the site secure, keeping our own business records, understanding which designs sell, recognising a returning customer, protecting our artwork against infringement, and defending legal claims. We balance these against your interests and use the least intrusive means that works.

Your consent

Sending you marketing email, where you have asked for it. You can withdraw consent at any time, and withdrawing it does not affect anything done beforehand.

We do not make decisions about you by automated means that produce a legal or similarly significant effect.

5. Cookies and similar technologies

We use two measurement tools — Google Analytics 4 and a Pinterest conversion tag — and this section says exactly what each one does, when it loads, and when it does not.

The strictly necessary cookies, set whatever you choose:

Our session cookie

Set only on pages that need it — your basket, signing in, checkout — so that your basket survives between pages, you stay signed in, and forms are protected against cross-site request forgery. It expires when you close your browser.

Stripe

Stripe sets its own cookies on the checkout page to process the payment and to detect fraud. They are necessary for a payment to be taken and are governed by Stripe’s privacy policy.

And the one that is not necessary:

Google Analytics (_ga, _ga_…)

Measures which pages and designs are looked at, so we know what to make more of. It is not needed to browse or to buy.

Pinterest tag (_pinterest_ct_ua and similar)

Tells us whether an advert on Pinterest led to a sale, so we are not paying to advertise designs nobody buys. It records the pages you look at on this site, what you add to the basket and the value of a completed order. It also uses Pinterest’s “enhanced match”, which takes the email address you type at checkout, scrambles it and sends only the scrambled form — enough for Pinterest to recognise one of its own users, not enough to read your address. The scrambling happens both in your browser and, once an order is paid, on our own server, so that a sale still counts when a browser blocks the first route or the page is closed early. It is how a sale on a laptop gets matched to the pin you saw on your phone. We send no name, no delivery address and no payment details, and declining stops all of it.

Whether we ask you first depends on where you are, and we would rather say so plainly than imply everyone is asked.

United Kingdom, European Union, EEA and Switzerland

Nothing is loaded until you allow it. You are shown a choice with Decline and Allow given equal weight, and if you decline — or simply ignore it — no analytics or advertising code is ever requested. Any visitor we cannot place is treated as being here, so you may see the choice even if you are not.

Everywhere else, including the United States

Analytics loads without an interstitial, which the law where you are permits on the basis that you may opt out rather than having to opt in. Choosing Cookie Choices in the footer and declining stops it immediately, and that choice is remembered in your browser.

We also use Google’s Consent Mode, so your choice is passed on to Google rather than only acted on by us.

We also load an icon font from a third-party content delivery network. It sets no cookies, but the request necessarily reveals your IP address to that provider, as any request for an external file does.

6. Who we share it with

We do not sell your personal information. We disclose it to the service providers who make the shop work, each acting on our instructions and only for the purpose shown — and, as the last entry sets out, we share a hashed email address with Pinterest to measure our own advertising:

Stripe

Payment processing and fraud prevention. Receives your payment details directly, plus your email address and billing information.

Printify, and the print partners it routes to

Printing and dispatching your order. Receives your name, delivery address, phone number where given, and the items ordered — not your email address or payment details.

Delivery carriers

Appointed by the print partner to deliver your parcel. Receive your name, address and, for some routes, a phone number or email for delivery notifications.

Brevo

Sends our order confirmations, delivery notifications and, where you have asked for it, our newsletter. Receives your email address and the content of the message.

Pinterest

Measures whether an advert of ours on Pinterest led to a sale. Receives the pages you look at here, what you add to the basket, the value of a completed order — which our server reports directly once an order is paid, so that a sale is not missed when a browser blocks it — and a hashed form of your email address — scrambled in your browser before it is sent, so Pinterest can match it against an account it already has but cannot read the address itself. It receives no name, no delivery address and no payment details. It receives nothing at all if you decline, and in the UK, EU, EEA and Switzerland nothing is sent unless you allow it first.

Our hosting and infrastructure

The site runs on a dedicated server we control. Data stays within our own database, which is not reachable from the public internet.

We may also disclose personal data where we are legally required to, to establish or defend legal claims, to prevent fraud, or to a buyer or successor if the business is sold — in which case this policy continues to apply until you are told otherwise.

7. International transfers

We are established in the United States, so personal data you give us is processed there. Our print partners operate production facilities in several countries, including within the European Union and the United Kingdom, and an order is routed to one able to serve your address — so a European order is often printed and posted within Europe.

Where personal data is transferred out of the European Economic Area or the United Kingdom, we rely on appropriate safeguards for that transfer, including the European Commission’s Standard Contractual Clauses and the UK Addendum to them, together with the transfer mechanisms our processors maintain for their own services. You may request details of the safeguards that apply by writing to legal@terracottanoon.com.

8. How long we keep it

Order and transaction records

Seven years from the date of the order, to meet accounting and tax record-keeping obligations and to deal with any later dispute or chargeback.

Your account

For as long as the account is open. If you close it or ask us to delete it, we remove your account details, while keeping the minimum order record described above.

Newsletter subscription

Until you unsubscribe, after which we keep a record that you opted out so that we do not email you again by mistake.

Messages you send us

Normally up to three years, so that we have the history if you come back about the same order.

Server logs

A short period, for security and fault diagnosis.

9. Your rights in the EEA and the UK

If you are in the European Economic Area or the United Kingdom, you have the right to:

• Access — be told whether we hold data about you and receive a copy
• Rectification — have inaccurate data corrected and incomplete data completed
• Erasure — have your data deleted, where we have no overriding obligation to keep it
• Restriction — have us pause processing while a dispute about accuracy or legitimate interests is resolved
• Portability — receive the data you gave us in a structured, machine-readable format, or have it sent to another controller
• Object — object to processing based on our legitimate interests, and to direct marketing at any time, which we will always honour
• Withdraw consent — at any time, where we relied on it

Write to legal@terracottanoon.com. We respond within one month, and will tell you if we need longer because a request is complex. There is no charge unless a request is manifestly unfounded or excessive. We may need to verify your identity first, which usually means confirming you control the email address on the account or order.

You also have the right to complain to your data protection authority. In the UK that is the Information Commissioner’s Office; in the EEA it is the supervisory authority of the country where you live or work. We would much rather you came to us first so we can put it right.

10. Your rights in California and other US states

If you live in California, or in another US state with comparable privacy legislation, you have the right to know what personal information we collect and why, to request a copy, to request correction, and to request deletion, without being discriminated against for exercising any of them.

To make a request, write to legal@terracottanoon.com. You may use an authorised agent, in which case we will ask for proof of their authority.

11. Marketing

We send order confirmations, delivery notifications and replies to your questions because they are necessary to your order. These are service messages and are not marketing; you cannot unsubscribe from them while an order is live.

We send marketing email only where you have asked for it. Every marketing message carries a one-click unsubscribe link, which takes effect immediately, and you can also ask us at legal@terracottanoon.com.

12. Security

The whole site is served over HTTPS. Card details go directly to our payment processor and never reach our servers. Passwords are stored only as salted hashes. Our database is not reachable from the public internet and accepts connections only from the server itself. Administrative access is restricted and authenticated, and backups are taken automatically and held outside the public web root.

No system is perfectly secure, and we cannot guarantee the security of data in transit across the internet. If a breach ever affects your personal data and the law requires it, we will notify you and the relevant authority without undue delay.

13. Children

This site is not directed at children, and we do not knowingly collect personal data from anyone under 16, or under 13 in the United States. If you believe a child has given us personal data, write to legal@terracottanoon.com and we will delete it.

14. Changes to this policy

We may update this policy. The version in force is the one published here, with its effective date at the top. Where a change materially affects how we use data we already hold, we will tell affected customers by email rather than relying on this page alone.