Our privacy policy

Data controller

Miron Digital (trading as Studio Miron)

Address

Deken Darraslaan 5 bus 101, 8700 Tielt, Belgium

Company number

0793239175

VAT number

BE0793239175

Email

hello@studiomiron.com

Phone

+32 (0)51 58 40 52

We are based in Belgium and work from our own studio there. We deliver throughout the European Union, the United Kingdom, the United States and Canada. What you order is designed, printed and packed by us, so your details do not go to an external print shop.

• Order details: your name, email address, billing and shipping address, phone number if you provide it, order number, chosen products, version and quantities.
• Customer account: your sign-in status and the profile, contact and address details you view or save in your account. Your account lives in the same secured store environment as your orders; our site itself only stores the strictly necessary cookies that keep you signed in.
• Personalization details: the text you have printed on a card, game, invitation, poster or sign. Usually that is a name, a date or a short sentence. If you choose the personalized version, that text travels with your order exactly as you typed it. A note you add to your order is also stored with that order. Only enter details you want processed on the product and in your order.
• Payment details: we see whether a payment succeeded and with which method. Your full card or account details never reach us. The payment provider processes those.
• Communication: your name, email address and whatever you email us or send through the contact or withdrawal form, including order number and return details when they are needed.
• Newsletter details: your email address, confirmation status and unsubscribe status.
• Technical data: IP address, time, browser and request data and limited server logs for security and troubleshooting. Your cart uses two necessary cookies and temporary session storage to restore focus. We also store in your browser your cookie choice and a list of the products you recently viewed; that list stays in your browser for at most 30 days and is not sent to us. If our server cannot confirm your choice at that moment, we remember that within this browser tab so your choice is not sent to us again on every page view; that flag is functional and not strictly necessary. If you dismiss the mix and match bar at the bottom of the screen, we remember within this browser tab that it should stay closed; that flag is strictly necessary for the dismissal you requested. See our Cookie Policy.
• Statistics data: page and product views totalled per hour, language, market and device category, plus store steps such as searching, adding to or removing from the cart and starting checkout. For an add we also count the product, Shopify variant and quantity. This statistic stores no raw events, IP address, search text, cookie, or visitor, session, cart or order ID. The measurement places nothing on your device and cannot be traced back to your name, account or order.
• Advertising data, only with your separate consent: Google would then link your visit and a few store steps to the ad that brought you to us, with its own cookies and identifiers. At the moment we do not advertise yet; even with a yes, nothing from Google loads and no advertising cookie reaches your device. Exactly what happens once we do advertise is explained in our Cookie Policy.

• Processing your order, making and printing it in the studio, shipping it and invoicing it. Legal basis: performance of the contract.
• Letting you sign in and showing and updating your profile, addresses and order details in the customer account. Legal basis: performance of the contract about the customer account that you conclude with us when you create the account.
• Answering your questions and complaints. Legal basis: performance of the contract or our legitimate interest.
• Meeting our legal obligations, such as the retention requirement for invoices. Legal basis: a legal obligation.
• Sending you a newsletter, but only if you consent yourself. Legal basis: your consent. You first confirm through a link and a button. After that you can unsubscribe with one click.
• Limiting form abuse, duplicate submissions and technical attacks and fixing outages. Legal basis: our legitimate interest in keeping the store and mail service secure and available.
• Understanding which pages and products help visitors and improving the store with that knowledge, through cookieless, anonymous visitor statistics. Legal basis: our legitimate interest in improving the store; the measurement places nothing on your device and cannot be traced back to you. Questions or objections: email us.
• Measuring whether our ads bring visitors and orders, so we can pay for advertising by its results. Legal basis: your separate consent to ad measurement, through the cookie banner. At the moment we do not advertise and therefore measure nothing; we already ask for your choice so we can respect it right away once that changes. You can withdraw this choice at any time with the Cookie settings button.

We do not use your data to build profiles, and we do not sell your personal data to third parties.

• Shopify, the platform behind our store: that is where your customer account, the cart, checkout, payment and order management run. Shopify receives your profile, address, order and contact details and, for a personalized product, the text that goes on it, so your order can be made.
• Payment providers at checkout: process the data needed for the payment method you choose. Which provider that is depends on the method and is shown at checkout. We never receive a full card or account number.
• The carrier: receives your name, delivery address and the necessary delivery details.
• Vercel, the company that hosts our site: this means technical data is processed, such as your IP address, the time and browser data. What you enter in a form or your cart also passes through those servers.
• SEO Overview and Supabase, our own visitor statistics: our internal dashboard sends only the limited statistics fields above to our Supabase database in the selected EU region. We store hourly totals only, with no raw events or visitor profiles. No cookies are set and nothing is stored on your device for this.
• OpenFreeMap, the service behind the map images: only on the map poster page. As soon as the map appears, your browser loads the map images and their fonts straight from OpenFreeMap, based on OpenStreetMap data. This happens automatically while the map loads, so it happens even if you never search for anything yourself. OpenFreeMap sees your IP address, your browser details and which part of the map you request. We add no name and no account to that, and we do not record which crop you are looking at; only what you order in the end ends up in your order.
• Photon (Komoot), the place search: only when you look up a place on the map poster page or the star map page. That search does not leave your browser directly but goes through our own server, which passes on the search term and nothing else. Photon therefore sees the IP address of our server and not yours, and receives no name, no account and no other browser details. We do not keep the search term.
• Google (ad measurement), only with your separate consent: would receive through its advertising tag which ad brought you to our site and which store steps followed. Google is independently responsible for that and acts according to its own privacy policy. As long as you have not said yes, we load nothing from Google: there is no Google code on the page, so Google does not receive a single signal and learns nothing about your visit. If you withdraw a yes you gave earlier, the code loaded at that moment immediately receives a denial signal, and after that nothing loads anymore. And because we do not advertise at the moment, even with a yes nothing goes to Google.
• Judge.me, our review platform: manages the reviews customers write about our products and our store, and requests them by email after an order. If a review includes a photo, that photo loads directly from the Judge.me servers; at that moment Judge.me receives your IP address and browser data. The review texts themselves we collect when building the site, not from your browser, and of each review we only show the display name its author chose.
• Resend, our mail provider (United States): sends our email and processes recipient, sender, subject, message content and delivery metadata for that. This includes newsletter confirmations, contact and withdrawal messages and the confirmation of receipt of a withdrawal. Contact and withdrawal emails also arrive in our own mailbox.

We may also share data when the law requires it, or with professional advisers bound to confidentiality. The visitor statistics place nothing on your device; ad measurement stays off until you switch it on through the cookie banner. Without your consent there are no advertising pixels or tracking cookies on our site.

We are based in the EU; if you are located outside the EU, for example in the United States or Canada, your data is transferred to and processed in our systems in the EU. Shopify, the platform behind our store, is Canadian and may process data in Canada and other countries. For Canada an adequacy decision applies where relevant. For other transfers contractual safeguards apply. Resend, our mail provider, processes data mainly in the United States and uses the EU-US Data Privacy Framework and the standard contractual clauses of the European Commission. Vercel, which hosts our site and internal dashboard, also uses appropriate safeguards for transfers outside the EEA, including standard contractual clauses. The aggregated visitor statistics are stored in our selected Supabase region in the EU. Judge.me, our review platform, may process data outside the EEA; if a review photo is shown, Judge.me receives your IP address. That transfer rests on appropriate safeguards, including standard contractual clauses. If we start advertising and you switch on the measurement, Google is certified for it under the EU-US Data Privacy Framework. You can email us if you want more information or a copy of these safeguards.

• Invoices and accounting records: 10 years. That is the retention period Belgian VAT law prescribes for invoices and bookkeeping, and it applies to us because we are based in Belgium. Other order details, including the personalization text belonging to your order, are only kept as long as they are needed for warranty, complaints and a possible dispute.
• Profile and address details in your customer account: as long as your account is active or as long as they are needed for the service. You can ask us to delete the account and this data. Data that is also part of an order or invoice is afterwards only kept as long as the legal retention requirement or an ongoing dispute demands.
• The print files we prepare in the studio for your order: no longer than needed for production, delivery, reprints and complaint handling.
• Email contact: 2 years after the last message.
• Newsletter: active until you unsubscribe. After that, our mail provider only keeps your email address and unsubscribe status on a suppression list, as long as needed to respect your unsubscribe. That data is not used to send newsletters.
• Technical logs: per the limited retention period configured at the company that hosts our site. We only keep them longer if needed to investigate a specific security incident.
• For form security we keep hashed keys for at most 24 hours and only inside the active server function. Your email address itself is not stored in that counter.
• The cart cookies: 14 days.

You have the right to access your data, have it corrected or deleted, have the processing restricted, object, and have your data transferred. If you gave consent, you can withdraw it at any time; that does not affect the lawfulness of the processing carried out on the basis of your consent before you withdrew it.

Email us at hello@studiomiron.com. We respond as soon as possible and at the latest one month after receiving your request. You can always lodge a complaint with a supervisory authority, without contacting us first: for California residents that is the California Privacy Protection Agency (cppa.ca.gov), and you can also contact the Belgian data protection authority (Gegevensbeschermingsautoriteit, gegevensbeschermingsautoriteit.be), which supervises us because we are based in Belgium.

Our store is meant for adults ordering something for a baby shower, a birth, a wedding or another celebration. Our services are not directed at children under the age of 16 and we deliberately do not ask children for data. If you put your child's name or date of birth on a card, game or poster, we only use it to make and ship that product.

Do you think we have still received data about a child that should not be with us? Email hello@studiomiron.com and we will delete it.

The site runs entirely over an encrypted connection. Your cart lives in a cookie that JavaScript in your browser cannot read (httpOnly). Payment details go directly to the payment provider and never pass through our servers.

Access to order and customer data is limited to those who need it to make your order, ship it or answer your question. If you still notice something that seems wrong, let us know through our contact page.