Privacy Policy
Last updated: 15 August 2026
1. Who is responsible for your data
The controller of your personal data is WIZARDHONESTY LDA, NIF 517236834, with registered office at R. Luís Calado Nunes 36, 2870-348 Montijo, Portugal, trading as ARTINBLACK STUDIO.
For any question about this policy or about your data, write to orders@artinblackstudio.com.
2. What we collect, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR art. 6) | Kept for |
|---|---|---|---|
| Name, e-mail, phone, delivery address | Processing and delivering your order, and contacting you about it | Performance of a contract, art. 6(1)(b) | 10 years, as accounting records must be retained under Portuguese law |
| The photograph you upload | Generating the thread pattern and producing your portrait or kit | Performance of a contract, art. 6(1)(b) | Deleted 90 days after the order is completed, unless you ask us to delete it sooner |
| Account e-mail and authentication data | Letting you sign in, see your orders and resume a kit in progress | Performance of a contract, art. 6(1)(b) | Until you delete your account |
| Name, e-mail, message from the contact or partner form | Answering your enquiry | Steps prior to a contract, art. 6(1)(b), and our legitimate interest in replying, art. 6(1)(f) | 2 years |
| Payment details | Taking payment | Performance of a contract, art. 6(1)(b) | We never see or store your card number — see section 4 |
| Usage statistics and device identifiers | Understanding how the site is used so we can improve it | Your consent, art. 6(1)(a) — nothing is collected until you accept | 14 months |
3. Providing your data is not always optional
The name, address and e-mail marked as required at checkout are necessary to conclude and perform the contract. Without them we cannot accept or deliver an order. Analytics, by contrast, are entirely optional and refusing them changes nothing about the service you receive.
4. Who else processes your data
We do not sell your data. We share it only with the providers that make the service work:
- Google Ireland Limited / Google LLC — hosting, database, server functions and, if you consent, analytics (Firebase and Google Cloud Platform).
- Stripe Payments Europe, Ltd. — payment processing. Your card details are entered directly into Stripe's systems and are never transmitted to or stored by us.
- The carrier that delivers your parcel, which receives the name and address needed for delivery.
Some of these providers process data outside the European Economic Area. Those transfers rely on the European Commission's Standard Contractual Clauses and, where applicable, on the provider's certification under the EU–US Data Privacy Framework.
5. Automated decisions
The thread pattern is generated automatically from your photograph. This is an image-processing step, not a decision about you: it produces no legal effect and does not significantly affect you within the meaning of GDPR art. 22. No profiling is carried out.
6. Your rights
Under the GDPR you may at any time:
- ask what data we hold about you and receive a copy;
- have inaccurate data corrected;
- have your data erased, where we are not legally required to keep it;
- ask us to restrict how we use it;
- receive the data you gave us in a portable, machine-readable format;
- object to processing based on our legitimate interest;
- withdraw consent to analytics at any time, without affecting what was lawful before.
Write to orders@artinblackstudio.com. We answer within one month. You may withdraw cookie consent directly on the site through the Cookie Policy page.
7. Complaining to the regulator
If you believe we have handled your data unlawfully you may complain to the Portuguese data protection authority, Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134 — 1.º, 1200-651 Lisboa, www.cnpd.pt. You may also complain to the authority in your own country of residence.
8. Security
The site is served over HTTPS only. Payments are handled by Stripe, which is PCI-DSS certified. Access to order data is restricted to the studio. No system is perfectly secure, but we take the measures appropriate to the scale of this business.
9. Children
The service is not directed at children under 16. We do not knowingly collect their data. If you believe a child has sent us personal data, write to us and we will delete it.
10. Changes
If this policy changes we will update the date at the top of this page. Material changes affecting your rights will be announced on the site.