Privacy Policy
Privacy Policy
Last updated: May 2026
This Privacy Policy describes how Photo & Craft, LLC ("Photo & Craft," "we," "us," or "our"), a California limited liability company, collects, uses, and discloses personal information when you visit photoandcraft.com (the "Site"), purchase products, subscribe to our newsletter, submit artwork for consideration, or otherwise interact with us.
1. Information We Collect
Information You Provide Directly
Identifiers and contact info: name, email, shipping/billing address, phone number
Payment information: card details and billing address, processed by Shopify Payments / Stripe — we do not store full card numbers on our servers
Account information: username, hashed password, order history, preferences
Artist submissions: portfolio images, biographical information, and contact details if you submit work for review
Communications: messages you send us via email, contact form, or customer service
Marketing preferences: newsletter signup, marketing opt-ins
Information Collected Automatically
Device and usage data: IP address, browser type, operating system, referring URL, pages viewed, time on site, click patterns
Approximate location derived from IP address
Cookies and similar tracking technologies (see Section 5)
Information From Third Parties
Payment verification from Shopify Payments / Stripe
Analytics from Google Analytics
Marketing engagement metrics from our email service provider
Under California law, we collect the following CCPA/CPRA categories of personal information: identifiers, customer records, commercial information, internet or network activity, geolocation data, and inferences drawn from the foregoing. We do not knowingly collect sensitive personal information beyond what is required to process payments.
2. How We Use Your Information
Process and fulfill orders, including shipping, tracking, and delivery
Send order confirmations, shipping notifications, and service communications
Respond to inquiries and artist submissions
Send marketing emails (opt-in only; unsubscribe available in every email)
Improve and personalize the Site, including analyzing usage patterns
Detect, prevent, and respond to fraud, security incidents, and unauthorized activity
Maintain edition tracking and provenance records for limited-edition artwork
Comply with legal obligations, including tax, accounting, and consumer protection laws
3. How We Share Your Information
We do not sell your personal information for money.
We do not currently "share" personal information with advertising partners for cross-context behavioral advertising under California's CPRA. If we begin doing so in the future, this policy will be updated to reflect the platforms used, and you will retain the right to opt out.
Service Providers
Shopify (e-commerce platform), Shopify Payments / Stripe (payment processing), our email service provider, Google Analytics (site analytics), and shipping carriers (USPS, UPS, FedEx, and similar).
Advertising Partners
We do not currently use third-party advertising partners or run paid advertising campaigns. If we begin running advertising in the future — through services such as Google Ads, Meta (Facebook/Instagram), or similar platforms — this policy will be updated to disclose the specific platforms, the categories of information shared, and your opt-out options. You will retain the right to opt out via the "Do Not Sell or Share My Personal Information" link in our footer.
Legal Compliance
Law enforcement, regulators, or other parties when required by law, subpoena, or to protect our rights.
Business Transfers
In connection with a merger, acquisition, financing, or sale of assets.
We do not share personal information with third parties for their own independent marketing use without your consent.
4. Data Retention
We retain personal information only as long as necessary for the purposes for which it was collected:
Order and provenance records — retained indefinitely for warranty support, edition tracking, and provenance; standard practice for limited-edition art
Account information — retained while your account is active and for up to 7 years after closure for accounting and tax compliance
Marketing data — retained until you unsubscribe or request deletion
Website analytics — retained per Google Analytics defaults (up to 26 months)
Customer service communications — retained for up to 3 years
Artist submissions — retained for up to 2 years if not selected; indefinitely if you become a represented artist
You may request deletion of your data at any time, subject to legal retention obligations.
5. Cookies and Tracking Technologies
We use cookies and similar technologies, grouped as follows:
Strictly Necessary
Required for cart, checkout, login, and core site function.
Functional
Remember preferences and improve experience.
Analytics
Google Analytics and similar tools to understand site usage.
Advertising
We do not currently use advertising cookies or run paid advertising on the Site. If we begin doing so in the future — for example through Google Ads, the Meta Pixel, or similar platforms — this section will be updated to describe the specific technologies in use, and you will retain the right to opt out.
You may disable cookies in your browser settings, but some features may not work correctly. You may also adjust your preferences in our cookie consent banner at any time, or use the "Do Not Sell or Share My Personal Information" link in our footer to register an opt-out for any current or future "sharing" of personal information for advertising.
We honor the Global Privacy Control (GPC) browser signal as a valid opt-out of sale and sharing under California law. Enabling GPC in your browser will be treated as an opt-out request for that browser and device.
6. Your Rights and Choices
Depending on your state of residence, you may have the following rights:
Access a copy of the personal information we hold about you
Correct inaccurate personal information
Delete your personal information (subject to legal obligations)
Receive a portable copy of your information
Opt out of marketing emails (link in every email)
Opt out of "sale" or "sharing" of your personal information for advertising
Limit our use of sensitive personal information (where applicable)
Designate an authorized agent to exercise rights on your behalf
To exercise these rights, email hello@photoandcraft.com or use the "Do Not Sell or Share My Personal Information" link in our footer. We will verify your identity by matching your request against information in your account or order history. We respond within 45 days, with one possible 45-day extension where reasonably necessary, and we will notify you if an extension is needed.
We do not discriminate against you for exercising your privacy rights. You will not receive a different price, lower quality of service, or be denied goods or services for asserting your rights.
7. California Privacy Rights (CCPA/CPRA)
California residents have the rights described in Section 6. We provide the following additional CCPA/CPRA-specific disclosures.
Categories of Personal Information Collected
In the past 12 months: identifiers; customer records; commercial information; internet or network activity; geolocation; inferences.
Sources of Personal Information
Directly from you, automatically through your use of the Site, from service providers, and from analytics partners.
Business Purposes for Collection
Order fulfillment, customer service, marketing, analytics, fraud and security, legal compliance.
Categories of Third Parties
Service providers, payment processors, shipping carriers, and legal authorities when required.
Sale or Sharing Disclosure
We do not sell personal information for money. We do not currently "share" personal information with advertising partners for cross-context behavioral advertising under CPRA. If we begin running paid advertising in the future, this disclosure will be updated to identify the specific platforms involved, and you may opt out using the "Do Not Sell or Share My Personal Information" link in our footer, by adjusting preferences in our cookie consent banner, or by enabling Global Privacy Control in your browser.
Sensitive Personal Information
We do not use or disclose sensitive personal information beyond purposes permitted without a right to limit (such as processing your payment).
Shine the Light (Cal. Civ. Code § 1798.83)
California residents may request, once per calendar year, information about our disclosures of personal information to third parties for those parties' direct marketing purposes. We do not currently make such disclosures. To inquire, email hello@photoandcraft.com.
Authorized Agents
You may designate an authorized agent to submit a request on your behalf. We may require written authorization signed by both you and the agent, and we may verify your identity directly.
Financial Incentives
We do not currently offer financial incentives in exchange for personal information.
8. Other U.S. State Privacy Rights
Residents of states with comprehensive privacy laws — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others — have rights similar to those described above, including the rights to access, correct, delete, and port personal information, and to opt out of targeted advertising, sale of personal information, and certain profiling. To exercise these rights, contact us at hello@photoandcraft.com.
If we deny your request, you may have the right to appeal. To appeal, reply to our denial response with the basis for your appeal, and we will review and respond within 60 days.
9. Children's Privacy
The Site is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected such information, please contact us at hello@photoandcraft.com and we will delete it promptly.
10. Third-Party Links
The Site may contain links to third-party websites and services. We are not responsible for the privacy practices of those parties. Please review their privacy policies before providing personal information.
11. Security
We use SSL/TLS encryption in transit, secure payment processing through Shopify Payments / Stripe, and reasonable administrative, technical, and physical safeguards to protect your information. No method of transmission or storage is 100% secure. In the event of a data breach affecting California residents, we will notify affected individuals as required by California Civil Code § 1798.82.
12. International Users
The Site is operated from the United States. If you access the Site from outside the U.S., your information will be transferred to and processed in the U.S., where data protection laws may differ from those in your jurisdiction. By using the Site, you consent to this transfer.
13. Changes to This Policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent revision. We will notify you of material changes via email or a prominent notice on the Site before they take effect.
Photo & Craft, LLC
5540 Fulton St.
San Francisco, CA 94121
Privacy questions?
hello@photoandcraft.com →