Your photos stay yours.

• Your photos — to make what you ordered. They are stored securely and removed from our systems after your order is complete and the return window has passed.
• Your name, email, phone and address — to confirm, print, ship and track your order, and to reach you if something comes up.
• Payment — handled by Stripe. We never see or store your full card number.
• Basic usage — which pages load and whether something broke, so we can fix it. No advertising trackers.

• We never sell your information or your photos.
• We never use your photos in advertising or show them to other customers.
• We never share your phone number or texting consent with third parties for their marketing.

Only the people and services needed to fill your order: our staff, our printing equipment, the carrier who delivers it, Stripe for payment, and the phone and email services that send your updates. Each one is bound to use it only for that purpose.

When you sign up for texts at our text sign-up page, a kiosk or the counter, we record your phone number, which kinds of messages you chose (marketing and transactional are separate choices), the date and time, and where you signed up. We keep this as proof of your consent, as phone carriers require.

Reply STOP to any message to opt out and we stop texting you right away. Reply HELP for help. Msg & data rates may apply. Your mobile information will not be shared with third parties or affiliates for marketing or promotional purposes.

The back office can connect a business bank account through Plaid, the door banks provide for apps. The account's owner signs in on the bank's own page; Suvino receives a read-only key and never the bank password. We read balances and transactions to match deposits to card payouts, match charges to suppliers, flag anything odd, and prepare the accountant's reports. Money moves only between that business's own accounts, only after its owner approves each move, under a daily cap. We never pay anyone new, never wire, and never change a bank setting. Bank data is never sold or shared; the only services that touch it are the ones that run the app (our database host and Stripe, for matching payouts). Disconnecting the bank revokes the key at Plaid and deletes it at once.

Staff accounts can turn on two-step sign-in. After the password, we text a 6-digit code to that person's own phone and ask for it. We keep only a scrambled copy of each code, for a day, and a record of which sign-ins gave it (7 days) and which phones the person asked us to remember (30 days). Turning two-step off deletes those records.

• Orders, invoices and payments — 7 years, as tax law requires.
• Photos and print files — for the retention period set in the shop's storage settings, or until you delete them, whichever comes first.
• Bank keys and balances — while the bank is connected; deleted the moment it is disconnected. Bank transactions used for bookkeeping are financial records and follow the 7-year rule.
• Sign-in codes — 10 minutes to use; the scrambled copy for 24 hours.
• Staff accounts — while the person works here; access ends the day they leave and the account is deleted within 30 days.
• Security alerts and audit records — 12 months.

Deleted records are removed from the live database; the hosting provider's backups expire within 30 days after that. The owner reviews these periods every October and whenever a new kind of data is added.

Ask us to see, correct or delete what we hold about you at any time through the contact page. We answer within 30 days, do it, and tell you when it's done. Where the law requires us to keep a record (for example a paid invoice), we say so and keep only what it requires.

If this policy changes, the date at the top changes with it. Big changes get a note on the site.

The site keeps a little in your browser so it works: your cart, your sign-in, and the project you're designing, so nothing is lost if you close the tab. Staff who tick "Remember this phone" get a cookie that skips the texted code for 30 days on that phone. Payment pages use Stripe's own cookies to keep card details safe. We don't run advertising trackers.

Questions about your information go through the contact page.