Privacy policy

What we collect

We collect the details you provide for an account, order or enquiry: your name, email, phone number, delivery or project address, selections and messages. Project records can include briefs, photos, plans, appointments and design files. We also keep quotes, invoices, payment and refund references, order status and consent choices.

Submitting an order request or enquiry saves those details even if payment or delivery is still pending. Optional fields are marked; without essential contact or delivery details, we may be unable to complete your request. Technical request information, including IP addresses, is processed to protect the site and prevent abuse.

Why we use it

We use information to respond to you, prepare quotes, manage accounts and orders, arrange deliveries or agreed visits, produce staff-made design work, reconcile payments and handle aftercare. We also use relevant records for security, accounting and legal obligations.

Depending on the purpose, processing is based on your consent, steps towards or performance of an agreement, a legal obligation, or a legitimate operational or security interest. Newsletter consent is a separate choice, not a condition of shopping or enquiring.

Private projects and security

Project photos, plans and deliverables are kept separately from public product images. Authorised studio owner or staff accounts and holders of the relevant private link can access them. A link may also allow quote actions, so share it only with people who should have that access.

The application encrypts stored outgoing email bodies and recoverable private-link tokens. Uploaded files are access-controlled, but are not separately encrypted by the application. Only upload material you may share, and avoid unnecessary identity, banking or sensitive information.

Cookies and browser storage

Essential HttpOnly cookies maintain server-backed sessions for sign-in and protected requests. Your shopping cart and saved pieces use local storage in your browser. Private order, project and document access details use the browser tab’s session storage; private links may also contain an access token.

You can clear or block cookies and browser storage in your browser settings, but some features may stop working. Clearing them removes local selections or access details, not orders or enquiries already submitted to the studio.

Payments and service providers

The payment provider you choose handles payment details on its hosted pages. Available providers are shown before payment; the studio uses Stitch Express and Ozow, and retains PayFast records for payments it previously processed. The store keeps amounts, status and payment references, not bank-login credentials, card numbers or card security codes. The chosen provider’s own privacy notice applies to its payment processing. PayJustNow is coming soon and is not currently a payment option.

Relevant contact, address and order details are shared with delivery providers to obtain quotes and fulfil deliveries. Hosting and site-support providers process information needed to operate and secure the store. Email providers process recipient details and messages when email is used.

Provider processing may take place outside South Africa. Any cross-border processing must meet POPIA’s requirements. Contact us for information about the providers involved in your order or request.

Messages, newsletters and tracking

We use your contact details for necessary account, order and project messages. When automatic email is off, the studio communicates manually; a saved reference does not mean an email has been delivered.

Newsletter signup, when available, requires separate opt-in consent and email confirmation. An order or enquiry does not subscribe you. Use the unsubscribe link supplied with your subscription, or email the studio to withdraw consent. This does not stop necessary messages about an existing order or project.

The store application does not run optional analytics or advertising pixels. External sites, including hosted payment providers and social networks, have their own privacy and cookie practices.

Keeping information

Retention depends on the purpose of the information, your ongoing order or project, applicable accounting and legal obligations, and any dispute that requires records. Information must not be kept longer than POPIA permits. Requests to remove information are assessed against those purposes and obligations, including records held in backups.

Closing a project, unsubscribing or clearing browser data does not automatically erase transaction records, issued documents or consent history.

Your privacy rights

Under the Protection of Personal Information Act (POPIA), you may request access to your personal information, correction of inaccurate information, and deletion or restriction where applicable. You may object to processing where the law allows and withdraw consent without affecting earlier lawful processing.

Email [email protected] with your request. We may need to verify your identity; do not send passwords, card details or private access tokens. You can also lodge a complaint with South Africa’s Information Regulator.