Privacy Policy

What we collect

When you order we receive your name, email address, delivery address, and what you bought. That is the whole list.

We never see your card number. Payment happens on a page hosted by Stripe, and what comes back to us is a confirmation, the last details needed for the receipt, and nothing you could pay with.

Your basket and your light or dark preference are stored by your own browser and stay there. Neither is sent to us as a basket. What does leave is the count described under visitor measurement: the product, its price and how many, with nothing attached that says who you are.

Visitor measurement

We use Google Analytics to count visits and see which pages people actually read. It sets a cookie, and it tells us roughly which country you arrived from and which page you landed on. It runs on every page of this shop.

It also follows the shape of a sale: something added to a basket, a checkout started, an order finished. So it is told which work and which size went into the basket and what the order came to. What it is never given is anything that identifies you to us, not your name and not your address. We use it to answer "is anyone finding the shop, and do baskets turn into orders", not to follow a person.

When you use the search box, the words you type are sent to Google Analytics along with how many works matched them. We read that to find what people look for and cannot find, which is how the collection gets better. It is the search term on its own, with nothing attached that says who typed it.

Visitors in the European Economic Area are treated as having refused, by default and without being asked, so no measurement cookie is set for them and Google estimates that traffic instead. That is why there is no banner on this site: there is nothing we would ask you to agree to.

We also count page views with Umami, which runs on a server we rent and manage ourselves rather than on an analytics company's. It records the page you opened, the site that sent you here, your browser, device and screen size, your language, and roughly where you are, down to the city. It sets no cookie and stores nothing in your browser. Your IP address is used to work out that location and to tell one visit from another, and it is not saved. Page addresses are recorded without anything after a question mark, so the words in a search are not kept this way.

We also keep our own count of what goes into baskets, on our own server rather than Google's: which work, which size and frame, what it costs and how many. It sets no cookie and carries nothing that says who you are, not your name and not your address. It covers what is bought as well as what is added, so we can see how many baskets turn into orders. We keep it for three months and then it is gone. It tells us which works people actually want, which is a different question from which ones they open. A browser extension that blocks Google does not stop this one, because it is part of the shop rather than someone else's code. What it records is the work and never the person.

When a search finds nothing, we also keep the words you typed, on our own server, so we can see what people come looking for and we do not sell. Searches that DO find something are not kept this way. It is the words on their own, with nothing attached that says who typed them, and it is gone after three months.

Our hosting company also keeps its own server records, which is unavoidable for any site on the internet, and the two counts described above are the only things we add to it.

Advertising

We advertise on Facebook and Instagram, and to know whether that is worth paying for we run Meta's measurement code on this shop. It sets a cookie of its own, called _fbp, and it tells Meta when a page is opened, when a work is looked at, when one is added to a basket and when a checkout is started. Once an order is paid for, our own server tells Meta what it came to and which country it is going to.

They do learn which works you look at and add to a basket, in the size and frame shown on the page, along with the price. That is what the measurement is for, and pretending otherwise would be the easy thing to write here. The message we send when an order is paid for carries only the total and the country, not a list of what was in it.

Your email address and the country are scrambled before they are sent, into a string that cannot be turned back into either. Meta are not told your name, your street address or your IP address, and they never see your card details, which do not reach us either.

This is the part of the site that can follow you elsewhere. Meta may recognise you on Facebook or Instagram and show you our advertising there. That is what it is for, and it is the one thing on this site that works that way.

If you are in the European Economic Area, none of it happens. The code is never loaded, so no Meta cookie is set and nothing about your visit is sent. If an order is going to an address in the EEA, nothing is sent when it is paid for either. Not a scrambled version, not a count, nothing. We have no way for you to agree to it and no banner to ask you with, so the honest answer is not to run it.

Anywhere else, any browser setting or extension that blocks Meta works here, and nothing on this site behaves differently when you use one. Your Facebook ad settings also control what Meta does with it.

Cookies

We set none of our own. Google Analytics sets one, described above, and in the European Economic Area it does not set that one either. Meta's measurement code sets one more, described under advertising, and in the European Economic Area it is never loaded at all. Local storage holds two things: your basket, and whether you chose the light or dark theme. Both stay in your browser and neither is a cookie.

Stripe sets its own cookies on Stripe's payment page, which is theirs rather than ours, and they use them to spot fraud and keep your payment session working.

The review invitation

On the page you land on after paying, we offer you the chance to be sent a review survey by Google. Taking it is entirely your choice and nothing happens unless you opt in on that page.

To make the offer at all, that page sends Google your email address, your order reference, the country it is shipping to and the date we expect it to arrive. Nothing else goes with it: not your name, not your street address, and not which piece you bought. If you opt in, Google emails you later, and any rating you give is about us as a shop rather than about a particular piece.

If you do not opt in, Google does not email you. The offer appears on that one page, once, and nowhere else on this site.

If you leave without paying

The basket has an optional email box. Filling it in saves you typing your address again on the payment page, because we pass it to Stripe to fill that field in for you. Leaving it blank is fine and changes nothing about your order.

If you start paying and then leave without finishing, we are told that a basket was left behind and what it was worth. If you gave us an email address we keep it with that record. If you did not, there is nothing on it that says who you are, and there is no tick box on the payment page that would give us one.

Stripe gives us a link that would rebuild that basket, and it stops working after 30 days. We do not send any email about a basket left behind. If that ever changes, an address you typed into the box above is the only one we would have to send it to.

A basket left behind and the email list below are separate records. Signing up in the footer does not mean you will be emailed about a basket, and leaving a basket behind does not put you on the list.

The email list

There is a signup box in the footer of every page, and another on the page you reach after ordering. Both are optional, neither is filled in for you, and nothing on this site pops up to ask.

Typing an address into one of those boxes does not put you on the list. We store the address, which of the two boxes it came from, the time, and a one-way fingerprint of the network address it arrived from, and then we send one email asking whether you meant it. Only clicking the link in that email adds you. If you never click it, nothing is ever sent to you.

Every message from the list carries a link that takes you off it, and your email program's own unsubscribe button works as well. One click is enough, there is no form and no questions, and it works whether or not you ever confirmed. We keep the record that you asked to stop, because that is what stops you being added again by mistake.

The list is not sold, rented or shared with anyone. We keep your address for as long as you are on the list. If you leave, we keep the address on a do-not-send record rather than deleting it, because a deleted address is one that can be added again by the next person who types it into the box. Ask us and we will remove that record too.

An address you give at checkout is not on this list. That address is used to send your receipt and to tell you when your order ships, which is what you gave it to us for. It is never copied onto the list. The two are separate records and nothing moves between them.

The signup box runs a check that you are not a machine, handled by Cloudflare, who host this site. Almost every time it decides on its own and you see nothing at all. When it cannot tell, it shows you one box to tick. It sets no cookie, it does not follow you anywhere else, and nothing it collects goes to an advertiser. It is there because typing an address into that box makes us send an email, and without it somebody could point that at a stranger.

Asking a question

The round button in the bottom corner of every page opens a box for questions about this shop. What you type there, and the earlier questions and answers in that same conversation, go to our server and to an AI model run by Cloudflare, who host this site, so it can write an answer from this shop's own pages. The answer comes from that model rather than a person, and it can be wrong.

We keep no copy of the conversation, and nothing about it is saved in your browser: it is gone when you leave the page. What we keep is a count of questions asked and of the ones it could not answer, with nothing attached that says who asked, for three months.

When it cannot answer, you can leave your question with your email address so a person can reply. We keep that question and address for 90 days and then delete them. The address is used to answer you and nothing else: it is not the email list and it is never added to it. The box runs the same check that you are not a machine as the signup box, handled by Cloudflare.

What we do not do

There is no session recorder and nothing that reads what you type before you send it. We do not sell or rent your details, we do not build a profile of you, and we do not send marketing email unless you have asked for it and confirmed it by clicking a link we sent you. That last promise is load bearing rather than a description of a shop that sends nothing: the list described above exists, and this sentence is what governs it.

Who else handles your order

Five companies see part of it, each because they do a job we cannot:

• Stripe takes the payment and holds the card details we never see. They also get your email and address to check the payment is genuine.
• Our fulfillment partner prints the piece, frames it and posts it, so they get the delivery name and address and the file we print from.
• Cloudflare host this site, the order records and the images.
• Google are told two separate things. Analytics is told that an order was finished, what it came to and which pieces were in it, with no name and no email address attached. And the page you land on after paying sends your email address, order reference, delivery country and expected arrival date, and only those, so they can offer you the review survey described above. They get nothing at all if you never reach that page.
• Meta are told what a paid order came to and which country it is going to, with your email address and the country scrambled first. Not your name, not your address, and not a list of what you bought. Nothing is sent at all if your order is going to the European Economic Area.

That means your details leave New Zealand. The lab that prints and posts your piece is overseas, and the payment and hosting companies operate across several countries. There is no way to make the print otherwise.

How long we keep it

Order records are kept for seven years, which is what New Zealand tax law requires of business records. The print file for your order is removed once it has been delivered and the window for a remake has passed.

Your rights

Under the Privacy Act 2020 you can ask what we hold about you and have anything wrong corrected. Email hello@encoregalerie.com and we will answer within 20 working days, which is the limit the Act sets.

You can ask us to delete your details. We will, except for the order records tax law requires us to keep, and we will tell you exactly what is staying and why.

If you are unhappy with how we have handled it, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

Contact

hello@encoregalerie.com. A person reads it.