Privacy Policy

1. What we collect

• Account details: email, display name and role.
• Commission details: specifications, sizes, reference images and Design Lounge messages.
• Delivery details: shipping address, tracking numbers and proof-of-shipment files.
• Artisan business details: legal name, registration number, address, website, portfolio and business documents.
• Usage information: pages visited and studio actions linked to your account, used to run and improve the service.

2. Identity and payment data

Card payments are processed by Stripe, a PCI-DSS certified provider; we never receive or store full card numbers. Where identity or tax verification is required, it is performed by Stripe, and we retain only the verification result and reference IDs rather than copies of government ID numbers.

3. How we use it

To provide the marketplace (contract), verify artisans and prevent fraud (legitimate interest and legal obligation), process payments and tax (legal obligation), send service notifications, and improve the service. We do not sell your personal information.

4. Sharing

Your delivery name, address and contact details are shared with your artisan only to fulfill and ship your commission. Artisans may not keep, export or use buyer details for their own marketing.

We also share data with service providers: Stripe (payments), carriers and insurers (delivery), our hosting and email providers, and authorities where required by law.

5. Retention and security

Uploaded files are stored privately and are only accessible to the parties to a commission and Facet staff. Financial and audit records are kept as long as tax and payment rules require; other data is deleted or anonymized when no longer needed.

6. Your rights

Depending on where you live (including under GDPR, UK GDPR and the CCPA/CPRA), you may access, correct, delete or export your data, object to or restrict certain processing, and withdraw consent. We will not discriminate against you for using these rights. Contact us through the support form; you may also complain to your local data protection authority.