Privacy Policy & Data Protection

1. Information We Collect

When you place an order in our shop or contact the studio, we collect personal information necessary to fulfill your transaction, including your full name, email address, shipping address, and phone number.

2. Payment Processing (PCI-DSS)

Payment information is processed securely through Stripe Inc. We never store credit or debit card numbers on our local servers. Stripe complies with PCI-DSS Level 1 standards.

3. Data Retention and Security

All sensitive configuration data and API credentials stored in our SQLite database are encrypted at rest using AES-256-GCM. We maintain security safeguards in accordance with OWASP ASVS 4.0 Level 2 guidelines.

4. Your Rights under PDPA & GDPR

You have the right to access, rectify, or request deletion of your personal order history. To submit a data request, please contact our Data Protection Officer at alex@canvas.design.