Last updated 16 September 2026.
Who handles your information
Ana-Raluca Constantin trading as My Art For You handles information for this shop. Correspondence and returns address: c/o Noctis Studios, 23 Glenfield Road, Leicester, LE3 6AT, United Kingdom.
Noctis Studios is the address addressee only, not the seller, a party to the sale contract, the payment operator or the controller of shop information. Privacy questions can be emailed to constantinanaraluca81@gmail.com.
Basket, reservations and orders
Product identifiers and quantities are kept in local storage so the basket persists. When you ask to check out, those identifiers, quantities and a random attempt identifier are sent to the shop server. The server keeps a time-limited reservation, Stripe Session, PaymentIntent and event identifiers, payment status, order lines, fulfilment state and an inventory audit. It does not receive or store full card details.
Payment, delivery and customs
Stripe receives the email, phone, billing, delivery and payment information entered in Checkout as payment processor. The selected postal or courier provider receives the delivery information needed to fulfil an accepted order and, where the service provides it, a tracking reference may be used for updates. Customs, tax and sanctions processes may require relevant delivery, contact, order, value, origin and product information to be disclosed to carriers, authorities or professional advisers.
Purposes and lawful bases
Checkout, reservation, payment, delivery, returns and support data is used to take steps requested before a contract and to perform accepted orders. Accounting, tax, customs and consumer-law records are handled where a legal obligation applies. Rate-limit identifiers and limited security logs are used for the legitimate interest of protecting the shop and its customers, subject to the buyer's applicable rights.
Security, contact and portrait enquiries
The service stores a salted one-way request-address identifier and timestamp for rate limiting. Transactional email hooks are disabled for this shop. The public contact form and uploads are disabled; using the email link causes Gmail and the sender's email provider to process the message. A private portrait reference photograph is not marketing permission.
How long information is kept
- Expired or abandoned reservations and failed checkout attempts: 30 days from expiry or last activity.
- The shop application does not retain raw webhook payloads. If an operational copy is retained, it is deleted within 30 days. Minimal webhook audit records (event ID, hash, mode, processing result, time and order link): 6 years.
- Security and rate-limit logs: 90 days, unless needed to investigate a specific incident.
- Ordinary support correspondence unrelated to an order: 12 months after the case closes. Correspondence concerning an order, return, complaint, chargeback or dispute: 6 years.
- Order, payment, refund, fulfilment, tracking, terms version, customer-consent evidence and accounting records: 6 years after the end of the tax year in which the order was completed.
- Customs and export documents: at least 4 years, and longer only where a specific procedure, trade agreement, dispute or legal duty requires it.
- Operational backups of the dynamic database: daily copies for 30 days and monthly copies for 12 months. Copies under dispute or legal hold are kept until the matter ends.
After the applicable period, information is deleted or securely anonymised unless a specific duty requires longer retention.
Your rights and complaints
Depending on the law that applies, you may request access, correction, erasure, restriction, portability or object to processing, and may complain to the UK Information Commissioner's Office or another competent authority. Some records must be retained for legal, accounting or dispute purposes.
No marketing tracking
No analytics, advertising tracker, newsletter or automated marketing is configured in this storefront.