Privacy Policy
Last updated
This policy explains what personal information BelDisegno collects when you use beldisegno.com, buy from us, or contact us; why we use it; who receives it; how long we keep it; and the rights you have. It covers everything we do — printed products made to order and digital services such as artwork created from your photos — whether you order on our site or from one of our marketplace shops.
1. Who is responsible for your information
- BelDisegno, a business name registered in Ontario, Canada, operated by its sole owner, is responsible for your personal information (the "controller").
- Postal address: 6 Greenbriar Rd, North York, ON M2K 0H6, Canada
- Email: support@beldisegno.com (subject line "Privacy")
- Person in charge of the protection of personal information (Quebec's Act respecting the protection of personal information in the private sector, and Canada's PIPEDA): Owner, BelDisegno, reachable at the same email and postal address.
- We have not appointed a representative in the European Union or the United Kingdom. Please contact us directly at the address above; we answer requests from everywhere.
2. What we collect, and where it comes from
From you
- Account: your email address and a password (stored only in scrambled, "hashed" form by our sign-in provider), or — if you sign in with Google — the name, email address and profile picture Google shares with us. If you add a passkey, your device keeps the private key; we store only the public key. You can also add a display name and avatar.
- Orders of printed products: your name, email address, delivery address and phone number, what you ordered, the personalisation you enter (names, dates, messages), gift messages, the files and photos you upload for us to work from, your approval of the proof, and the shipping and tracking details of your parcel.
- Payments: our payment processor collects your card or other payment details directly. We never receive or store your card number. We receive the payment outcome, the processor's references for it and its fraud-risk assessment.
- Digital services and credits: the photos and instructions you send for a digital artwork, the results we create, your credit purchases and how you use them.
- Messages: what you send us through the contact form, Bel (the AI chat on our website), the support chat, email, a messaging app where we offer a channel, or an AI assistant connected to our store, including any files you attach.
- Newsletter: your email address and the record of your consent (when you confirmed, your IP address, browser and language).
- Reviews: if you write a review, your rating, text, any photos, and the name you choose to show. If you answer them, your ratings for shipping and customer service and whether you would recommend us; we keep those to ourselves and never publish them.
- Design apps: what you enter into our free design apps. Some apps send what you enter to a provider that does that part of the work — for example, a map app sends the places you search for to our mapping provider (section 5).
- Intellectual property notices: if you tell us that something we sell infringes your copyright or trademark, your name, company, role, postal address, country, phone number and email address; the details of your notice and your typed signature; the documents you upload, such as a registration certificate or a letter of authorisation; and a coded (hashed) form of your IP address and your browser type, which we use only to limit abuse of the form.
Collected automatically
- Technical and security data: IP address, browser and device type, approximate location (country, region and city, worked out from the IP address by our hosting provider), pages requested and timestamps — kept in server logs and with support messages, to keep the site secure and stop abuse.
- Our own visit statistics: when you view a page on our site, including the home page, product and category pages, your cart and the start of checkout, we record the page, the referring site, campaign tags and device type under a code made from your IP address and browser that changes every day. It sets no cookie. If you arrive from a link in one of our emails, or place an order, the visit can be linked to that email address or order.
- Search history: what you search for on the site, linked to a random
identifier in the
bd_vidcookie (or to your account), to improve results. - Cookies and similar technologies: see section 9.
From others
- Marketplaces: when you buy from one of our marketplace shops (for example on Etsy), the marketplace gives us your name, delivery address, order details, personalisation and the messages and files you send there, and an email address we use only for that order. We do not add marketplace buyers to our marketing lists. Where the marketplace itself is the seller (for example Amazon Merch on Demand), we receive sales figures, not buyers' personal information.
- Google (if you sign in with Google) and our payment processor (payment outcome and fraud signals), as described above.
- Business contacts: if we contact a business about working with us, we may hold the business's name and the work contact details published on its own website.
3. Why we use it, and our legal basis
| Purpose | Legal basis (EU/UK GDPR) |
|---|---|
| Running your account; making, delivering and supporting your order; creating your digital artwork; answering your messages | Contract |
| Taking payment, keeping accounting and tax records, answering legal requests | Legal obligation |
| Security, fraud prevention, abuse prevention, rate limiting and our own visit statistics and search improvements | Legitimate interests (keeping the shop safe and working) |
| Analytics and advertising cookies and tags where consent is required (section 9) | Consent |
| Reminder emails about a preview or custom listing you asked us for. They are on unless you turn them off. We send at most two at each step: two about a preview, two about a custom listing waiting for your approval, and, if you approve it but do not pay, two more until you pay. They stop when you pay, when you reply to us, or when we close the conversation, and we send none for a listing that has expired. To stop them yourself, use the "Choose what we send you" link at the bottom of any reminder and turn off "Support replies" (this also stops the emails telling you we have answered a message), or just reply and ask us to stop | Contract (steps you asked us to take before an order) |
| Noting what you asked us about (the product and its category, the kind of personalisation, the occasion, and how far your order got) so we can help you better. To fill these notes we also scan the images you send us, on our own server: software reads any text in them and sorts them by kind (a logo, a photo, a pet). No other company sees them for this, and the scan is not kept, only the note. We use these notes to suggest other products only if you have separately agreed to marketing emails | Legitimate interests (understanding what our customers ask for) |
| Handling an intellectual property notice: checking it, deciding it, telling you the outcome, and keeping a record of what we did | Legal obligation, where a law requires us to act on notices (such as the EU Digital Services Act); otherwise legitimate interests (respecting other people's rights, and being able to show what we did if a claim follows) |
| Marketing emails | Consent |
| Showing your review publicly | Consent |
| Reviewing saved chats with Bel, and the feedback you give on its answers, to make Bel and our service better; and measuring whether a chat helped, by linking it to the visit it started in, the products you opened or added to your cart from it, and an order you place within 7 days | Legitimate interests (making our help better) |
In Canada we rely on your consent, which may be implied for what is needed to fill your order, and express for marketing and for sensitive information. You can withdraw consent at any time (section 11); withdrawing does not affect what we did before.
Address check. When you pay for a printed product, we send your delivery address — not your name, email or phone number — to Google's address validation service to check that a parcel can reach it. If it may not be deliverable, a person reviews the order and may contact you to correct the address; the check never cancels an order on its own.
Fraud screening. Our payment processor scores each card payment for fraud risk. When a payment for a printed product is rated as risky, we hold the order before production until a person reviews it; the result may be that we cancel and refund it. We make no decision with legal or similarly significant effects about you by automated means alone.
4. How we use AI
- Digital artwork. Our studio designs each style and the instructions behind it; AI image tools then create your artwork from the photos and details you send. To do this we send your photos and instructions to an AI image-generation platform, which runs image models from the AI model providers named in section 5.
- Support replies. We may use AI tools to help draft replies to your messages. A person reads, edits and sends every reply.
- Bel, our chat assistant. Bel is an AI. It answers in the chat on our website using Anthropic's Claude models and live facts from our catalogue and policies, and it can put you in touch with a person from our team at any time. When you are signed in, Bel can show you your own orders (status, items and tracking); it never sees your address or payment details. Bel can make mistakes: the price and options you pay for are the ones shown at checkout.
- Designing your order with Bel. After you have paid for a personalized product, Bel can create a design and show it on your product, using AI image models on Fal.ai. It uses what you describe in the chat and the photos you added to that order. The pictures are kept with the chat so our team can prepare your print file; nothing is printed from them until our team has checked the print file.
- Leaving your contact with Bel. If you choose to give Bel your email address or phone number, we use it only to follow up on what you asked about. We send you news and offers only if you said yes to them, and you can stop them at any time.
- We do not use your photos or messages to train AI models of our own.
5. Who receives your information
We do not sell your personal information for money. We share it only with the providers that run the shop for us, each only for its part of the job, and with the others listed below. This table names the providers we use today; when that changes, we update it.
| Role | Provider | Where |
|---|---|---|
| Website hosting, server logs and approximate location from IP | Vercel | United States |
| Database, file storage and sign-in | Supabase | United States |
| Payments and fraud screening | Stripe | United States and other countries |
| Checking that a parcel can reach your delivery address: the address only | Google (Address Validation) | United States and other countries |
| Making and shipping printed products: your name, delivery address, phone number and print files | Printify and its print providers; Gelato and its print partners | United States, European Union, United Kingdom and other countries where the item is made |
| Delivering parcels: your name, delivery address and, where the carrier needs it, your phone number | The postal service or courier our production partner uses for your order | The countries the parcel passes through |
| Showing your parcel's progress on your order tracking page: the tracking number, an order reference and your language | 17TRACK (parcel tracking) | China and other countries |
| Creating digital artwork (section 4) | Fal.ai (AI image-generation platform), running image models from Google (Gemini) and OpenAI | United States and other countries |
| Help drafting support replies, and sorting support messages by the kind of problem they report, so we notice a fault on our site early | Google (Gemini), Anthropic | United States |
| Bel, the AI chat on our website: your chat messages, the page you are on, the products in your cart and, when you are signed in and ask about your orders, their status, items and tracking number | Anthropic | United States |
| Designs and product pictures Bel makes for a paid order: your description, the photos on that order and the product details | Fal.ai (AI image-generation platform), running image models from OpenAI and Google; Printify (product pictures) | United States and other countries |
| Routing some AI text requests to the model that answers them | OpenRouter | United States |
| Sending our emails | Resend | United States |
| Rate limiting to prevent abuse | Upstash | United States |
| Scanning files attached to support messages for malware. This service may share files submitted to it with its security community, so please do not attach documents you would not want seen by others. | VirusTotal (Google) | United States and other countries |
| Font files for the design tools and the small country flags on the site; your browser fetches them directly, so these services receive your IP address and browser details | Google Fonts, flagcdn | United States and other countries |
| Code libraries, emoji, stock images, product images and the artwork we create; your browser fetches them directly, so these services receive your IP address and browser details | jsDelivr, cdnjs, unpkg (content delivery); Fal.ai, Pixabay, Printify, Gelato (image hosting) | United States, European Union and other countries |
| Maps in our map design tools: the places you search for, and the map images | Mapbox | United States |
| Site analytics (section 9); and, if you opt in to a review survey after an order, your order number, email, country and delivery date | Google (Analytics, Customer Reviews) | United States |
| Advertising measurement (section 9) | United States | |
| Messaging channels, if you message us there; one also alerts our team to new support requests | Telegram, WhatsApp and Messenger (Meta) | Various |
| Marketplace orders — the marketplace is a separate controller under its own policy | Etsy | United States and other countries |
| If you send an intellectual property notice: your notice, including your name and contact details, may be shared with the person who provided the material you reported, with a marketplace or production partner that carries the listing when we ask it to remove the listing, and with a court or authority when the law requires | That person; Amazon, Etsy, Printify or Gelato; courts and authorities | Various |
| Where the law requires it, to protect our rights, or if the business is sold (you would be told) | Professional advisers, authorities, a buyer of our business | — |
What the AI providers say they do with your data. Fal.ai processes the data for us under its data processing addendum; by default it stores request data for 30 days, and its terms allow it to use de-identified or aggregated data to improve its services. Google states that, on its paid Gemini API, it does not use prompts or responses to improve its products, and logs them for a limited period only to detect abuse. OpenAI states that data sent to its API is not used to train its models, and that abuse-monitoring logs are kept for up to 30 days.
"Sale" and "sharing" under US state laws. Outside the regions where we ask first (section 9), the Google and Pinterest tags on our site let those companies collect information about your visit for analytics and advertising. Some US state laws may treat that as a "sale" or "sharing" of personal information. You can opt out at any time with the Cookie settings link in the footer, or by sending a Global Privacy Control signal.
6. Where your information goes
We are based in Canada. Most of our providers store or process data in the United States, and production partners may be in the European Union, the United Kingdom or elsewhere. Your information may therefore be processed outside your province or country — including outside Quebec and Canada — where it is subject to the laws of that place. For information from the EEA, the UK and Switzerland, we rely on the adequacy decisions those countries have made for Canada and, for other transfers, on the safeguards our providers offer, such as the European Commission's standard contractual clauses, the UK addendum, or the EU-U.S. Data Privacy Framework where the provider is certified.
7. How long we keep it
We keep personal information only as long as we need it for the purpose we collected it for, then delete or anonymise it. In practice:
- Orders and payments: as long as tax and accounting law requires (in Canada, generally six years after the end of the tax year).
- Account: while your account exists. When you ask us to delete it, we delete or anonymise what we are not required to keep.
- Uploaded photos, files and artwork, and the digital results we make for you: online for 45 days after we deliver your order, so you can download them and raise any problem. After that we keep an offline copy for 6 months, only to handle a remake or a claim, and then delete it. You can ask us to delete them sooner. Uploaded files that are no longer linked to an order or project are removed automatically.
- Support messages: as customer-service records until you ask us to delete them, unless we must keep them for a legal claim. The notes on what you asked about are kept and deleted with them.
- Chats with Bel: 12 months after your last message, then deleted automatically, together with any contact you left in them. Designs made for an order are kept with that order's records. You can ask us to delete a chat sooner.
- Newsletter: until you unsubscribe; we then keep your email address on a do-not-contact list so we never email you again.
- Intellectual property notices: six years after we decide the notice — the longest period in which a related legal claim can be brought in the countries we sell to — then deleted with the documents you uploaded. A notice whose email address is never confirmed is deleted after 30 days.
- Security logs and visit statistics: only as long as needed to protect the site and understand its use.
- Cookies: for the lifetimes in section 9.
8. How we protect it
We use encrypted connections (HTTPS), access controls on our database, and sign-in protection for our own accounts. Payment details stay with our payment processor. Files you upload, and the artwork we deliver, are stored at unlisted web addresses that are very hard to guess, but anyone who has the link can open the file, so please share links with care. No system is perfectly secure. If a security incident creates a real risk of significant harm to you, we will tell you and the relevant regulators as the law requires, and we keep a record of every incident.
9. Cookies, analytics and advertising
Essential cookies make the site work and are always on. Analytics and advertising technologies depend on where you are:
- In the EEA, the UK and Switzerland we ask first. No analytics or advertising cookies are set and the advertising tags do not load until you accept. Until you choose, Google Analytics runs in "consent mode": after your first interaction with the page it sends Google basic measurement signals without setting or reading cookies.
- Everywhere else, including the rest of Canada and Quebec, analytics and advertising run by default, and you can turn them off at any time with the Cookie settings link in the footer.
- You can change or withdraw your choice at any time, in the same place, with one click. You can also delete cookies already set in your browser settings.
Do Not Track and Global Privacy Control. We treat a Global Privacy Control (GPC) signal as your request to opt out of the sale or sharing of your personal information: advertising tags stay off for you everywhere. Browsers' older "Do Not Track" setting has no agreed meaning, and our site does not respond to it; use GPC or the Cookie settings link instead.
| Name | Purpose | Type | Lasts |
|---|---|---|---|
| sb-…-auth-token | Keeps you signed in | Essential | Your sign-in session |
| bd_cookie_consent | Remembers your cookie choice | Essential | 12 months if you accept, 6 months if you decline |
| bd_cart, bd_cart_has_lines (and the bd-cart browser storage) | Keeps your cart | Essential | 90 days / 7 days |
| bel_conv | Keeps your conversation with Bel, set only when you send it a message | Essential | 12 months |
| bel_last_at (browser storage) | Remembers when you last chatted with Bel, so an order you place within 7 days can be linked to that chat | Analytics (only with your consent where it is required) | 7 days of use; removed if you decline analytics |
| NEXT_LOCALE, bd_market, bd_prefs | Remember the language, market and currency you chose | Essential | 12 months |
| bd_vid | Random identifier for your search history | Functional | 12 months |
| bd_subscribed | Stops the newsletter pop-up showing again after you sign up | Functional | 5 years |
| _ga, _ga_* | Google Analytics — counts visits and how the site is used | Analytics | Up to 2 years |
| _pin_unauth, _pinterest_*, _epik | Pinterest — measures our Pinterest ads | Advertising | Up to 1 year |
The payment form, Google reCAPTCHA (which protects our contact form from spam and loads on the contact page) and Google Customer Reviews may set their own cookies when they are used.
10. Marketing emails
We send our newsletter and offers only to people who ask for them: the sign-up box is never pre-ticked, and you confirm by clicking a link we email you. Our marketing emails name us, give our postal address and have a one-click unsubscribe link, and you can also manage your choices on the email preferences page. We do not add marketplace buyers to our marketing lists. Order, delivery, proof and account emails are sent because you need them for your order.
11. Your rights
Depending on where you live, you have the right to:
- know whether we hold information about you, and get access to it and a copy;
- have it corrected if it is wrong or incomplete;
- have it deleted, or have its distribution stopped (including, in Quebec, de-indexing);
- receive it in a portable, structured format;
- object to, or ask us to restrict, how we use it;
- withdraw consent at any time, and opt out of marketing and of the "sale" or "sharing" of personal information;
- be told about, and have a person review, any decision about you made by automated means.
How to use them. If you have an account, sign in and open Settings → Privacy & your data. There you can download a copy of your account data (your profile, notification preferences, projects, app creations, orders, transactions, reviews and support messages) and send us a deletion request. Uploaded files, newsletter records and marketplace order data are not in that download — ask us for them. Anyone can also email support@beldisegno.com or write to us at the address in section 1. We may ask you to confirm your identity first, usually by replying from the email address we hold.
When we answer. Within 30 days. If a request is complex, we may extend this where the law allows (by up to 30 more days in Canada, or two more months under the GDPR), and we will tell you why. Using your rights is free, and we will never treat you differently for using them.
Complaints. Please tell us first, so we can try to fix it. You can also complain to a regulator:
- Canada: the Office of the Privacy Commissioner of Canada (priv.gc.ca);
- Quebec: the Commission d'accès à l'information du Québec (cai.gouv.qc.ca);
- European Union and EEA: the data protection authority of the country where you live or work;
- United Kingdom: the Information Commissioner's Office (ico.org.uk);
- Switzerland: the Federal Data Protection and Information Commissioner (edoeb.admin.ch).
California. California residents can ask us, once a year and free of charge, what personal information we disclosed to others for their direct marketing; we do not disclose it for that purpose.
12. Children
Our site is for a general audience and is not directed to children. We do not knowingly collect personal information from children under 13 (in the United States), under 14 (in Quebec) or under 16 (in the EEA and the UK), and you must be an adult to open an account or order. Many of our products are made for or about children, so parents and guardians send us their children's names and photos: please send a child's photo or details only if you are their parent or guardian, or have that person's permission. If you think a child has given us personal information, email us and we will delete it.
13. Shopping with an AI assistant
You can browse, design and prepare an order with our store from inside an AI assistant such as ChatGPT. The assistant's provider runs the conversation under its own privacy policy. We receive only what our app needs for the task: your search and product choices, the images you choose to send, the order number and email address you give to check an order (we send a one-time verification link and keep only coded records of it), and, if you contact us, your message and a short summary written by the assistant. We also receive a pseudonymous identifier, your IP address and your country, which we use only to prevent abuse and to show what we can deliver. We never ask for payment details in the chat; you pay on beldisegno.com. Carts made in the app are deleted after 7 days without activity. You can disconnect the app at any time in your assistant's settings.
14. Google sign-in and our own Google accounts
If you choose to sign in with Google, Google shares your name, email address and profile picture with us so we can create and sign you in to your account; we receive nothing else from your Google account. Separately, our own business Google accounts (the support mailbox, Merchant Center, Search Console, Analytics, Ads and YouTube) are connected to our systems so that we can read order emails and customer messages sent to us, list our products, measure our site and publish our videos. Data from those accounts is stored with our database provider only as long as we need it to run the shop. We do not sell it, use it for advertising, or use it to train AI models. BelDisegno's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Design-rights reviews and reports
When we review a design, we use the submitted artwork, notes, relevant permission evidence, request or order identifiers and review history to assess the request, communicate with you, fulfil or cancel it, resolve disputes and protect rights. Submit only information relevant to the review, and redact unrelated financial or personal details.
Review files are private and accessed through restricted administrative access or temporary signed links. Alternative artwork and permission images are normally removed within 225 days of submission, unless needed for an active review, dispute or legal hold. Operational decision records and financial records are retained under the periods described elsewhere in this policy. A formal rights complaint may follow the separate retention rules for legal claims.
We may share relevant information with service providers or parties involved in resolving a claim where necessary and lawful. A formal copyright counter-notice may be forwarded to the original claimant. We do not publicly display the permission evidence you submit through the design-review form.
15. Changes to this policy
When we change this policy, we update the date at the top of this page. If a change is significant, we will tell account holders by email or with a notice on the site before it takes effect, and ask for consent again where the law requires.
16. Contact
Questions or requests: support@beldisegno.com, or BelDisegno, 6 Greenbriar Rd, North York, ON M2K 0H6, Canada.