Privacy Policy

When you buy something: your name, email, shipping and billing address, and what you ordered. Payment happens entirely on Shopify's checkout: we never see or store your card number. We use this to ship your order, send you order emails and answer your questions.

When you join a waiting list (a drop, a restock, the site launch): your email address, kept in our Shopify customer list, used only to send what you asked for. Every email has an unsubscribe link, and it works at once.

If you bought from our previous shop (Wix): your name, email and order history were moved to Shopify so we can still serve your order. You were not subscribed to any mailing list by that move.

When you browse: standard technical data (IP address, browser, pages viewed) in our hosting provider's logs, used to keep the site fast and working. We also count visits with Vercel Web Analytics: pages viewed, the site you came from, your country, device and browser, counted in aggregate. It sets no cookie and builds no profile; the visitor is not identified, and the data cannot follow you to other sites.

We use only the cookies the site needs:

• your bag (`mitsuart_cart_id`, 30 days);
• the creator link you arrived from, so their code applies to your order (`mitsuart_ref`, 30 days);
• your reprint vote on an ended drop (`mitsuart_voter`, 1 year);
• sign-in cookies, for our team only.

No advertising cookies, no cross-site tracking, no analytics profile.

We are a small shop and rely on a few providers, each receiving only what its job needs:

• Shopify: checkout, payments, orders, customer list
• NextSmartShip and Printful: your name and shipping address, to pack and ship your order
• Wix: the orders placed on our previous shop, until they have all shipped
• Vercel: website hosting and visit counting
• Neon: database hosting
• Cloudflare: image storage and delivery

These providers may store data outside Canada, usually in the United States. We do not sell, rent or trade personal information, ever.

Order records: as long as tax and accounting law requires. Waiting-list emails: until you unsubscribe. Technical logs: deleted automatically on short cycles.

Email us to access, correct or delete the personal information we hold about you, or to withdraw your consent to our emails. We answer within 30 days. Order records we must keep by law can only be partly deleted; we tell you exactly what we can and cannot erase.

In the EU and the UK, you have the same rights under the GDPR (access, rectification, erasure, portability, objection), used the same way: email us.

The shop is not directed at children under 13, and we do not knowingly collect their information.

We post any change here and update the date above. An important change also gets a notice on the site.

Privacy questions and requests: support@mitsuart.net

Person in charge of the protection of personal information (Québec, Law 25): the management of Mitsu Art, at support@mitsuart.net.