Privacy Policy
Effective Date: July 21, 2026
We value your privacy and strive to be transparent about how we handle your personal information. This Privacy Policy explains what data we collect, why we collect it, what we do with it, and what you can do to control the collection, correction, and/or deletion of your data under the European Union’s GDPR (General Data Protection Regulation), CCPA (California Consumer Privacy Act), and other applicable regulations (“Data Protection Laws”).
By using the Website or the Services, you confirm that you have read and agreed to the Terms of Service and read and understood this Privacy Policy.
1. Information That We Process
The types of information that we process depends on how you use the Website and/or the Services. The following explains the types of information we process.
1.1 Data You Provide
1.1.1 Basic Account Data
In order to use the Services, you may be required to register and create an account. You will be required to provide your name and email address.
1.1.2 Payment and Billing Information
If you purchase any Assets, we may collect payment and billing information to process the transaction. For instance, a billing contact name, billing address, email address, and phone number may be required.
1.1.3 User-Generated Content
If you leave comments or product reviews on the Website, we collect the data shown in any comment and product review forms you submit, as well as your IP address and browser user agent string for spam detection.
1.1.4 Messages and Other Communications
If you send us an email, submit a contact or support form on the Website, or contact us through some other means, the contents of your communication and any identifying information you include will be collected to process your inquiry.
1.2 Information We Automatically Collect
1.2.1 Location Data
We automatically collect your IP address.
1.2.2 Device Information
We automatically collect information about your browser and device when you visit the Website, and record this data in log files. This data includes your browser user agent string, unique device identifier, and device characteristics such as the operating system used.
1.2.3 Information Obtained From Cookies
When you visit the Website we use cookies to monitor traffic patterns, to identify which pages you have visited, to determine whether you have clicked on a page, and to determine which pages and features are popular.
1.3 Information Provided By Third Parties
1.3.1 Analytic Data
Some Information Obtained From Cookies may be provided by third-party analytics companies.
2. How We Process Your Data and Our Legal Bases For Doing So
We collect and process your data when you use the Website and/or the Services. We are obligated to identify a legal basis for each of our processing activities.
Under EU law there are six different bases, which may be relied upon to enable the lawful processing of your data:
- Consent: where we have received freely given, specific, informed and unambiguous consent from you;
- Contractual Necessity: where processing is necessary to conclude and perform a contract;
- Legal Obligation: where processing is necessary to comply with a legal obligation to which we are subject; or
- Legitimate Interests: in pursuit of our legitimate interests, except where these interests are overridden by your rights and freedoms.
Under the CCPA, we must disclose the purposes for which we collect your information:
Business Purposes: which include auditing, security, debugging/repair, certain short-term uses, performing services, internal research for technical development, quality and safety maintenance and verification, as well as the use of Your Information for our operational purposes, or other notified purposes that use Your Information as reasonably necessary and proportionate to achieve the operational purpose; and
Commercial Purposes: which include use of your to advance our commercial or economic interests, such as encouraging others to buy, rent, lease, join, subscribe to, provide, or exchange products, goods, property, information, or services, or enabling or effecting, directly or indirectly, a commercial transaction.
Following, we explain the purposes for processing different categories of your data.
2.1 Consent
| Reason for Processing | Categories of Data | CCPA Purposes |
|---|---|---|
| We use your data as necessary to answer your questions and provide any other customer support requested by you. | Basic Account Data, Payment and Billing Information, Messages and Other Communications | Business Purposes |
| You can adjust your device-based settings and cookie consent settings to enable sharing of certain information. | Analytic Data, Information Obtained From Cookies | Business Purposes |
| We use data shared in product reviews and comments to improve the Services, provide other users with information about products, and control spam. | User-Generated Content | Business Purposes, Commercial Purposes |
2.2 Contractual Necessity
| Reason for Processing | Categories of Data | CCPA Purposes |
|---|---|---|
| So you can create and control your account, and we can verify your access rights to the Services. | Basic Account Data | Business Purposes |
| To process billing transactions for paid use of the Services, such as making a purchase. | Basic Account Data, Payment and Billing Information | Business Purposes |
| To protect against fraud and errors, and to respond to claims of violations of our rights or those of third parties, and to enforce the Terms of Service. | Basic Account Data, Payment and Billing Information, Location Data, Device Information, Messages and Other Communications | Business Purposes |
2.3 Legal Obligation
| Reason for Processing | Categories of Data | CCPA Purposes |
|---|---|---|
| Compliance with tax laws. | Basic Account Data, Payment and Billing Information | Business Purposes |
| When you make requests to exercise your rights under Data Protection Laws. | All Your Data | Business Purposes |
| To respond to legitimate government or law enforcement requests. | All Your Data | Business Purposes |
2.4 Legitimate Interests
| Reason for Processing | Categories of Data | CCPA Purposes |
|---|---|---|
| Improve the Services and the Website, identify and fix bugs on the Website, ensure adequate infrastructure capacity for the Website. | User-Generated Content, Messages and Other Communications, Analytic Data, Information Obtained From Cookies, Device Information, Location Data | Business Purposes |
| To protect against fraud and errors, and to respond to claims of violations of our rights or those of third parties, and to enforce the Terms of Service. | Basic Account Data, Payment and Billing Information, Location Data, Device Information, Messages and Other Communications | Business Purposes |
| We share some of your data with third-parties, such as our payment processor Square, to provide the Services. | Basic Account Data, Payment and Billing Information | Business Purposes, Commercial Purposes |
| We may process your data in the event that all or part of the Services are sold or transferred. | All Your Data | Business Purposes |
3. Who We Share Your Data With
We do not sell your information to third parties, however we do share some of your information with third parties as necessary to provide service or improve your experience. We share the following information with the following entities:
| Category of Entity | Categories of Data | Purpose | Location |
|---|---|---|---|
| Web hosting providers | All Your Data | We use cloud services to host and store your data (Business Purposes). | USA |
| Payment processors | Basic Account Data, Payment and Billing Information | We use Square to process your payments when you make a purchase (Business Purposes, Commercial Purposes). | USA |
| Email service providers | Basic Account Data, Messages and Other Communications | We use Amazon Web Services to send and receive email regarding your user account, your e-commerce orders, and customer support (Business Purposes). | USA |
| Web analytics providers | Analytic Data, Information Obtained From Cookies | We use Google Analytics to monitor and improve the performance of the Services and the Website (Business Purposes). | USA |
4. Your Rights
At any time you may:
- decline to share your data with us; though we may be unable to provide certain services if you do;
- update certain information, such as your Basic Account Data and Payment and Billing Information, by logging into your account page and updating the data therein;
- block or restrict all or certain cookies using your browser settings, though doing so may disable enhancements to certain features or render some features, such as the shopping cart, inoperable;
- you may withdraw your consent at any time where Consent-based information processing applies, but we may be unable to provide certain services if you do.
4.1 Data Portability
You may request that we disclose certain information to you about our collection and use of your personal data over the past 12 months. Once we receive and confirm your verifiable consumer request, we will disclose:
- The categories of personal information we collected about you, or that we have sold, or disclosed for a Commercial Purpose.
- The categories of sources for the personal information we collected about you.
- Our business or commercial purpose for collecting or selling that personal information.
- The categories of third parties with whom we share that personal information.
- The specific pieces of personal information we collected about you (a data portability request).
4.2 Data Deletion
If you have an account on the Website, or have left comments or product reviews, you can submit a verifiable consumer request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can also request that we erase any personal data we hold about you, except for any data we are obligated to keep for administrative, legal, or security purposes.
4.3 Exercising Your Data Access, Portability, and Deletion Rights
If you wish to exercise your data access, portability, and deletion rights, send a verifiable consumer request to support@grafetti.com. We endeavor to respond to all verifiable consumer requests within 45 days.
4.4 Personal Data Sales Opt-In and Opt-Out Rights
We do not sell your personal data.
4.5 Non-Discrimination
We will not discriminate against your for exercising your data rights. Except where permitted or required by law, we will not:
- deny you services or goods;
- charge you different rates for services or goods;
- provide you with a different level or quality of services or goods;
- suggest that you will receive different rates, quality, or level of services or goods.
5. Data Security and Data Breach
We implement generally accepted industry standard security and organizational measures to prevent the unauthorized access, disclosure, destruction, alteration, or loss of your data.
Your data is protected by a password supplied by you. It is your responsibility to choose an adequately strong password, change your password when appropriate, and prevent disclosure of your password. It is also your responsibility to log out of your account after use, and maintain control over your email communications.
Despite these measures, it is not possible to warrant that any of your data transmitted to us will not be accessed, disclosed, destroyed, altered, or lost from the Services or the Website.
6. Data Retention
We retain your personal data while your account is active or as long as necessary to provide you with the Service. After your account becomes inactive we retain your information for long enough to achieve the purposes listed in this Privacy Policy, for example for dispute settlement, legal compliance, or protecting our interests or the interests of others.
The length of time we retain your information for depends on the purpose we need it for. Factors used to determine those lengths of time include minimum periods required by law, the time limit to make a legal claim, the time required to meet contractual obligations, and other relevant criteria. The length of time we retain some of your data is also dependent on what you do. For example, we need to retain your email address in order to provide you with a user account, so the length of time we retain your email address depends on how long you choose to have a user account.
7. Privacy Policy Changes
From time to time, we may update this Privacy Policy. If you have an account, we will notify you of the update at the email address you provided, and we will post a notice on the Website.
8. Contact Information
If you have further questions about the Privacy Policy, queries about exercising your data rights, or wish to submit a verifiable consumer request, please send an email to support@grafetti.com.