Privacy Policy

Who we are

Linvela Gallery is operated by Grafko-Caspar d.o.o., Ulica Ivana Sokača 6, 42000 Varaždin, Croatia (OIB 30402881876) — "we", "us". For any privacy question or request, contact us at help@linvelagallery.com.

What data we collect and why

Orders. When you buy from us we collect your name, email, shipping and billing address, and the details of your order. We need this to fulfil the contract: printing your artwork, shipping it, sending order and shipping confirmations, and handling returns. Payment card details go directly to our payment processor (Stripe) — we never see or store your card number.

Account. If you create an account we store your email, name, and password (stored only as a secure hash), plus your saved addresses and favorites. If you sign in with Google, we receive your name and email address from Google; we never see your Google password.

Support. If you contact us by email or through the site chat, we process the messages you send us to help you.

Analytics. With your consent, we use Google Analytics to understand how the shop is used (pages visited, what's added to carts, purchases). See "Cookies" below — analytics never runs unless you accept it.

Cookies

We ask for your choice before setting any non-essential cookie, and you can decline with one click. Your choice is stored for 12 months.

Necessary (always on — the shop can't work without them):

• _medusa_cart_id — keeps your cart.
• _medusa_customer_token — keeps you signed in (7 days).
• lv_consent — remembers your cookie choice (12 months).

Analytics (only with your consent):

• _ga, _ga_* — Google Analytics, anonymous usage statistics (up to 2 years).

Support chat (only with your consent): our chat widget (tawk.to) sets its own cookies to keep your conversation running across pages.

If you decline, analytics runs without cookies in aggregate-only mode and the chat widget does not load. You can change your mind anytime by clearing cookies for this site — the banner will ask again.

Who we share data with

We share personal data only with the service providers who make the shop work, and only what they need:

• Payment: Stripe (payment processing; PCI-DSS certified).
• Production & delivery: we print and ship your order ourselves in the EU; delivery carriers receive your name and address to deliver it.
• Email: our email delivery provider (Resend) sends transactional messages such as order, shipping, and password reset emails.
• Analytics & reviews: Google (Google Analytics with Consent Mode; and, if you opt in after a purchase, Google Customer Reviews as a customer-satisfaction processor).
• Support chat: tawk.to, when you've consented to chat cookies.
• Hosting: our website and database run on EU-region infrastructure (Vercel, Railway Amsterdam, Supabase eu-west-1).

Where a provider processes data outside the EU/EEA (e.g. Google, Stripe, tawk.to), transfers rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses.

How long we keep data

Order records are kept as long as Croatian accounting and tax law requires (generally 11 years). Account data is kept until you delete your account or ask us to. Analytics data is retained in Google Analytics for 14 months.

Your rights

Under the GDPR you can ask us for access to, correction, deletion, restriction, or a portable copy of your personal data, and you can object to processing based on legitimate interest. Where processing is based on consent (analytics, chat), you can withdraw it at any time without affecting the shop's functionality. Write to help@linvelagallery.com — we answer within 30 days. You can also complain to your data protection authority; in Croatia that is AZOP (azop.hr).

Changes

We'll update this page when our data practices change; the "Last updated" date above reflects the latest revision.