Privacy policy

This policy explains what FAMIKAT collects about you, why, who else sees it, and what you can require us to do with it. It applies to famikat.com and to any order you place with us.

The data controller is FAMIKAT, 1209 Mountain Road Pl NE, Albuquerque, NM 87110, United States. For any privacy question or request, write to support@famikat.com.

1. What we collect

Information you give us

Name, email address, shipping and billing address, and phone number when you place an order.
Artwork, logos, text or photographs you upload for a custom piece.
The content of any message you send us.
Your email address if you subscribe to our newsletter.

Information collected automatically

IP address, browser type, device type, operating system and language settings.
Pages viewed, products opened, time spent, and the site or advertisement that referred you.
Cookie identifiers, described in Section 6.

What we never see. Your full card number, expiry date and security code go directly to our payment processor. They are never transmitted to us or stored on our systems. We receive only the card brand, the last four digits, and whether the payment succeeded.

2. Why we use it

Purpose	Legal basis (EU/UK)
Processing and delivering your order	Performance of a contract
Producing a custom artwork from files you supply	Performance of a contract
Customer support, returns and warranty claims	Performance of a contract
Fraud screening and payment security	Legitimate interest
Improving the site and our product range	Legitimate interest
Marketing emails	Consent
Advertising and audience measurement cookies	Consent
Keeping tax and accounting records	Legal obligation

We do not sell your personal information, and we do not share it with third parties for their own marketing.

3. Custom artwork files

Files you upload for a custom piece are used for one purpose: producing your artwork. We do not publish them, resell them, or add them to our catalogue without asking you first and getting your agreement in writing.

By uploading a file you confirm you own it or hold the rights to have it reproduced. We keep production files for 24 months so that we can honour warranty replacements at the original specification, then delete them.

4. Who we share it with

Shopify — hosts the store and processes orders on our behalf.
Payment processors — Shopify Payments, PayPal and the other providers shown at checkout, each handling card data under their own privacy terms and PCI-DSS obligations.
Carriers — we pass your name, address, phone number and email so a parcel can be delivered and tracked.
Manufacturing partners — the workshop building your piece receives the production specification and, for custom work, your artwork file. They receive your shipping address only when they dispatch directly, and are contractually barred from using your data for anything else.
Email and analytics providers — for newsletters and for understanding how the site is used.
Authorities — where we are legally required to disclose, or where disclosure is needed to investigate fraud or protect someone's safety.

5. International transfers

We operate from the United States and work with partners in several countries, so your information may be processed outside the country where you live, including outside the European Economic Area.

Where data leaves the EEA or the UK, the transfer is covered by Standard Contractual Clauses approved by the European Commission, or by an adequacy decision for the destination country.

6. Cookies

We use four categories of cookie:

Strictly necessary — keep you logged in and keep your cart intact. These cannot be switched off; the store will not function without them.
Preferences — remember your language and currency.
Analytics — tell us which pages are used and where visitors give up, in aggregate.
Marketing — measure advertising performance and show relevant ads on other platforms.

Analytics and marketing cookies are set only after you consent. You can withdraw consent at any time through the cookie settings on the site, and you can block or delete cookies in your browser settings — though blocking the strictly necessary ones will break checkout.

7. How long we keep it

Data	Retention
Order and transaction records	7 years (tax and accounting law)
Custom artwork production files	24 months, matching the warranty period
Support correspondence	3 years after the case closes
Newsletter subscription	Until you unsubscribe
Analytics data	26 months

8. Your rights

Wherever you live, you may ask us to:

tell you what personal data we hold about you and give you a copy;
correct anything inaccurate;
delete your data, where we have no legal duty to keep it;
stop or restrict a particular use;
send your data to another provider in a portable format;
object to processing based on our legitimate interests.

If you are in the EEA or the UK, these are statutory rights under the GDPR, and you may also complain to your national data protection authority.

If you are in California, the CCPA gives you the right to know what is collected and disclosed, to request deletion, and not to be discriminated against for exercising those rights. FAMIKAT does not sell personal information as the CCPA defines it.

Send any request to support@famikat.com. We reply within 30 days and never charge for it. We may need to verify your identity first — usually by confirming details of an order you placed.

9. Marketing emails

We email you about new work and offers only if you opted in. Every message carries an unsubscribe link that takes effect immediately, and you can also unsubscribe by emailing us.

Transactional messages — order confirmation, dispatch notice, delivery updates, warranty correspondence — are part of fulfilling your order and are sent regardless of marketing preferences.

10. Security

The site runs over TLS encryption throughout, and payment pages meet PCI-DSS requirements. Access to customer data inside FAMIKAT is limited to staff who need it to do their job.

No system is perfectly secure. If a breach ever affects your personal data and creates a real risk to you, we will notify you and the relevant authority without undue delay, and within 72 hours where the GDPR requires it.

11. Children

famikat.com is not intended for children under 16 and we do not knowingly collect their data. If you believe a child has given us personal information, contact us and we will delete it.

12. Changes

When this policy changes we update the date below. If a change materially affects your rights, we will tell you by email or with a notice on the site before it takes effect.