Privacy Policy

In short. We use your data mainly for one thing: creating, printing, and shipping the portrait you ordered. We strip location data from your pet photo the moment you upload it, and we delete the photo and portraits 90 days after delivery unless you've given us permission to show them. Only Revolut sees your card details. We don't sell or share personal information, and we don't send newsletters. If your browser sends a Global Privacy Control signal, we honor it automatically.

Who we are

Coat & Canvas is run by Redbit S.r.l.s. con socio unico, a company based at Viale della Grande Muraglia 494, 00144 Rome, Italy (VAT number IT15237911001, certified email redbitsrls@legalmail.it). Redbit is the "controller" of your personal data. For any privacy question or request, email info@coatandcanvas.com.

Because we're based in the European Union, the EU General Data Protection Regulation (GDPR) applies to all the personal data we handle, including data about customers and visitors in the United States. This policy is our notice under Articles 13 and 14 of the GDPR and also covers US state privacy laws (see "For US residents" below).

What we collect, why, and for how long

Activity	Data	Purpose	Legal basis (GDPR)	How long we keep it
Your order and delivery	Name, email, phone (optional), shipping address, product, style and size, your pet's name if you want it on the nameplate, order status	Process your order, send previews, have the portrait printed and delivered	Performance of a contract (Art. 6(1)(b))	As long as needed to handle the order and any warranty claim; data that ends up in our accounting records, 10 years
Photo and portraits	The photo you upload, with location data removed; the previews; the approved portrait and, if you buy it, the digital file	Create the previews, let you choose, print the approved portrait	Performance of a contract (Art. 6(1)(b))	90 days after delivery, then deleted
Gallery and social media (optional)	The images you allow us to use	Show them in the site gallery or on our social media accounts	Your separate, optional consent (Art. 6(1)(a)), which you can withdraw at any time	Until you withdraw consent
Payment	Amount, currency, payment status (authorized, captured, canceled, refunded), payment reference, email. Never your card details	Place a hold when you order, capture it when you approve, cancel or refund it	Performance of a contract (Art. 6(1)(b))	With the order; in accounting records, 10 years
Accounting	Payment records; billing details if you ask for an invoice	Keep the books required by Italian law	Legal obligation (Art. 6(1)(c))	10 years (Italian Civil Code, Art. 2220)
Order emails	Email address, order number, message content	Order confirmation, previews ready, approval reminders on day 3 and day 5, shipping notice	Performance of a contract (Art. 6(1)(b))	With the order
Server logs and security	IP address, date and time, page requested, referring page, browser; the IP address you place your order from	Keep the site secure, prevent fraud and abuse, fix errors	Legitimate interest (Art. 6(1)(f))	Log files are rotated and deleted automatically; the order IP stays with the order
Consent panel (InMobi Choice)	IP address and the country InMobi derives from it, technical browser data, your choices	Ask for consent where the law requires it, respect your choice, and be able to prove it	Legal obligation (Art. 6(1)(c) and Art. 7(1)) and legitimate interest (Art. 6(1)(f))	Your choices: 13 months in your browser. Data InMobi receives: per its own privacy policy
Analytics with Google Analytics 4	_ga cookie IDs, pages viewed, referrer, device and browser, approximate location	Understand how the site is used and improve it	In the US: legitimate interest, and you can opt out at any time. In the EU, EEA, UK, and Switzerland: consent (Art. 6(1)(a))	Cookies up to 14 months; data in Google Analytics up to 14 months
Cookieless visit counter	Page visited (without query parameters), referring domain, country, device type, page load times; a daily code derived from IP and browser, never the raw IP	Count visits and measure site speed	Legitimate interest (Art. 6(1)(f))	Individual visits 90 days, then totals only; the code changes every day
Customer support by email	Name, email, message, any photos you send (for example, of damage)	Answer you, handle warranty claims and complaints	Contract or steps you asked for (Art. 6(1)(b)); our legitimate interest in defending claims (Art. 6(1)(f))	As long as needed to close the request; if it's about an order, with the order

When these periods end, the data is deleted.

Your pet's photo

• On upload, we remove the photo's location data (EXIF), meaning the coordinates of where it was taken.
• No people. Photos that show people are rejected or cropped so only the animal remains. Please upload only photos you have the right to use.
• To create the portrait, we send the photo to Vertex AI, Google Cloud's artificial intelligence service, which processes it on our behalf. Google commits not to use Vertex AI customer data to train its models. Google may process the photo in data centers outside the EU, with the safeguards described below.
• Memorial portraits. If the portrait honors a pet who has passed away, a person at Redbit also reviews the previews before we send them to you.
• How long. 90 days after delivery, we delete the photo, the previews, and the portrait, including the digital file if you bought one. Download it and keep a copy. If the order is canceled or the payment fails, the photo and previews are deleted after 30 days.
• Gallery and social media. Only with a separate consent, which you don't need to give to place an order, may we show the images in the site gallery or on our social media accounts. You can withdraw it any time by emailing info@coatandcanvas.com, and we'll take them down from the gallery and our accounts.

We don't use your photo for anything other than what's listed here.

Payments

You pay by card through Revolut (Revolut Bank UAB, Lithuania). You enter your card number and other payment details in Revolut's payment form; our site never sees or stores them. Revolut only tells us whether the payment went through and its status.

When you order, Revolut authorizes the amount: it places a hold on your card without charging it. We capture the payment only when you approve a preview. If you don't approve within 7 days, or the order is canceled, the authorization lapses and the hold is released. Revolut acts as an independent controller for payment data, under its own privacy policy.

Printing and shipping

We use Gelato (Gelato AS, Norway) for printing and shipping. Gelato sends your order to a partner print lab in the delivery country: in the US for US orders, in Italy for Italian orders. Gelato and the print lab receive your name, shipping address, email, and the image to print; the carrier receives what it needs to deliver. The lab downloads the file through a signed link that expires shortly after. Carriers are USPS or UPS in the US and UPS in Italy.

Emails

We only email you about your order: confirmation, previews ready, reminders if you haven't approved yet (on day 3 and day 5), and shipping. We don't send newsletters or promotional emails today; if that changes, we'll update this policy first. Our emails are sent from our mail server hosted by IONOS in Germany.

Browsing and security

The site runs on an IONOS SE server in Germany and reaches you through Cloudflare, which acts as our content delivery network (CDN), runs our DNS, and protects the site from attacks. The server logs the requests it receives to detect attacks and errors, not to track what you look at. When you place an order, we also record the IP address it comes from, to prevent fraud.

The consent panel (InMobi Choice)

Consent is managed by InMobi Choice, a consent management platform provided by InMobi Technology Services Pte. Ltd. (Singapore) that complies with version 2.4 of the IAB Transparency & Consent Framework (TCF). The panel loads from InMobi's servers, so your browser sends InMobi your IP address (which InMobi uses to determine your country and apply the right rules), technical browser data, and your choices. Your choices are stored in your browser for 13 months, in the cookies and local storage listed in our Cookie Policy.

InMobi acts as an independent controller for the data it receives, as set out in its CMP data processing agreement, and handles it under its own privacy policy.

Analytics with Google Analytics 4

• In the US, analytics start on your first visit, with Google Signals turned off. You can opt out any time from the "Do Not Sell or Share" panel or the Your Privacy Choices page. If your browser sends a Global Privacy Control signal, analytics stay off automatically.
• In the EU, the European Economic Area, the UK, and Switzerland, the panel appears on your first visit and Google's script doesn't load until you accept. If you decline or don't choose, analytics stay off.
• With Google Signals off, the data isn't linked to your Google account.
• According to Google, Google Analytics 4 doesn't log or store IP addresses; it uses them only to derive an approximate location.
• Cookies last up to 14 months, and data stays in Google Analytics for up to 14 months. In our reports we only see aggregated data.

You can change your choice any time with the "Cookie settings" link in the footer. Technical details are in our Cookie Policy.

Cookieless visit counter

Alongside Google Analytics, we use our own visit counter (stats.redbitapp.com), which runs on our server. It sets no cookies and doesn't store your IP address. It records the page visited without query parameters, just the domain of the site you came from, your country, device type, and page load times. To count unique visitors, it computes a code from your IP address and browser using a key that changes every day, so the next day it can no longer be linked back to you. Keys are deleted after 7 days and individual visits after 90; after that, only totals remain.

Where the data comes from and whether you have to provide it

Data comes from you (forms, photos, emails) and from your browser. Revolut tells us the payment outcome; Gelato and the carriers tell us the shipping status. Cloudflare and InMobi derive your country from your IP address. We don't buy data or match it with other databases.

Your name, email, address, and photo are needed to fulfill your order; without them we can't create or ship it. Your phone number is optional: if you give it, we pass it to the print lab and the carrier only for delivery contacts. Consent for the gallery and for analytics is optional and doesn't affect your order.

Who we share data with, and international transfers

We don't sell or rent personal information. We use vendors that process data on our behalf, and we disclose data to authorities only when the law requires it. Revolut and InMobi handle the data they receive as independent controllers.

Vendor	Service	Data	Location	Transfer safeguards
IONOS SE	Servers for the site, the visit counter, and email	Order data, photos and portraits, logs, emails	Germany (EU)	No transfer outside the EU
Cloudflare, Inc.	CDN, DNS, attack protection	Traffic in transit, IP address, country	United States and global network	EU-US Data Privacy Framework and Standard Contractual Clauses
Google Cloud EMEA Limited (Vertex AI)	AI portrait generation	The photo, style instructions, generated images	Ireland; processing may also take place outside the EU	EU-US Data Privacy Framework and Standard Contractual Clauses
Revolut Bank UAB (independent controller)	Card payments	Card details, amount, email, payment outcome	Lithuania (EU)	No transfer outside the EU by us
Gelato AS and partner print labs	Printing and shipping	Name, shipping address, email, image to print	Norway (EEA); print lab in the US or Italy	For orders shipped to the US: transfer necessary to perform the contract (GDPR Art. 49(1)(b))
Carriers: USPS or UPS in the US; UPS in Italy	Delivery	Name, shipping address, email	United States or Italy	For orders shipped to the US: as above (GDPR Art. 49(1)(b))
TeamSystem S.p.A. (Fatture in Cloud)	Bookkeeping and invoices	Payment records; billing details if you ask for an invoice	Italy	No transfer outside the EU
InMobi Technology Services Pte. Ltd. (independent controller)	Consent panel (InMobi Choice)	IP address, technical browser data, consent choices	Singapore and other countries outside the EU	Standard Contractual Clauses (Decision (EU) 2021/914)
Google Ireland Limited	Analytics (Google Analytics 4), only when active	The analytics data described above	Ireland and United States	EU-US Data Privacy Framework and Standard Contractual Clauses

Standard Contractual Clauses are approved by the European Commission (GDPR Art. 46); the EU-US Data Privacy Framework is based on the Commission's adequacy decision of July 10, 2023.

Your rights under the GDPR

Articles 15 to 22 of the GDPR give you the right to:

• access your data and get a copy;
• correct inaccurate or incomplete data;
• have your data deleted when it's no longer needed or was processed unlawfully (data we're legally required to keep, such as accounting records, stays until the period ends);
• restrict processing in certain cases;
• receive your data in a structured format (portability) for processing based on a contract or consent;
• object to processing based on legitimate interest, including analytics in the US;
• withdraw consent at any time, without affecting processing that already happened: for analytics, use the "Cookie settings" link; for the gallery, send us an email.

Email info@coatandcanvas.com. We reply within one month; for complex requests we may need up to two more months, and we'll tell you within the first month (GDPR Art. 12). You can also file a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the authority of the EU country where you live or work.

Children

Our shop is for adults only: you must be at least 18 to place an order. We don't knowingly collect data from minors. If you believe a minor has given us personal data, let us know and we'll delete it.

Security

The site works only over HTTPS. Card details never pass through our server. Photos, previews, and print files are kept outside the public part of the site, and the print lab downloads them through signed links that expire. If a data breach occurs, we'll follow GDPR Articles 33 and 34.

Automated decisions

We don't make decisions based solely on automated processing that have legal or similarly significant effects on you, and we don't profile you (GDPR Art. 22). AI creates the previews; you decide which one gets printed.

For US residents

This section applies to residents of California, where the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) applies, and of other states with similar privacy laws. We extend these rights to all our US customers and visitors, even where these laws' thresholds don't apply to us.

Notice at collection

Category	What	Source	Why	How long	Sold or shared
Identifiers	Name, email, phone if you provide it, shipping address, IP address, _ga cookie IDs	You; your browser	Fulfill your order, security, analytics	As described in the table above; accounting records 10 years	No
Commercial information	Products ordered, amounts, order and payment status	You; Revolut	Fulfill your order, accounting	Accounting records 10 years	No
Visual information	Your pet's photo, the previews, the portrait	You; AI-generated	Create and print the portrait; gallery only with your consent	90 days after delivery, unless you consent to the gallery	No
Internet activity	Pages viewed, referrer, browser and device	Your browser	Security and analytics	Up to 14 months in Google Analytics; 90 days in the visit counter	No
Approximate geolocation	Country and, in the US, state. Never your precise location: we strip location data from photos	Derived from your IP address by Cloudflare and InMobi	Apply the right consent rules; analytics	90 days in the visit counter; up to 14 months in Google Analytics	No
Communications	Messages you send us	You	Answer you, handle warranty claims and complaints	As long as needed; if it's about an order, with the order	No

We don't collect sensitive personal information: only Revolut handles your card details. We don't use any data to infer characteristics about you.

We don't sell or share your personal information

We don't sell personal information, and we don't share it for cross-context behavioral advertising. We don't sell or share the personal information of consumers under 16.

Global Privacy Control

We treat the Global Privacy Control (GPC) signal as a valid request to opt out: if your browser sends it, analytics stay off in that browser automatically. You get the same result from the "Do Not Sell or Share" panel, which opens from the "Cookie settings" link in the footer or from the Your Privacy Choices page.

Your rights

You have the right to know what personal information we have about you and get a copy, to ask us to delete or correct it, to opt out of its sale or sharing (which we don't do), to limit the use of sensitive personal information (which we don't use), and not to be discriminated against for exercising these rights.

Email info@coatandcanvas.com with the subject line "US privacy request." An agent you've authorized in writing can also make a request for you. We verify your identity by matching the information you give us with what we have, for example your order number and the email you used. We respond within 45 days, and may extend that by another 45 days if we tell you why.

Appeals

If we deny your request in whole or in part, we'll explain why. You can appeal by emailing info@coatandcanvas.com with the subject line "Appeal." We'll review the decision and reply in writing within 45 days. If you're not satisfied with the outcome, you can contact your state Attorney General or, in California, the California Privacy Protection Agency.

Changes to this policy

The date of the last update is shown at the bottom of the page. We update this policy when the way we handle data changes, and we'll post a notice on the site for significant changes.