Privacy Policy

1. Who is responsible for your information

Picturing Places is operated by Picturing Bits SASU, a company established in France. Picturing Bits is the data controller for the processing described here, except where another organisation acts as an independent controller for its own processing.

This Policy applies when you visit picturing-places.com, use the map creator, download free artwork, purchase a physical product, contact us or otherwise interact with Picturing Places.

2. Information we process

Information you provide

Depending on your use, we may process your name, contact information, billing and delivery information, messages, feedback, place requests, and information associated with an order or support request.

Your map design

We process design information such as the selected place and coordinates, map position and scale, style, colours, labels, dates or other text, layout and product options, and rendering settings. Some unfinished designs and preferences remain locally in your browser. When server-side rendering, downloading or production is requested, the necessary design information is sent to our systems.

Orders and payments

For physical-product orders, we process contact and delivery details, product and variant, personalised artwork, order status and transaction information. Stripe processes complete payment-card details. We receive the payment status, amount, transaction identifiers and other information needed to administer the transaction, but do not receive or store complete card details.

Technical information

Our infrastructure and security services may process IP address, browser and device characteristics, requested pages, timestamps, request information, referring page, approximate location inferred from IP address, and error, performance and security information.

3. Search, orders and service providers

Place search

Place searches, including an address, postcode or landmark you type, may be sent to Geoapify. The request passes through our server, so Geoapify receives it from our server rather than directly from your browser IP address. Precise provider responses may be cached in our Cloudflare infrastructure for up to five minutes. A selected label and coordinates are used to create your map, may be included in a locally stored or shareable design link, and are sent to our systems when server-side rendering, downloading or production is requested.

Orders and fulfilment

We use order information to verify payment, create artwork, manufacture and deliver products, send transactional messages, provide support, process cancellations, replacements and refunds, prevent fraud, and meet accounting, tax and legal duties.

We currently use Prodigi to manufacture and fulfil physical products. We provide only information necessary for fulfilment, which may include recipient name, address, contact details required for delivery, order and product details, and the production artwork. For customer information handled on our behalf, Prodigi acts as our processor and may use production facilities, group companies, fulfilment providers and carriers.

Other providers and recipients

We do not sell personal information. Where reasonably necessary, we share it with Stripe for payments; Cloudflare for hosting, security, databases and private storage; Geoapify for place search; PostHog for optional analytics; Sentry for error monitoring; Prodigi and delivery providers for production and delivery; and professional advisers, banks, insurers, authorities, regulators or courts for appropriate legal or operational reasons.

Stripe and delivery providers may act as processors or as independent controllers for activities arising from their own legal and regulatory obligations.

Communications

We use contact details for requested transactional messages, including order confirmations, delivery information, support, cancellations and refunds. If we offer optional marketing, we will obtain consent where required and provide an unsubscribe method. Optional marketing is not required to purchase.

4. Why we process information

Our principal purposes and legal bases are:

• Contract or pre-contract steps: providing the creator and requested artwork; processing orders and payments; providing fulfilment information to Prodigi; customer support, cancellations, defects, replacements and refunds.
• Legal obligations: accounting, tax and transaction records and other mandatory compliance.
• Legitimate interests: customer service and dispute resolution; preventing fraud, abuse and security incidents; essential technical monitoring and error diagnosis; and establishing, exercising or defending legal claims.
• Consent: optional product analytics and optional electronic marketing where consent is required.

Where we rely on legitimate interests, we consider compatibility with your rights and reasonable expectations. You may withdraw consent at any time without affecting processing already lawfully carried out.

5. International transfers and retention

Some providers operate internationally, so information may be processed outside France or the European Economic Area. Where a destination lacks an applicable adequacy decision, we or our providers use safeguards required by data-protection law, such as European Commission Standard Contractual Clauses or another recognised mechanism. You may contact us for information about safeguards for a particular transfer.

How long we keep information

• Production artwork: 90 days after delivery, or until an active defect, replacement, chargeback or dispute is resolved.
• General support correspondence: two years after the last contact.
• Order, complaint or dispute correspondence: five years after the case closes, with access restricted when it is retained only for legal claims.
• Invoices and mandatory accounting records: ten years where required by applicable law.
• Precise-place search cache: up to five minutes.
• Cloudflare Worker observability logs: up to seven days under our current plan.
• Other security and access records under our control: up to six months in the ordinary course, and up to twelve months when needed for an active security investigation.
• Sentry error events: up to 30 days under our current plan.

After production artwork is deleted, we may retain the order and accounting metadata needed for our contractual, legal and dispute-management obligations. Optional analytics follows our configured analytics retention. Your analytics preference is remembered in your browser for up to approximately 180 days unless changed or cleared earlier. Providers acting as independent controllers apply their own retention duties; processors follow our contractual arrangements.

6. Cookies and browser storage

Strictly necessary storage may operate requested features, remember technical state, protect administrative areas, maintain security or continue a requested process. The creator may store preferences or unfinished work locally in your browser.

PostHog analytics are disabled by default and begin only after you choose to allow analytics. When allowed, we use a randomly generated analytics identifier to measure page visits and the journey through the creator, including completed wallpaper preparation and confirmed print orders. We also use masked session recordings to understand clicks, scrolling and navigation. Input values and page text are masked in your browser; artwork previews, canvas content and embedded payment pages are excluded. Console logs and network request or response payloads are not recorded. Recordings are retained for up to 30 days. Recording stops when you withdraw analytics consent. We do not send payment-card details, delivery addresses or the personal text in your artwork to PostHog. You can change your choice through Privacy choices. Rejecting or withdrawing optional analytics does not prevent creator use or purchases. Browser settings can remove cookies and local storage, but doing so may reset preferences or locally stored work.

7. Your data-protection rights

Depending on the circumstances and applicable law, you may have rights to access, correct or delete information; restrict processing; object to legitimate-interest processing; receive certain information in a portable format; withdraw consent; and complain to a competent supervisory authority. These rights are not absolute—for example, transaction records may need to be retained under accounting or tax law.

To exercise a right, email [email protected] with enough information to identify the data and understand the request. We may reasonably verify your identity. As Picturing Bits is established in France, you may complain to the Commission Nationale de l’Informatique et des Libertés (CNIL), or another competent authority where applicable.

Children

Picturing Places is intended for a general audience and is not specifically directed at children. We do not intentionally design it to collect personal information from children independently of a parent or guardian. Contact us if you believe a child supplied information in circumstances where we should not process it.

8. Security and changes

We use technical and organisational measures intended to protect information, including restricted administrative access, encrypted communications, private storage, access controls, monitoring, supplier controls and measures designed to limit sensitive information in technical logs. Sentry is used for error and security monitoring, not advertising or optional product analytics. No internet or storage system can guarantee absolute security.

Private operator integrations

Private integrations may let authorised Picturing Bits operators publish Picturing Places content to third-party platforms such as Pinterest or Instagram. They are not public customer-account features and do not access customers’ social-media accounts. We may securely store credentials and operational information for our own business accounts; the platforms process information under their own privacy policies.

Changes to this Policy

We may update this Policy when services, providers, technology or legal obligations change. The date above identifies the current version. We will give additional notice where a material change requires it.

9. Contact us