Privacy Policy

The data controller is [YOUR REGISTERED BUSINESS NAME], trading as Sāpiën, [STREET ADDRESS, POSTCODE, CITY, POLAND], tax identification number [NIP].

For anything about your data, write to hello@sapien-art.com.

When you place an order: your name, email address, delivery address, phone number and what you bought. We need this to make the contract with you happen — to print, ship and support your order. Without it we cannot fulfil an order.

Payment information is entered directly with Stripe and never reaches our servers. We receive only the outcome of the payment, the last four digits of the card and the billing country.

When you email us: your message and contact details, kept so we can answer and to have a record of the exchange.

Your shopping bag is stored in your own browser on your device. It is not sent to us until you check out.

Performing our contract with you — processing and delivering your order.

Complying with a legal obligation — keeping invoices and accounting records for the period Polish tax law requires.

Our legitimate interests — answering enquiries, preventing fraud and keeping the site working. We use these only where your rights do not override them.

Stripe Payments Europe, Ltd. (Ireland) processes payments and holds the payment record.

Printful (Latvia, with facilities in the EU) receives the name, delivery address and item details needed to print and ship your order.

Vercel Inc. (United States) hosts the website and processes technical request data.

Cloudflare, Inc. (United States) provides DNS for the domain.

Each acts under a contract with us and may use your data only to provide their service. Where data reaches the United States, transfers rely on the EU Standard Contractual Clauses or an adequacy decision.

We do not sell your personal data, and we do not share it for anyone else's marketing.

This site does not use advertising or analytics cookies and does not track you across other sites.

Your shopping bag is kept in your browser's local storage so it survives a page refresh. Stripe sets its own cookies on its checkout pages, which are necessary to process payment securely and to prevent fraud.

Order and invoice records: for as long as Polish accounting and tax law requires, currently five years from the end of the tax year.

Email correspondence: up to two years after the matter is closed.

Your shopping bag: until you clear it or your browser's storage is cleared. That one is on your device, and you control it.

You may ask for a copy of the data we hold about you; ask us to correct it if it is wrong; ask us to delete it; ask us to restrict how we use it; object to processing based on our legitimate interests; and ask for your data in a portable format.

Write to hello@sapien-art.com and we will respond within one month.

Some data we must keep despite a deletion request — invoices, for instance, are required by tax law.

If you think we have handled your data wrongly, you may complain to the Polish supervisory authority, the President of the Personal Data Protection Office (Urząd Ochrony Danych Osobowych, uodo.gov.pl), or to the authority where you live.

The site is served over HTTPS. Payment details are handled entirely by Stripe, which is PCI-DSS certified, so card numbers never touch our systems.

No system is perfectly secure, but we keep the data we hold to the minimum needed and limit who can reach it.

This shop is not intended for children, and we do not knowingly collect data from anyone under 16.

If we change this policy we will update the date at the top. Material changes affecting how we use data you have already given us will be communicated directly.