Privacy Policy

1. Who This Policy Covers

This policy applies when you:

• Browse cheekypixel.store, with or without an account;
• Create an account, sign in, or sign in using Google or Facebook;
• Place an order — as a registered customer or as a guest;
• Sell as a creator: upload designs, run a creator page, earn and withdraw royalties;
• Sell as a brand or seller on the marketplace;
• Produce orders as a print partner studio;
• Contact us through the chat widget, the contact form, the affiliate form, or a business or sponsorship enquiry;
• Subscribe to our emails.

Different sections apply to different people. If you only browse, most of what follows never comes into play.

2. What We Collect

Data you give us

When you create an account:

• Your name and email address;
• Your password — stored only as a cryptographic hash, never in readable form, and never visible to us;
• Your phone number, if you choose to add one;
• Your language, currency and shipping country preferences.

You can optionally add more to your profile: a username, an avatar, a display name, a short bio, your date or year of birth, gender, and a confirmation that you are over 18. None of these are required to shop.

When you place an order:

• Shipping and billing address, and a contact phone number;
• What you ordered — item, size, colour, quantity, and any customisation you made, including artwork you placed yourself;
• Any note you leave for us;
• Discount, gift card or promotional codes you used.

If you sell as a creator:

• Your creator display name, bio and avatar;
• The artwork and files you upload;
• Your payout method, payout details and payout currency.

If you sell as a business or produce as a print partner, we also collect the details that role requires — legal name, business type, tax identification number and payout setup for sellers; company name, contact name, phone, studio address and production capabilities for print partners.

When you contact us:

• Your name and email if you write in as a guest through the chat widget or a form;
• The content of what you send us — chat messages, contact enquiries, affiliate applications, sponsorship and business enquiries, and our replies.

Data we collect automatically

Some data is recorded without you typing it in:

• Your IP address and browser user-agent are stored with an order, as evidence against fraud and chargebacks;
• Standard server logs, kept for security, debugging and abuse prevention;
• The device and browser information any website needs in order to serve pages correctly;
• With your consent only: analytics from Microsoft Clarity, including aggregate usage, heatmaps and session recordings of how pages are used.

Sponsored placements on the site count impressions and clicks as daily totals per booking. No identifier, cookie or profile is attached to those counts — a sponsor learns how many times a banner was seen, never by whom.

Data we receive from others

If you sign in with Google or Facebook, we receive only your email address and basic profile information — we request no other permissions, and we never gain access to your posts, contacts or friends. Our payment providers tell us whether a payment succeeded or failed and give us a reference for it; carriers give us delivery and tracking status.

Data we never ask for

We never see or store your full card number — that goes directly to our payment provider. We do not ask for identity documents from shoppers, and we do not want special categories of data such as health, religion, political views or biometrics. Please do not send them to us in chat or in an order note.

3. Why We Use It, and Our Legal Basis

Running your account and your orders

• Creating and maintaining your account, and signing you in;
• Taking, confirming, producing and delivering your order, and handling returns;

Legal basis: performance of our contract with you.

Payments, invoicing and fraud prevention

• Taking payment and issuing refunds;
• Checking orders for fraud and abuse, and defending against chargebacks;

Legal basis: performance of our contract, our legitimate interest in preventing fraud, and our legal obligations in accounting and tax.

Paying creators, sellers and production partners

• Calculating royalties, commissions and payouts;
• Producing the records that tax and accounting law require of us;

Legal basis: performance of our contract and legal obligation.

Support and service messages

• Answering your questions in chat, by email or through a form;
• Sending messages your order requires — confirmations, dispatch notices, verification codes, password resets;

Legal basis: performance of our contract and our legitimate interest in supporting our customers. Service messages are not marketing and cannot be unsubscribed from while an order is live.

Keeping the marketplace safe and lawful

• Reviewing designs before they go live, and acting on copyright or content complaints;
• Suspending accounts that break the rules, and investigating abuse of the platform;

Legal basis: our legitimate interest in a safe marketplace, and our legal obligations.

Marketing emails

• Sending you news, drops and offers;
• Telling you about creator programmes you asked to hear about;

Legal basis: your consent. You can withdraw it at any time — in your account settings, or with the unsubscribe link in any marketing email.

Analytics and improving the site

• Understanding which pages work and where people get stuck;
• Fixing errors and improving the shopping and creator experience;

Legal basis: your consent, given through the cookie banner. Nothing analytical loads until you allow it, and you can change your mind at any time.

Legal claims and compliance

• Meeting tax, accounting and consumer-protection obligations;
• Establishing, exercising or defending legal claims;

Legal basis: legal obligation and legitimate interest.

4. What Is Public on CheekyPixel

A marketplace only works if creators can be found, so some things are public by design:

• A creator's display name, handle, avatar and bio;
• A creator's page, and the designs and products they publish;
• Anything you choose to write into a public profile field.

Your email address, phone number, postal addresses, order history and payout details are never public, and are never shown to other users of the platform.

Buyers are not public. We do not publish names, purchases or profiles of people who order.

5. Who We Share Data With

We do not sell personal data. We share the minimum each job needs, with providers acting on our instructions:

• Stripe — card payments, and Stripe Connect onboarding and payouts for sellers;
• Halkbank ePay — bank card payments made through a payment link;
• Brevo — sending transactional email such as order confirmations, verification codes and password resets, and any newsletter you opted into;
• Microsoft Clarity — website analytics, loaded only after you consent;
• OpenAI — our internal staff assistant runs on OpenAI's API, and order and account details can be processed through it when our team uses it to answer an operational question;
• Print partner studios — with the strict limits described below;
• Couriers and delivery services — the details needed to deliver to you;
• Our hosting and infrastructure providers;
• Public authorities where the law requires it, our professional advisers under a duty of confidence, and a buyer of the business if CheekyPixel is ever sold or merged.

What a print studio can and cannot see

This one deserves to be specific. When a studio is offered your order, it receives the order number, the item, size, colour and quantity, and the artwork file it needs to print. It does not receive your name, your email address or your delivery address — those are stripped out before the job reaches the studio's portal. Studios also never see what you paid.

Sponsors and advertisers

Sponsored banners and partner placements receive daily impression and click totals for their own booking, and nothing else. No identifiers, no profiles, no targeting based on who you are or what you have bought.

6. Cookies and Local Storage

We use very few cookies. Most of what we store lives in your browser's local storage and never reaches our servers on its own:

• Your sign-in session token, so you stay signed in;
• Your shopping cart, so it survives a page reload;
• Your language, currency and shipping-country choices;
• Your cookie preferences;
• A chat session reference, so a support conversation stays connected.

Only this strictly necessary storage is active until you make a choice in the cookie banner. Analytics and third-party scripts load only with your consent, and you can change or withdraw that consent at any time.

Our Cookie Policy has the full detail. Read the Cookie Policy

7. Where Your Data Is Processed

Our website and database run on servers we rent from our hosting provider. Several of the providers listed above operate in the United States or process data globally — Stripe, Microsoft, OpenAI and Brevo among them.

Where data leaves North Macedonia or the European Economic Area, we rely on the safeguards the law provides: an adequacy decision where one exists, or the European Commission's Standard Contractual Clauses. You can ask us for details of the safeguards that apply to a specific transfer.

8. How Long We Keep It

We keep data only as long as it has a purpose:

• Account data — for as long as your account is open, and then until you ask us to delete it;
• Orders, invoices and payment records — for the period tax and accounting law requires us to keep them, which is several years and is not something we can shorten on request;
• Royalty, commission and payout records — the same, for the same reason;
• Designs and uploaded artwork — while the design is live on the platform, and for a limited period afterwards so that reprints and disputes can be handled;
• Support conversations — for a limited period after the conversation closes;
• Marketing consent and mailing lists — until you unsubscribe or withdraw consent;
• Server and security logs — for a short period, unless a log is part of an active investigation;
• Analytics — for the retention period of the analytics provider, described in our Cookie Policy.

After that, data is deleted or irreversibly anonymised. One honest caveat: if you ask us to delete your account, we can remove your profile and contact details, but we must keep the accounting record of any order you already placed.

9. How We Protect It

• Passwords are stored as cryptographic hashes — we cannot read them, and neither can anyone who obtained the database;
• Traffic to and from the site is encrypted in transit;
• Card details are handled by our payment providers and never touch our servers;
• Access to the back office is restricted by role, and production jobs sent to studios are stripped of customer details automatically;
• Uploaded artwork is stored on our own infrastructure, not on a third-party image service.

A small number of trained staff can access accounts, and can sign into an account where that is genuinely needed to reproduce and fix a problem you have reported. This access is limited to people who need it for their work.

No system is perfectly secure. If a breach ever affects your personal data and puts you at risk, we will notify you and the supervisory authority as the law requires.

10. Your Rights

Wherever you are, you can ask us to:

• Confirm what data we hold about you, and give you a copy;
• Correct anything that is wrong or out of date;
• Delete your data, where we are not legally required to keep it;
• Restrict how we use it while a question about it is resolved;
• Object to processing we base on our legitimate interests;
• Send your data to you or to another provider in a portable, machine-readable format;
• Withdraw a consent you gave, without affecting what came before;
• Complain to a data protection authority.

Some of this you can do yourself: change your password, your details and your marketing preferences in your account settings, and adjust cookie choices from the cookie banner at any time.

For everything else — including deleting your account, which has no self-service button yet — email support@cheekypixel.store and we will handle it. We answer within one month, and will tell you if a request needs longer or if we cannot act on it and why. Exercising your rights is free.

If you think we have got it wrong, you can complain to the Agency for Personal Data Protection of the Republic of North Macedonia. If you live in the European Economic Area, you may instead complain to the supervisory authority in your own country. We would rather you came to us first, and we will take it seriously.

11. Children

CheekyPixel is not intended for children. You need to be at least 16 to have an account, and some parts of the platform — selling as a creator, receiving payouts — require you to be 18 and to confirm it.

We do not knowingly collect data from children. If you believe a child has given us personal data, email support@cheekypixel.store and we will delete it.

12. Changes to This Policy

We update this policy when what we do with data changes — a new provider, a new feature, a new legal requirement. The current version is always on this page, with the date it took effect at the top. If a change materially affects your rights, we will tell you directly rather than quietly reposting the page.

13. Contact Us

Questions about this policy, about your data, or a request to exercise any right above:

CheekyPixel
support@cheekypixel.store

Write to us and we will respond. If you need a postal address for a formal notice, ask and we will provide it.