Privacy Policy

1. Who is responsible

Paintacles is responsible for your personal information and decides how it is used.

Our address is No 7 Ajigbona Street, Modakeke, Osun 220266, Nigeria.

2. What we collect

What we collect depends on how you use the site:

• Account details: your name, email address and password (kept in a protected form, so we cannot read it), and, if you choose to add them, a phone number and your birthday month.
• Order details: the items you buy, your delivery and billing addresses, the currency and amounts, the discount codes you use, delivery and tracking information, and your order history and invoices.
• Payment details: card payments are handled by our payment provider, Flutterwave. We do not store your full card number or security code. If you save a card, we keep a token that lets you pay with it again and its last four digits.
• Gift details: if you send a gift, the recipient's name and email address, and your message.
• Things you add: your wishlist, the reviews you write, your saved addresses and your email preferences.
• Messages: what you write to us and what we reply.
• Technical information: your IP address, browser and device type, the pages you view and when, and reports of errors, collected when you use the site.

3. How we use it, and why

We use your information to:

• create and secure your account and keep you signed in
• take payment, make and deliver your order, and keep you updated about it
• send you emails about your orders and, if you opt in, news and offers
• send you a reward in your birthday month, if you gave us that month
• show and moderate reviews
• prevent fraud and misuse and keep the site secure
• understand how the site is used and fix problems
• meet our legal, tax and accounting duties

Where the law asks for a legal basis, we rely on: carrying out our contract with you (your account, orders, payment and delivery); our legitimate interests (running and securing the shop, preventing fraud, understanding how the site is used and fixing errors); your consent (marketing emails and other optional features, which you can withdraw at any time); and legal obligations (tax and accounting records).

4. Emails

We send emails that you need, such as order confirmations, receipts, refund decisions, security messages and the confirmation of your email address. These are always sent.

Other emails can be switched off: shipping and delivery updates, review requests and reminders, and wishlist alerts are on by default, and marketing emails (news, promotions, rewards and cart reminders) are off until you opt in. Every optional email has an unsubscribe link, and you can change your choices in your account at any time.

Our emails are sent for us by our email service provider, Brevo.

5. Who we share it with

We do not sell your personal information. We share it only with:

• Our print and fulfilment partners, and the carriers they use, who need your name, delivery address, phone number if you gave one, the items ordered and, for a gift, the message, to make and deliver your order.
• Our payment provider, Flutterwave, which processes card payments and may run fraud and bank-authentication checks.
• Our email service provider, Brevo, which sends our emails.
• Hosting and infrastructure providers, including Cloudflare and Vercel, which run this website and our servers.
• Error-monitoring and analytics providers, Sentry, Cloudflare Web Analytics and Umami, described below.
• Public authorities and professional advisers where the law requires it or to protect our rights, and a buyer if our business is ever sold. Your information would stay protected by this policy.

6. Cookies and similar storage

We use a small number of cookies and similar storage that the site needs to work:

• Sign-in cookies (pt_access and pt_refresh) keep you signed in. Scripts on the page cannot read them.
• A currency cookie (pt_currency) remembers the currency you chose.
• Local storage on your device keeps your cart, your wishlist and your recent searches. Session storage remembers an order in progress and ends when you close the tab.

You can clear these in your browser settings, but you will then be signed out and your saved cart, wishlist and searches on that device will be lost. We do not use advertising cookies.

7. Analytics and error reports

We measure visits with Cloudflare Web Analytics and Umami. Both work without cookies. Umami does not keep the query string of a page address and respects your browser's Do Not Track setting.

On some browsing pages (the shop, collections, product pages, gift pages and our story) we may record anonymous clicks, scrolling and movement to see where people get stuck. Personal details on the page are hidden, and we never record the cart, checkout, sign-in or account pages.

When the site hits a problem, Sentry receives a technical report: the page address, browser and device type, your IP address and what went wrong. We configure it to leave out form contents, cookies and sign-in tokens, and we do not record sessions.

8. How long we keep it

• Your account details: until you delete your account.
• Order, payment and invoice records: for as long as tax and accounting law requires, even after you delete your account. Once an account is deleted these records are kept without your contact details.
• A gift recipient's email address: it is stored encrypted and removed from the order once the recipient has been sent their one email, or straight away if the order is cancelled or refunded, or after 90 days at the latest. A record of it is then kept encrypted for 90 more days and deleted. Your gift message and the recipient's name are erased if you delete your account.
• Reviews: kept after you delete your account, shown under the name “Verified buyer”.
• Error reports and visit statistics: for a limited time, set by the provider.

9. Your choices and rights

You can do these yourself, at any time, in your account:

• download everything we keep about you
• delete your account
• change your details, addresses and saved cards
• switch optional emails on or off
• sign out of other devices

Depending on where you live, you may have further rights, such as to ask us to correct or restrict how we use your information, to object to it, to have it moved to another service, to withdraw consent, or to complain to your data protection authority. To use one of these, contact us. We will respond within the time the law allows.

10. International transfers

We and the providers named above work in several countries, so your information may be processed outside the country where you live, including in countries whose data protection rules differ. Where the law requires it, we use safeguards such as standard contractual clauses.

11. Security

We protect your information with encrypted connections, restricted access, and by keeping sign-in tokens out of reach of scripts on the page. Gift details are stored encrypted. No system is perfectly secure, so please use a strong password and tell us if you suspect a problem with your account.

12. Children

This site is not meant for children under 16 and we do not knowingly collect their information. If you think a child has given us information, contact us and we will delete it.

13. Changes to this policy

We may update this policy. The date at the top shows when it last changed. If a change is important, we will tell you by email or on the site.

14. Contact

Questions about your privacy, or a request about your information? Use the details on our contact page and tell us it is a privacy request.