Privacy policy

1. Scope

This Policy applies to personal information PosterBloom processes through our storefront, checkout-related systems, order support, fulfillment workflow, marketing emails, and analytics. It does not govern a third party's independent website or service. When you use Stripe's hosted checkout or follow a third-party link, that provider's privacy notice also applies to information it collects directly.

2. Information we collect

Stripe collects full payment-card details through its hosted checkout. PosterBloom does not receive or store your full card number or card security code. We do not intentionally collect government identification, biometric data, precise geolocation, health information, or other special-category data through the storefront. Please do not send it to us.

3. How we use personal information

We use personal information to:

• operate the site, cart, checkout, and order-status experience;
• process payment, tax, discounts, refunds, and fraud checks;
• produce, route, pack, ship, track, replace, and support orders;
• send transactional messages, including order, shipment, delivery, return, and support updates;
• send marketing or cart-related messages consistent with your choices and applicable law;
• publish and moderate reviews or photos you submit;
• understand site performance and customer interactions and improve products, merchandising, and the shopping experience;
• detect, investigate, and prevent fraud, abuse, security incidents, and technical problems;
• comply with tax, accounting, consumer-protection, recordkeeping, and other legal obligations; and
• establish, exercise, or defend legal claims and enforce our terms.

We may aggregate or de-identify information and use it for lawful business purposes. We do not attempt to re-identify information that we maintain as de-identified.

4. Legal bases for EEA, UK, and similar laws

Where a law requires a legal basis, we rely on:

• Contract: to take steps you request before purchase and to process, fulfill, deliver, and support your order.
• Legal obligations: for tax, accounting, consumer rights, fraud prevention, and lawful government requests.
• Legitimate interests: to secure and operate the site, prevent misuse, understand performance, improve our business, and defend claims, where those interests are not overridden by your rights.
• Consent: when you choose to receive marketing or when we otherwise ask for consent. You may withdraw consent prospectively at any time.

5. Cookies, local storage, and analytics

We use browser storage and similar technologies to keep your cart, secure and operate the site, remember choices, measure site use, and diagnose problems. The cart is stored locally in your browser. If you delete or block that storage, saved cart items may disappear or parts of the storefront may not work as intended.

PostHog helps us measure page views, page exits, and product or checkout interactions and currently uses cookies and browser storage. Vercel provides cookie-free web analytics plus hosting and performance information. Both may process device, network, and interaction data as described in their notices. We do not currently use third-party advertising pixels or cross-site behavioral advertising on PosterBloom.

You can limit cookies and storage through your browser or a content blocker. Because there is no uniform industry standard for browser “Do Not Track” signals, PosterBloom does not currently respond to them. See Your choices and rights for other controls.

6. How we disclose personal information

We disclose information only as reasonably necessary:

• To service providers and fulfillment recipients that operate checkout, production, delivery, hosting, storage, databases, email, analytics, security, and support.
• To independent controllers such as payment networks, banks, carriers, customs authorities, tax authorities, and professional advisers for their own legal or operational responsibilities.
• For legal and safety reasons when we believe disclosure is required by law or reasonably necessary to protect rights, safety, security, or prevent fraud.
• In a business transaction such as a financing, merger, acquisition, reorganization, bankruptcy, or sale of assets, subject to appropriate safeguards.
• At your direction or with your consent.

If you are an order recipient rather than the buyer, the buyer may receive order and delivery information about the shipment.

7. Key service providers

The providers below support the current storefront. We use them for the roles described below, and some may independently process information under their own legal obligations.

• Stripe: hosted checkout, payment processing, fraud screening, and tax; receives contact, address, order, payment, and transaction data.
• Prodigi: print production, fulfillment, quality control, reprints, and shipping coordination; receives recipient name, delivery address, email, phone if supplied, order and product configuration, artwork files, and shipment information. Prodigi may pass limited fulfillment data to its print facilities and logistics partners.
• Vercel: site hosting, security, performance, and web analytics; may process request, device, IP-address, and usage data.
• PostHog: product and site analytics; may process browser, device, network, page, referral, and interaction data.
• Turso: database infrastructure for order, contact, subscriber, fulfillment, review, and operational records.
• Cloudflare: object storage, media delivery, network, and security services; may process stored files and request metadata.
• Resend: transactional and marketing email delivery; receives email addresses, message contents, delivery status, and engagement data.
• Axiom: application and platform logging, monitoring, and security diagnostics; may receive request paths, order or provider identifiers, errors, and other metadata included in our logs.

This list may change as our systems evolve. Categories of disclosure and the purposes described in this Policy will continue to apply.

8. No sale, sharing for ads, or profiling

PosterBloom does not sell or rent personal information. We do not share personal information for cross-context behavioral advertising, use it for targeted advertising, or make decisions that produce legal or similarly significant effects through automated profiling.

Global Privacy Control signals are designed to communicate certain sale, sharing, and targeted-advertising opt-outs. Because we do not engage in those practices, there is no separate sale or sharing setting to apply today. If our practices change, we will update this Policy and honor legally valid signals where required.

9. International processing and transfers

PosterBloom and its providers may process information in the United States, United Kingdom, European Economic Area, Australia, and other countries where providers, print facilities, or carriers operate. Those countries may have privacy laws different from the laws where you live. When required, providers use recognized transfer mechanisms such as adequacy decisions, standard contractual clauses, or the UK addendum or international data transfer agreement.

10. How long we keep information

We retain personal information only as long as reasonably necessary for the purpose collected and for legal, tax, accounting, warranty, fraud-prevention, security, dispute, and enforcement needs. The period varies by record:

• order, payment, tax, refund, fulfillment, and support records are kept for customer service and required business and legal records;
• marketing subscription data is kept until you unsubscribe or it is no longer relevant, while a limited suppression record may be kept so we honor the opt-out;
• cart snapshots are kept while reasonably useful for the shopping and related email flow and are then deleted or overwritten;
• reviews may remain published until removed or no longer needed, subject to legal retention needs;
• analytics and logs are kept according to configured provider retention periods and our operational or security needs; and
• backups are deleted or overwritten on normal backup cycles.

Prodigi retains production artwork and fulfillment records for the time reasonably required for manufacturing, quality control, reprints, support, tax, disputes, and compliance, then deletes or restricts them under its retention processes.

11. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information, including access controls, encrypted network transmission, restricted secrets, signed or secret-protected order links and webhooks, logging, and established service providers. No transmission or storage system is completely secure, so we cannot guarantee absolute security.

Order-status and unsubscribe links may grant access without a password. Do not forward them to someone you do not trust. If you believe information or a link has been compromised, contact us.

12. Your choices and privacy rights

You can unsubscribe from marketing through the link in any marketing email. We may still send non-promotional messages about an order, return, security issue, or direct support request. You can clear or block browser storage using browser settings, but doing so may clear your cart.

Depending on where you live and subject to legal exceptions, you may have the right to request access, a copy, correction, deletion, or restriction of personal information; object to certain processing; withdraw consent; and receive portable data. You may also have a right to appeal our response and to use an authorized agent.

Email hello@posterbloom.store with the subject “Privacy request.” Describe the request and the email address or order number involved. We may ask for information reasonably necessary to verify your identity, authority, and the scope of the request. We will not discriminate against you for exercising a privacy right. We may retain information where an exception applies, including to complete an order, maintain tax or transaction records, prevent fraud, honor an opt-out, or defend a legal claim.

13. Regional disclosures

14. Children's privacy

PosterBloom is a general-audience shopping service and is not directed to children under 16. We do not knowingly collect personal information from a child under 13 without legally required parental consent. If you believe a child has provided personal information improperly, contact us and we will investigate and delete it where required.

15. Changes and contact

We may update this Policy as our practices or legal obligations change. We will post the updated version here and revise the date above. If a change is material, we will provide additional notice when appropriate.

For purchase and website terms, see our Terms of Service.