Privacy policy

Last updated: 27 October 2026 1. Controller The Sinulik shop is operated by Now Party OÜ, registration number 16940938, Tallinna mnt 74, Haapsalu, Estonia. Contact: info@sinulik.ee. 2. Data and purposes We process your name, email, phone number, ordered products, quantities, prices, personalisation choices, destination, parcel locker or delivery address, order reference, payment and shipping status to prepare and fulfil your order. The legal basis is taking steps at your request before a contract and performing the contract (GDPR Article 6(1)(b)). The contact form collects your name, email, optional phone number and message to answer your enquiry or prepare a quote. General enquiries and security may rely on our legitimate interests in customer service and protecting the shop (Article 6(1)(f)). Accounting is based on legal obligations (Article 6(1)(c)); resolving claims relies on an obligation or our legitimate interest in defending our rights. Optional analytics is based on consent (Article 6(1)(a)). Required fields have an asterisk. Refusing analytics does not prevent shopping or contacting us. 3. Photos and files Files are saved when uploaded, even if checkout is not completed, and linked to the relevant product when an order is submitted. We use them to make the requested product or test the workflow. They are separate from the public product gallery; customer files in the application are accessible only to the authenticated, authorised shop owner. We do not use customer photos for advertising or product examples without a separate basis. The application does not perform automatic face recognition or send customer files to an AI model. Upload only materials you may use for this purpose, respecting the rights of people pictured and children's legal representatives. Do not upload identity documents or unnecessary sensitive information. 4. Service providers The shop uses ChatGPT Sites and Cloudflare hosting, database and file storage. Platform account information is used to verify the shop owner's access. There are no separate customer accounts. Montonio provides payments, payment-status checks and shipping integration. Payment-related information includes the order reference, amount, currency, payment method and contact information required by the service. Card details are entered in the payment provider's form; the shop's order database does not store card numbers or security codes. Montonio supplies parcel-locker lists. Creating a shipment shares the necessary recipient name, phone, email, destination and parcel information with Montonio and the selected carrier. Estonia offers Omniva, Smartpost, DPD and Unisend. Other destinations use the delivery method agreed for the order. Resend sends order confirmations and contact-form messages. These emails contain the contact and order details necessary for their purpose. Google Workspace provides the shop's email service. Google Analytics receives analytics data only with consent. We do not sell customer data; competent authorities may receive information when required by law. 5. International processing Processing by all providers may not be limited to the European Economic Area. Locations and transfer safeguards depend on provider contracts. Before opening real sales, the owner must verify data-processing agreements, locations and transfer mechanisms. This contractual review has not been confirmed by the shop's technical setup. Ask info@sinulik.ee for details. 6. Browser storage Necessary local storage holds the basket (sinulik-cart-v2) and cookie choices (sinulik-consent). The basket can contain personalisation text and file references. Paid order lines are removed after confirmation; other basket data remains until removed or browser data is cleared. Cookie choices remain until changed or browser data is cleared, with no automatic expiry currently set. Session storage keeps the order reference, receipt access token and payment-attempt information needed to check payments. A local record containing the measurement ID and order reference prevents repeated purchase-event submissions. This storage does not contain card details. The platform may use technical login and security cookies. Clearing browser data does not delete orders or files already submitted to the server; contact us for those requests. 7. Google Analytics GA4 is connected. Google's measurement script loads only after analytics consent. It measures page views, interactions, add-to-cart events, checkout starts and confirmed purchases. The sandbox event sinulik_test_purchase is separate from real purchase events. The shop's purchase event contains the order reference, product IDs and names, quantities, prices, currency and shipping cost. It does not include the customer's name, email, phone, address, personalisation text or files. Google may process cookie identifiers, device and usage data. Enhanced measurement can include scrolling, outbound-link clicks and form-interaction events. Consent may enable cookies beginning with _ga and _ga_. Their duration depends on Google's settings and can be up to two years. Analytics event retention depends on the account settings and still needs owner confirmation. Change or withdraw consent through Cookie preferences in the footer. Withdrawal stops further measurement and removes Analytics cookies accessible to the application; it does not affect the lawfulness of earlier processing. PayPal is not connected. Ordering or submitting the contact form does not subscribe you to marketing emails. 8. Retention Order data is kept as needed to fulfil orders, provide customer service, handle claims and meet legal duties. Accounting source documents are retained for the statutory period, generally seven years from the end of the relevant financial year. Customer-uploaded personalisation photos are deleted within 60 days after the order is fulfilled. A specific photo needed for an ongoing complaint or legal claim is retained only while that need continues. Other design files and unfinished-order uploads are kept only as long as necessary for their purpose. Enquiries are kept as needed to answer them and handle related claims. The owner arranges deletion manually; server-side automatic deletion is not currently implemented. Test data is removed when no longer needed. Deleting photos does not delete order or accounting records retained under legal obligations. Provider log and backup retention depends on their terms. Browser storage is described in section 6. 9. Your rights You may request information and access to your data, correction, and where legally applicable erasure, restriction or portability. You may object to processing based on legitimate interests and withdraw consent. Email info@sinulik.ee with an order reference or enquiry date if available. We may request only the information needed to verify your identity. We normally respond within one month and notify you of a legally permitted extension. You may complain to the Estonian Data Protection Inspectorate (https://www.aki.ee) or seek a judicial remedy. 10. Test mode and changes While the public checkout is marked as a test shop, its payments use Montonio's sandbox. A separately labelled owner control purchase may use live payments. The contact form sends real enquiries to the shop's email. Use sample information when testing wherever possible. We update this policy when purposes or providers change and request separate consent where necessary. Microsoft Clarity With analytics consent, we also use Microsoft Clarity (Microsoft) to analyse website use through click and scroll heatmaps and session replays. Clarity processes technical and interaction data. Its script loads only after consent and on public shop pages. Admin, payment and control-purchase pages are excluded; personalisation fields, uploaded file names, the contact form and basket content are masked. Customer files are not included in recordings. Clarity advertising storage consent is denied. Withdraw consent at any time using cookie preferences in the shop footer. Information about Microsoft processing: https://privacy.microsoft.com/privacystatement. Clarity cookies include _clck and _clsk; withdrawing consent deletes these shop-domain cookies and stops tracking. Meta Pixel With separate advertising consent, we use Meta Pixel (Meta Platforms Ireland Limited) to measure ad results and improve ad relevance. Meta receives page views, product views, add-to-cart, checkout-start and confirmed real-purchase events. Events include the page URL, product IDs, quantities, value and currency; browser requests also carry technical information such as IP address and browser details. Our event code does not send customer names, emails, phone numbers, personalisation text or uploaded files. Automatic event detection is disabled in code. Test and control purchases are excluded from Purchase events. Neither the Meta script nor a tracking image loads before advertising consent. Admin and control-purchase pages are excluded; the payment result page sends only the confirmed real-purchase event, without the receipt access token. Measurement is browser-based; server-side Conversions API is not connected. Withdraw consent using cookie preferences in the footer. Withdrawal stops transmission and deletes shop-domain _fbp and _fbc cookies. Meta may process data outside the European Economic Area. More information: https://www.facebook.com/privacy/policy/. Google Ads With advertising cookie consent, Google Ads measures confirmed purchases using the order total, EUR currency and unique order identifier. This event does not send customer names, email addresses or personalisation content.