Privacy Notice

1. Who is the data controller

Adriana Ionela Mihai, sole trader / independent artist, Romania. For any privacy question or request, contact the studio through the enquiry form.

2. What data we collect

• Enquiry form: your name, email, optional phone number, and the message you write.
• Purchases & patronage: billing and shipping details are collected and processed by Stripe on our behalf. We receive the order confirmation, amount, and shipping address so we can send you your painting.
• Technical data: minimal server logs (IP address, user-agent, timestamp) kept briefly for security and fraud prevention.

We do not use advertising cookies, cross-site trackers, or sell your data to anyone.

3. Why we use it (legal basis)

• To reply to your enquiry and discuss a possible commission or sale — legal basis: steps taken at your request prior to entering into a contract.
• To process payments and ship a purchased painting — legal basis: performance of a contract.
• To meet Romanian tax, accounting, and consumer-protection obligations — legal basis: legal obligation.
• To protect the site from abuse and fraud — legal basis: legitimate interest.

4. Who we share it with (processors)

• Stripe — payment processing for purchases and patronage. Stripe is the controller for card data.
• Resend — transactional email delivery so your enquiry reaches the studio inbox.
• Lovable Cloud (Supabase infrastructure) — hosting, database, and serverless functions that run the site.
• Shipping carriers — the courier we use to deliver your painting receives your shipping address only.

Some of these providers process data outside Romania, including in the EEA, the UK, and the United States, under GDPR-compliant safeguards (Standard Contractual Clauses).

5. How long we keep it

• Enquiries with no follow-up: up to 24 months, then deleted.
• Commissions and sales records: retained for the period required by Romanian tax law (typically 10 years).
• Server logs: up to 90 days.

6. Your rights under GDPR

You can ask for access to your data, correction, deletion, restriction, portability, or object to processing based on legitimate interest. To exercise any of these rights, write to the studio through the enquiry form. You also have the right to lodge a complaint with the Romanian supervisory authority (ANSPDCP, dataprotection.ro).

7. Children

This site is not directed at children under 16, and we do not knowingly collect their data.

8. Changes to this notice

If we materially change how we handle your data we will update this page and the "last updated" date above.