Privacy Notice
What we know about you, why, and for how long.
Version 2026-10-12.2 · in force since 12 October 2026
We are a very small shop and we would like to keep knowing very little about you. This notice says exactly what we hold, why we hold it, and when it goes away.
There is no advertising tracker on this site. No Google Analytics, no Meta pixel, no advertising cookie, nothing that follows you anywhere else. The one analytics on the site is IndieBob, which our own family makes: it counts pages, not people, and sets no cookie. That is why there is no cookie banner: there is nothing to consent to.
Who is responsible
Surfzone OÜ, registry code 14052124, Toome pst 51a, 10913 Tallinn, Estonia.
Write to [email protected] about anything in this notice. A person reads it, and that person is Priit Pärna.
If you think we have got this wrong, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn — aki.ee, or to the authority in the EU country you live in.
What we hold, and why
If you are just looking and drawing
| What | Why | How long |
|---|---|---|
A cookie called lu_v — a random id, nothing more | So the machine knows which drawings are yours and can keep your place in the queue | 1 year |
A cookie called lu_ref, when you open a friend's link | So the discount reaches your checkout | 30 days |
| A page view, the page you came from and a coarse device type, sent to IndieBob — our own analytics, made by the same family that makes this shop | So we can see which pages people reach and where they drop off, in counts. It keeps a random id in your browser's local storage, not a cookie, and knows no name | 12 months |
| Your prompt, or the words you asked us to set | It is what the machine draws. A prompt typed in a language other than English also helps the shop learn to read that language better (see below) | While the shop runs, or until you ask us to delete it |
| The drawings the machine made for you | So you can come back to them and buy one, and so the people you send a link to can order it too | While the shop runs, or until you ask us to delete it |
| A photograph you upload | To draw from it | 30 days, then it is deleted automatically |
| Your IP address, hashed with a salt that changes daily | To stop one person overwhelming the machine. We cannot turn it back into an address, and we never store the real one | 24 hours |
| That a drawing was refused, and why | So we can see what the shop is turning away | 12 months |
| The name of the AI assistant you drew from (ChatGPT, Claude, Grok, Gemini…), when you used one instead of this site | So we know which assistants people come from, and which of their links led to an order | With the drawing; with an order, 7 years |
The lu_v cookie is strictly functional. Without it the queue cannot tell your drawing from anybody else's. It holds no name, no email and no history of where else you have been.
A refused photograph is deleted immediately. If our check says we will not print it, the file is removed there and then; all that is kept is the fact that something was refused and the score that refused it. We do not look at it and we do not keep it.
An accepted photograph is deleted after 30 days. We need it only long enough to draw from it and for you to come back and order. After that the file goes, automatically, whether or not you ordered — the drawing is what gets printed, not the photograph.
The legal basis for all of the above is our legitimate interest (Article 6(1)(f) GDPR) in running a shop that works and is not abused.
If you order a shirt
| What | Why | How long |
|---|---|---|
| Your name, email, phone, delivery address | To make the shirt and get it to you. The courier rings the phone | 7 years |
| What you ordered, what you paid, and when | To fulfil the contract, and because tax law requires it | 7 years |
| The drawing that was printed | It is the record of what we sold you and of what was printed for you | 7 years |
| Every step your order went through | So we can answer honestly when you ask what happened | 7 years |
| Which version of the Terms of Sale you agreed to | Because the law puts the burden on us to prove we told you | 7 years |
| Whether your order came through a friend's link, and the code a friend's link earned | To give the friend's discount, to recognise a first order, and to email the person who shared the link their code — the email address it goes to is the one on their own order | 7 years, with the order |
| A code you typed, and what it took off | To honour it once and only once | 7 years, with the order |
The legal basis is the contract between us (Article 6(1)(b) GDPR) and, for keeping it as long as we do, our legal obligation (Article 6(1)(c)) — Estonian accounting law requires seven years for the documents behind a sale.
We do not send marketing email. If we ever want to, we will ask you first.
Who else sees it
We hand over the least we can, to the fewest people we can.
- Stripe takes the payment. Your card details go straight to Stripe and never touch our server — we only learn that a payment succeeded. Stripe's privacy policy.
- Printify and its print partner print the shirt and post it. They get your name, address, phone, email and the print file. They cannot get anything else, and they may not use it for anything but your parcel. Printify's privacy policy.
- DigitalOcean hosts the database and stores the drawings, in Frankfurt, Germany.
- Google is asked two narrow questions: whether a delivery address it recognises looks right, and — only when our own check on this machine cannot decide — whether a photograph is safe to print. Most photographs are never sent anywhere.
- IndieBob, which our own family makes, carries the support chat: when you write to us through the round button in the corner, what you write and anything you choose to tell us in it goes to IndieBob so that we can read and answer it. Nothing goes there until you open the chat and write.
- The AI assistant you use, if you make a shirt through ChatGPT, Claude, Grok, Gemini or another assistant instead of on this site. Your words, and any photo or picture you give it — or one it made for you — pass through that assistant's company first, under its own terms and privacy policy, which are between you and them. We receive from it only what it sends for the drawing: the words, the picture, and the assistant's name. We treat them exactly as if you had typed or uploaded them here, and send back only the drawing, a picture of the shirt and the link to order it. The order, your address and the payment happen on this site, never in the chat.
- Anthropic, with its AI Claude, reads the words of prompts typed in a language other than English, to improve how the shop understands what people ask for — slang, a name, a word with two meanings. They go through our own system (Surfoda, which the same family runs), once a night, as the words alone: no name, no email, no address, no photograph and no cookie id go with them, and nothing about who typed them. Our own system keeps them for at most 30 days; what the shop keeps afterwards is what it learned about the language. Anthropic handles them under its own privacy policy. Our legitimate interest (Article 6(1)(f) GDPR) is a shop that reads your request the way you meant it.
Everything else runs on our own machine in Estonia. The drawing itself is made here, on our own hardware. We do not send your prompt to OpenAI, Midjourney or anyone else to be drawn, and Anthropic gets only what is described above. If you chose to make your shirt through an assistant, your words reached that assistant's company before they reached us — that is your choice, and theirs to look after.
We do not sell your details, and we never will. There is no list.
Where it lives
Inside the European Union — Estonia and Germany.
Stripe, Printify and Anthropic may process some of it outside the EU. Where they do, it is covered by the European Commission's Standard Contractual Clauses or an adequacy decision.
What you can ask for
Under the GDPR you may ask us at any time to:
- show you everything we hold about you;
- correct anything that is wrong;
- delete it — and we will, unless tax law makes us keep an order record, in which case we say so and tell you when it goes;
- hand it over in a form you can take elsewhere;
- stop using it for something, or object to our legitimate interest.
Email [email protected]. We answer within a month, usually the same week, and it costs nothing.
If you just want to be forgotten as a visitor: clear the lu_v cookie in your browser and everything tied to it becomes an orphan we cannot connect to you.
Children
The shop is not for children and we do not knowingly hold a child's details. If you think we have, write and we will delete them.
Changes
If this notice changes, the new version appears here with its date at the top. If a change matters to you — a new company getting your details, a new reason for holding them — we will say so plainly rather than quietly swapping the page.
The Terms of Sale are a separate document: Terms of Sale.