Privacy Policy
Privacy Policy
Last Updated: [Insert date when you publish]
This Privacy Policy explains how Once Upon a Wall ("we", "our", "us") collects, uses, and shares your personal information when you visit or make a purchase from onceuponawall.co (the "Site"). Protecting your privacy — and the privacy of the children whose photos you upload — is important to us, and we are committed to handling your data responsibly and transparently.
Information We Collect
Device Information
When you visit the Site, we automatically collect details about your device, such as:
- Your web browser, IP address, and time zone
- Cookies installed on your device
- Pages or products you view, websites or search terms that referred you, and how you interact with the Site
We use the following technologies:
- Cookies: Small data files stored on your device
- Log files: Track actions on the Site (e.g., IP address, browser type, ISP, referring/exit pages, timestamps)
- Web beacons / tags / pixels: Electronic files used to record browsing activity
Order Information
When you make or attempt a purchase, we collect information such as:
- Name, billing/shipping addresses, email, and phone number
- Payment details (e.g., credit card information)
- Order history and preferences
Photo Uploads
To create your personalized portrait, we collect photos that you upload to our Site or send to us via email. These photos may include images of children, family members, or others in your care.
We treat uploaded photos with extra care:
- Photos are stored securely on encrypted servers
- Photos are used only for the purpose of creating the portrait you ordered
- Photos are automatically deleted from our active systems within 30 days after your order is fulfilled
- Photos are never sold, shared with third parties for marketing purposes, or used to train AI models
- We never use uploaded photos in advertising or marketing without your explicit written consent
By uploading a photo, you confirm that you have the right to share that photo with us and that any individuals depicted (or their parents/guardians, in the case of minors) have given you permission to use their image for this purpose.
Personal Information in this Policy means Device Information, Order Information, and Photo Uploads.
How We Use Your Personal Information
We use the information we collect to:
- Process transactions and fulfill your orders
- Create and deliver your custom portrait
- Communicate with you about your purchase, revisions, or inquiries
- Screen for potential fraud or risk
- Provide you with information or advertising about our products and services (with your consent)
- Improve our website experience and services
With your permission, we may also send email or SMS updates about Once Upon a Wall, including promotions, new portrait scenes, and checkout reminders.
SMS & Text Marketing
If you provide your phone number at checkout or via subscription, you agree to receive SMS notifications (such as order updates, abandoned cart reminders, and promotions).
- Message frequency varies but will not exceed 4 per month
- Consent is not a condition of purchase
- Message and data rates may apply
You can unsubscribe at any time by replying STOP to any text message or by using the unsubscribe link in our messages. For support, text HELP or contact us at hello@onceuponawall.co.
Currency Conversion
To provide accurate pricing in your local currency, third parties may process your IP address to determine your location. This information may be stored in a session cookie (temporary, deleted when you close your browser).
Sharing Your Personal Information
We share your Personal Information only with trusted partners who help us provide our services:
- Shopify: Hosts our online store. Read Shopify's Privacy Policy.
- Print and fulfillment partners: We work with print-on-demand and shipping providers (such as Printful or Gelato) to produce and deliver your physical canvas. They receive only the information needed to fulfill your order.
- Our artists: Real artists touch up every portrait before it ships. They receive only the photo and order details needed to complete the work and are bound by confidentiality agreements.
- Google Analytics: Helps us understand customer behavior. Read Google's Privacy Policy or opt out here.
- Email and SMS service providers: Such as Klaviyo or Postscript, used to send you order updates and marketing communications.
We may also share information to comply with legal obligations, respond to lawful requests, or protect our rights.
Behavioural Advertising
We use your information to deliver targeted ads we believe are relevant to you. Learn more at the Network Advertising Initiative.
You can opt out of targeted ads:
Or via the Digital Advertising Alliance.
Refunds & Returns
We value your trust and want you to shop with confidence.
- We offer free unlimited revisions until you're happy with your portrait. Just message us and we'll redo it.
- If you're not satisfied with your finished canvas, you may request a refund within 60 days of receiving your order.
- Refunds are issued back to your original payment method within 5–10 business days.
- Because each portrait is custom-made, returned canvases cannot be resold and are recycled.
- For damaged or defective items, we will replace them at no cost — please send a photo of the damage to hello@onceuponawall.co within 14 days of delivery.
To start a return or revision, contact us at hello@onceuponawall.co with your order number.
Do Not Track
We do not change our data collection practices when a Do Not Track signal is detected from your browser.
Your Rights (European and UK Residents)
If you are located in the EU or UK, you have the right to:
- Access the personal information we hold about you
- Request corrections, updates, or deletion of your information
- Withdraw consent for marketing communications at any time
- Request that we delete uploaded photos at any time
To exercise these rights, please contact us at the details below. Your data may be transferred outside Europe, including to Canada and the U.S., to help us fulfill contracts or pursue business interests.
Your Rights (California Residents)
If you are a California resident, you have additional rights under the CCPA, including the right to know what personal information we collect, the right to delete your personal information, and the right to opt out of the sale of your personal information. We do not sell personal information.
Children's Privacy
Our Site is intended for adult customers (age 18+) purchasing portraits, including portraits of children in their care.
While we create products featuring children's likenesses, we do not knowingly collect personal information directly from children under 16. The adult customer placing the order is responsible for ensuring they have the right to upload any photo of a minor.
If you believe we have inadvertently collected information directly from a child, please contact us immediately and we will delete it.
Data Retention
- Order Information: We retain order records for our business and tax purposes unless and until you request deletion.
- Photo Uploads: Automatically deleted within 30 days after order fulfillment.
- Marketing Data: Retained until you unsubscribe or request deletion.
Changes to This Policy
We may update this Privacy Policy periodically to reflect changes to our practices or for legal, regulatory, or operational reasons. The "Last Updated" date at the top of this page will show the most recent revision.
Contact Us
If you have questions, concerns, or complaints about our privacy practices, please contact us:
Once Upon a Wall Attn: Privacy Compliance Officer [Your business address] Email: hello@onceuponawall.co
A few things to fill in or update before you publish:
- The date at the top — put today's date when you publish
- Your business address — Shopify legally requires a real business address on your site. If you're operating from home, you can use a virtual mailbox service ($10-15/month) like iPostal1 or Anytime Mailbox to keep your home address private. Or use a registered agent address if you have one.
- Email address — I used hello@onceuponawall.co throughout. Set up that email through Google Workspace or your domain provider before publishing this policy. If you prefer support@onceuponawall.co or contact@onceuponawall.co, swap throughout.
- Print partner name — I left "Printful or Gelato" generic. Once you commit to one, name it specifically.
- Email/SMS service provider — Same. Name your actual provider once you've picked one (Klaviyo is the standard for DTC).
Important note on the photo-handling section:
I added stronger language about photo privacy than your sample policy because you're handling images of children, which is genuinely sensitive territory and a real concern your customers will have. Loverse's "Your photo is safe · Deleted in 24hrs" claim is part of why customers trust them with kids' photos. Your policy should match or beat that promise.
The "30 days" retention I used is industry-standard and gives you operational room to handle revision requests. If you want to be more aggressive on privacy as a marketing point, you could shorten to 14 days or even mirror Loverse's "deleted within 24 hours of fulfillment." Just make sure whatever you write here matches what you actually do operationally.
One legal note:
This is a starter privacy policy adapted from your sample. For most early-stage DTC stores, this level of policy is sufficient and matches what 95% of competitors use. Once you're doing meaningful revenue ($100K+) or expanding internationally, it's worth having a real lawyer review it ($300-800 one-time) for jurisdictional compliance. I'm not a lawyer and this isn't legal advice — it's a working draft that should be reviewed by counsel if you want to be fully buttoned up.
Want me to draft your Terms of Service next? That's the other document Shopify expects you to have at launch.