Privacy Policy
artpint · Last updated: 17 August 2026 · Effective immediately
1. Data Controller
The data controller responsible for your personal information is:
- Legal entity: PrintaCraft Studio (sole proprietor / individual)
- Trading name: artpint
- Country of operation: People's Republic of China
- Privacy contact email: privacy@artpint.com
- Data Protection Officer (DPO): Not applicable — the volume and nature of data processed do not require the appointment of a DPO.
2. Personal Information We Collect
2.1 Information you provide to us
- Order information: email address used at checkout, product(s) purchased, transaction amount and currency. (Full card data is collected and held by our payment processor and never reaches our servers.)
- Support communications: emails you send us, including any information you choose to share in support requests.
2.2 Information collected automatically
- Device & network: IP address, user-agent string, referrer, language and timezone.
- Usage data: pages viewed, products viewed, download token validation timestamps.
- Server logs: request time, status code, error logs (retained for 90 days, then deleted).
3. How We Use Personal Information
| Purpose | Legal basis |
|---|---|
| Delivering the product and download link | Contract performance |
| Processing payment and preventing fraud | Contract performance / legal obligation |
| Responding to support, billing and refund requests | Contract performance / legitimate interest |
| Service notifications (security incidents, policy updates) | Legitimate interest / legal obligation |
| Aggregated, non-identifying analytics | Legitimate interest |
| Tax and accounting record-keeping | Legal obligation |
We do not use your personal information for marketing newsletters. If we ever add optional marketing communications, we will ask for your explicit consent first.
4. Cookies and Tracking
| Type | Purpose | Can you disable? |
|---|---|---|
| Strictly necessary | Session integrity, security, basic store functionality | No |
| Analytics (Cloudflare Web Analytics) | Anonymous traffic measurement | Yes (via browser Do-Not-Track or browser settings) |
| Marketing | Not used | N/A |
We use Cloudflare Web Analytics, which does not set cookies or fingerprint individual visitors. See Cloudflare's privacy policy for details.
5. Sharing and Disclosure
We do not sell your personal information. We share personal information only with the following categories of recipients, all bound by confidentiality obligations:
- Payment processor — Waffo Pancake (PCI-DSS compliant): receives order amount and tax identifiers; card numbers are processed and held exclusively by Waffo Pancake and are not stored on our servers.
- Cloud hosting & storage: the website is hosted on a Tencent Cloud CVM in Malaysia; product ZIP files are stored on Cloudflare R2. These providers process data on our behalf under their respective privacy and security terms.
- Email delivery provider: transactional messages (order confirmation, download link) are sent through standard SMTP infrastructure.
- Legal & regulatory: where required by law, court order or competent authority.
- Business transfers: in the event of a merger, acquisition or asset sale, with prior notice and equivalent protection guarantees.
- With your consent: for any other purpose you authorize.
6. International Data Transfers
Because our website is hosted in Malaysia and our payment processor may process data in multiple regions (including the EU, US and Asia-Pacific), your personal information may be transferred across borders. We rely on the following safeguards:
- EU Standard Contractual Clauses (SCCs) with processors where applicable.
- Transfer only to recipients that maintain adequate data-protection standards.
- Cloudflare R2 stores product files in the region selected by Cloudflare's account configuration.
7. Data Security
- Transport encryption: TLS / HTTPS on all pages and APIs.
- Server hardening: SSH public-key only, ufw firewall, fail2ban, automatic security updates.
- Application security: unguessable random download tokens, webhook signature verification, parameterized SQL, hotlink protection on /static, robots.txt blocking /admin /download /webhook.
- Access control: principle of least privilege; only the operator account can manage products, view orders and access Cloudflare R2.
In the event of a personal-data breach affecting your rights, we will notify you and the competent supervisory authority within 72 hours of becoming aware of it, in accordance with applicable law.
8. Data Retention
| Data type | Retention period | After expiry |
|---|---|---|
| Order record (email, product, amount) | 7 years (tax / accounting requirement) | Securely deleted |
| Download token & counter | Until download limit reached or 7 days after issue | Marked expired |
| Server access logs | 90 days | Securely deleted |
| Support emails | 2 years after last contact | Securely deleted |
| Security / audit logs | 12 months | Securely deleted |
9. Your Rights
Depending on your jurisdiction (including GDPR / UK GDPR, CCPA/CPRA, PIPL), you have some or all of the following rights. To exercise any right, email privacy@artpint.com — we will respond within 30 calendar days.
- Right to be informed — what we collect and why (this policy).
- Right of access — a copy of the personal information we hold about you.
- Right to rectification — correction of inaccurate or incomplete data.
- Right to erasure ("right to be forgotten") — deletion where the legal basis no longer applies.
- Right to restriction of processing — pause processing while a dispute is resolved.
- Right to data portability — receive your data in a machine-readable format.
- Right to object — object to processing based on legitimate interest or for marketing.
- Right to withdraw consent — where processing is based on consent.
- Right to lodge a complaint — with your local data-protection authority.
10. Marketing Communications
We do not currently send marketing newsletters. If you subscribed to a third-party service that forwards promotional material on our behalf and no longer wish to receive it, unsubscribe directly from that service. Transactional messages (order confirmation, download link, security notices) are not marketing and cannot be opted out of while your account is active.
11. Children's Privacy
The Service is intended for users aged 18 and over. While our products are often used by parents buying for younger children, we do not knowingly collect personal information directly from children under 18. If you believe a child has provided personal information to us, contact privacy@artpint.com and we will delete it.
12. Third-Party Links & Services
The website may link to third-party sites (for example, waffo.ai checkout). This Policy applies only to information we collect directly. We are not responsible for the privacy practices of third parties — please review their policies before providing any personal information.
13. Changes to this Policy
We may update this Policy from time to time. Material changes will be notified at least 15 days in advance via the website and and ( where available ) by email, and the "Last updated" date at the top of this page will be revised. Continued use after the effective date constitutes acceptance.
14. Contact Us
- Privacy email: privacy@artpint.com
- General support: support@artpint.com
- Legal entity: PrintaCraft Studio (trading as artpint)
- Website: https://artpint.com
This Privacy Policy is provided for transparency. It does not constitute legal advice. Where your local law provides additional protections, those protections apply in addition to this Policy.