Privacy

This store is operated by Tony Decay, based in Lima, Peru, and is the controller of the personal data described here. We sell limited-edition, hand-signed and numbered art print sets. For anything in this policy, email contact@tonydecay.com.

When you order, we take your name, email, phone, and shipping address, plus the items and order status. If you message us, we keep that message. If you join the mailing list, we take your email. When you visit, we also collect basic technical data (IP address, browser, device, pages viewed) through cookies. This store does not create customer login accounts or store passwords.

Order details are used to take payment, ship your set, and email you about the order. Mailing-list emails only tell you when a new set is available, and every one has an unsubscribe link. Technical data keeps the site running, blocks bots, and measures how our ads perform. We do not sell your data or make automated decisions about you.

Payments are handled by PayPal. You enter your payment details on their systems, not ours. We never see or store your card or bank numbers - we only receive confirmation that you paid and the contact details tied to the order.

Essential cookies keep the site, checkout, and bot protection (Cloudflare Turnstile) working; these always run. For advertising, the Meta (Facebook) Pixel is off until you accept it in the cookie banner. If you decline, it never loads. When you accept, it sets cookies that link your visit and purchase to our ads; you can withdraw by clearing cookies in your browser or using a tracking blocker at any time, and the store works either way.

We do not sell your data. It is shared only with the services that run the store, and only so they can do their job: PayPal (payments), Vercel (hosting), Supabase (database), Resend (email), Cloudflare (bot protection), and Meta (ad measurement). Each acts under its own privacy terms. We may also disclose information if the law requires it.

We are in Peru. The services above are based in the United States and process data on servers outside Peru and your own country. When you order or contact us, your information is transferred to and processed in those locations under those providers' standard data-protection terms.

We keep order records for as long as needed to complete your order and handle any issues, then for as long as tax and accounting law requires. Mailing-list email is kept until you unsubscribe. Cookie data is short-lived and controlled by your browser and the providers' settings.

You can ask us to show, correct, or delete what we hold, or to stop mailing-list emails (use the unsubscribe link or just reply). Email contact@tonydecay.com; we may ask you to confirm your identity first. In Peru you have rights under Law No. 29733 and can complain to the Autoridad Nacional de Proteccion de Datos Personales. In the EU or UK you have rights under the GDPR and can complain to your local authority.

The site runs over HTTPS and we keep what we collect to a minimum. No system is perfectly secure, but access to order data is limited to us and the providers listed above.

If we change this policy we update the date at the top and note significant changes on this page.

For any privacy request, email contact@tonydecay.com.