Privacy

This store is operated by Tony Decay, based in Lima, Peru, and is the controller of the personal data described here. We sell limited-edition, hand-signed and numbered art print sets. For anything in this policy, email contact@tonydecay.com.

When you order, we take your name, email, phone, and shipping address, plus the items and order status. If you message us, we keep that message. If you join the mailing list, we take your email. When you visit, we also count basic technical data (approximate location, browser, device, pages viewed) without cookies and without identifying you. This store does not create customer login accounts or store passwords.

Order details are used to take payment, ship your set, and email you about the order. Mailing-list emails only tell you when a new set is available, and every one has an unsubscribe link. Technical data keeps the site running, blocks bots, and tells us how many people visited. We do not run ads, sell your data, or make automated decisions about you.

Payments are handled by PayPal. You enter your payment details on their systems, not ours. We never see or store your card or bank numbers - we only receive confirmation that you paid and the contact details tied to the order.

Essential cookies keep the site, checkout, and bot protection (Cloudflare Turnstile) working; these always run. We do not use advertising or tracking cookies, and we do not run an ad pixel. For visitor numbers we use Vercel Analytics, which is cookieless and does not build a profile of you or follow you across other sites. That is why you are not asked to accept a cookie banner.

We do not sell your data. It is shared only with the services that run the store, and only so they can do their job: PayPal (payments), Vercel (hosting and cookieless analytics), Supabase (database), Resend (email), and Cloudflare (bot protection). Each acts under its own privacy terms. We may also disclose information if the law requires it.

We are in Peru. The services above are based in the United States and process data on servers outside Peru and your own country. When you order or contact us, your information is transferred to and processed in those locations under those providers' standard data-protection terms.

We keep order records for as long as needed to complete your order and handle any issues, then for as long as tax and accounting law requires. Mailing-list email is kept until you unsubscribe. Visit counts are aggregated and short-lived, and the essential cookies that keep checkout and bot protection working are controlled by your browser and the providers' settings.

You can ask us to show, correct, or delete what we hold, or to stop mailing-list emails (use the unsubscribe link or just reply). Email contact@tonydecay.com; we may ask you to confirm your identity first. In Peru you have rights under Law No. 29733 and can complain to the Autoridad Nacional de Proteccion de Datos Personales. In the EU or UK you have rights under the GDPR and can complain to your local authority.

The site runs over HTTPS and we keep what we collect to a minimum. No system is perfectly secure, but access to order data is limited to us and the providers listed above.

If we change this policy we update the date at the top and note significant changes on this page.

For any privacy request, email contact@tonydecay.com.