short version: nothing measures you here until you say it can, there's no account to sign into, and the only personal details you hand over are at checkout, which happens on shopify. if you make a pet portrait, you also give us a photo of your pet.
your bag. when you add a print, the item, size and quantity are saved in your browser’s local storage under the key “edenandco-cart-v1”. it never leaves your device and we never see it — it exists so your bag survives a refresh. clear your browser data and it’s gone.
your answer about tracking, under “edenandco-consent-v1”, so we don’t ask again on every page. it records a yes or a no and nothing else.
one cookie, “eden-consent-mode”, which holds the word “opt-in” or “opt-out”. it is set from the country your request arrives from and decides whether we have to ask you before anything loads. it identifies a rule, not a person — everyone in the same region gets the same value.
we run ads on facebook and instagram, and we want to know which of them actually bring people here rather than guessing. that is what the meta pixel does: it reports that a page was viewed, a product was looked at, something was added to a bag, or a checkout was started, and it sets cookies in your browser so meta can connect those actions to an ad you saw.
if you are in the eu, the eea, the uk or switzerland, none of it loads until you accept. no script is requested, no cookie is set, nothing is sent — declining means the file is never fetched in the first place, not that it runs quietly. elsewhere it loads by default and you can still decline. the shop works exactly the same either way.
shopify’s own analytics — visits, sessions, which pages get looked at — follows the same answer.
meta processes what the pixel sends under its own terms, as a controller in its own right, and may use it to build advertising profiles. you can see and disconnect what it has under “off-facebook activity” in your facebook settings. if you would rather change your mind here, clear this site’s data in your browser and we’ll ask again.
clicking through to checkout hands you to shopify, which runs the store at shop.edenandco.shop. from that point shopify collects what it needs to fulfil the order — name, delivery address, email, and payment details — and processes it as a data processor under its own privacy terms.
payment card details go to shopify’s payment processor. they never touch this site and we never store them.
if you make a pet portrait, you upload a photo of your pet. we store it privately on our hosting provider (vercel) and send it to openai, whose image model draws the portrait from it. openai processes the photo on our behalf to produce the picture. please upload photos of pets only, not of people.
the photo and the portraits made from it are deleted after 7 days if you don’t order. if you order, we keep the chosen portrait so we can check it, print it and sort out any problem with your order.
the portrait studio sets one cookie that ties your previews to your browser, so they are still there when you reach your bag. it holds a random id and nothing about you. to stop automated abuse we run a cloudflare turnstile check before drawing, which means your browser talks to cloudflare, and we count portraits per day against a scrambled form of your ip address that we cannot turn back into the address.
product photography is served from shopify’s cdn, so loading a product page makes a request to shopify.
typefaces are loaded from google fonts, which means your browser requests them from fonts.googleapis.com and fonts.gstatic.com. google receives the request, including your ip address, as part of serving the file. this happens regardless of your tracking answer, which is a wrinkle we intend to remove by hosting the files ourselves.
if you accept measurement, connect.facebook.net is added to that list — that is where the pixel is loaded from.
depending on where you live you may have the right to ask what personal data is held about you, to have it corrected, to have it deleted, and to object to its processing. because order data lives with shopify, most requests are answered from there — write to us and we’ll route it.
consent is not a one-way door. whatever you chose, you can change it by clearing this site’s data in your browser, and you will be asked again on your next visit.
if what we collect changes, this page changes first. the date at the bottom is the last time it was revised.