Privacy policy

§1 Who is responsible

The controller is Aislopica OÜ, Pihlaka tn 2, Jüri alevik, Rae vald, Harju maakond, 75301, Estonia, registry code 17584979.

Write to baldrick@lousydeal.com about anything in this document and a person will read it.

§2 Cookies, and what is recorded when you visit

Three essential cookies can be set under this site's own domain. One is ours and two are Stripe's, and the two are set only if you go to the payment page.

Ours is called lousydeal_cart_id. It holds an opaque identifier for your basket and nothing else, and it ends when you close your browser. Without it the cart and the checkout have no way to find what you put in them.

Stripe's are called __stripe_mid and __stripe_sid. They are set by Stripe's script under this site's own domain, and they identify the browser you are paying from so that Stripe can tell an ordinary payment from a fraudulent one. __stripe_sid lasts 30 minutes. __stripe_mid lasts a year.

We do not ask you to consent to any of the three. For ours that is straightforward: a basket that cannot be found is not a shop. For Stripe's two we take the view that identifying the device is part of accepting a card payment safely rather than something separate we do to you, and they are set only when you reach the page where a payment happens. If you never go there, they are never set.

Google Analytics and Meta Pixel are optional measurement tools. They load only after you agree in the analytics choice below the footer. We send fixed funnel events, route categories, product handles, currency and amounts. We do not send the address or title of the page you are reading, URL queries, certificate serials, form entries, customer or order identifiers, or your words to Baldrick. The tools run in an isolated measurement frame with its own fixed page identity and no referring page address.

The measurement frame cannot read this site's cookies or browser storage, and it sets no first-party analytics cookies. Google is configured with analytics and advertising storage disabled. Vendors still receive your network address and browser/device information when your browser contacts them, and may generate their own measurement identifiers. Your browser controls cookies on connections to vendor domains; those vendors' privacy notices describe their own use and retention. Optional measurement is not anonymous merely because we omit customer details.

Refusing keeps the tools off. Stop analytics destroys the measurement frame, discards events waiting there and stops future collection from that frame; it cannot recall requests already sent or delete data the vendors already received. The one preference this site stores is lousydeal.analytics-consent.v1; it says only whether you agreed or refused. It has no automatic expiry: it remains until you change your choice, clear this site's browser storage, or your browser removes it. No interaction from before consent is saved for later replay.

No error reporter, third-party font or content delivery network is used. The payment page loads Stripe, because that is what taking a card payment consists of; apart from Stripe and the optional Google and Meta tools you chose, this site is rendered on our own server and fetches nothing from anywhere else.

Printful, which §5 describes, is not an exception to that. Your browser never contacts it. Everything that goes to Printful goes from our own server, so it sets nothing on your machine and sees nothing of you beyond what we send it.

Our own services record a line for each request they handle: what was asked for, whether it worked, and how long it took. Those lines do not carry your address. The shop's interior is reached only through this site's own server, so the address in them is that server's, and it is the same for everyone. They are kept for 30 days and then discarded, and they are not sent to anyone.

Your own address is seen by Cloudflare, which is how this site reaches you at all. §5 says what that means.

§3 When you buy something

Our own code asks you for four things: your email address, the country you are in, the consent described in Refunds and Withdrawal, and — optionally — the two lines that go on the certificate itself. If your order contains something that has to be posted, it asks for a fifth: where to send it.

The two certificate lines are a name and a dedication, both optional and **both public**: they are printed on a certificate anybody with its address can read, which the checkout tells you before you type them. They are the one thing here you give us deliberately for publication, and leaving them blank prints “the bearer” instead. Neither is your billing name, which we never ask for.

That fourth is a delivery name, a street, a town, a postcode, and in a few countries a state or province. It is asked for only when there is a parcel, and a certificate is never a parcel. None of it is printed on a certificate and none of it is published. §4 says what happens to it and §5 says who else sees it.

The email address is where the order confirmation we owe you goes, and we send it: § 55(1) requires that confirmation on a durable medium, and an email is one. Sending it is a legal obligation rather than anything you consented to, which is why §7 lists it there and nothing here asks for consent. §4 says what happens to the address and §7 how long it is kept.

The payment itself happens inside a frame that Stripe serves and controls, which we place on our checkout page. Stripe decides what that frame asks for. Today it asks for your card details, and depending on how you pay it may also ask for your name, your email address, your telephone number or a billing address — and if you pay with Apple Pay, Google Pay or Link, those services hand Stripe what they hold about you. None of it is typed into anything we wrote, and none of it reaches us except as §4 describes.

Stripe's script also collects signals about the device and browser you are paying from. It uses them to judge whether a payment is fraudulent, and that judgement is made automatically: a payment can be declined by it without a person looking. If that happens to you and you think it is wrong, write to baldrick@lousydeal.com and a person will look.

If you buy it as a gift, the checkout also asks for the recipient's email address and optionally their name, a name for you, and a short message. We use the address to send them the certificate once, and we do not write to them again. §6 is addressed to them, and you should know that giving us somebody else's address is you telling us we may write to them.

You do not have to give any of this. It is what a card payment requires, so if you would rather not, the consequence is simply that you cannot buy anything here. Nothing else on the site is affected.

§4 What an order leaves behind

An order record holds its number, what you bought, what you paid, the currency, the country you selected, the email address you gave, and the time. Where the order contained something to post, it also holds the delivery name and address you typed.

This section used to say there was no name on an order at all, because our own code never asked for one. That was true until this shop began posting things and it is not true now. What is still true is narrower: we never ask for your billing name, and nothing here asks for a name except the one a parcel has to be addressed to.

It also holds what Stripe tells us about the payment. That record is stored as Stripe returns it, and it can include the brand of your card, its last four digits, its expiry, and any billing details Stripe collected in its own frame — details that reach our database without ever passing through this site's code. We use them only to reconcile the payment, and they are not shown to anyone.

§5 Who else handles your data

Five companies can handle data when you use this site, and these are all of them. Google and Meta do so only if you choose optional analytics. A sixth kind of party — whoever carries a parcel — is described at the end of this section.

Google Analytics and Meta Pixel receive the measurement data described in §2 only after your opt-in. We use them to understand whether the shop's purchase path is usable. Google and Meta may process it outside the European Economic Area, including in the United States. Their respective privacy notices govern their own processing and retention; stopping collection here does not erase an existing vendor record.

Stripe processes payments and holds the payment record. For that it acts on our instructions. For the fraud and regulatory checks described in §3 it acts for itself, deciding on its own account what to collect and what to conclude, and for those we are not the only one responsible. Its own privacy notice is at stripe.com/privacy and it governs that half.

Cloudflare provides this site's DNS and the connection through which it is reached, and gates the administrative interface. It therefore sees the address each of your requests comes from. This is not optional: it is how the site is delivered at all.

Printful prints and posts anything physical you order. The company we contract with is Printful, Inc., a Delaware corporation; AS “Printful Latvia” is its representative in the European Union. It acts on our instructions, and its data processing terms say so and form part of the terms of service we accepted, so they bind it without anything having been signed separately. It may not sell what it receives, share it for anyone's advertising, or use it outside our arrangement, and it does not use it to market to you.

One thing it does for itself rather than for us: it checks a recipient against the sanctions lists its own law obliges it to apply. That is its legal obligation and not our instruction, and it is here for the same reason §3 describes Stripe's fraud check — it is processing that happens to you and is not done on our behalf.

While you are still filling the form in, the delivery address is sent to Printful to get a price for the parcel. Your name is not sent with it. That happens before you pay, and it happens whether or not you go on to pay, because the postage is quoted rather than guessed.

When you pay for something that has to be posted, the order goes to Printful so the item can be made: the delivery name and address, and which items they are. Nothing else of yours goes with it — not your email address, not what you paid, and not the certificate or anything written on it.

A parcel has to be carried by somebody, and a carrier is given what it needs to deliver it: the address, and a way to reach you if there is a problem at your door or at a customs desk. Which carrier that is depends on where the item was made and where it is going, and neither we nor you choose it.

Printful's published terms do not say whether it treats a carrier as a company acting on its instructions or as one answering for itself. We are not going to state a position its own documents do not support, so what we tell you instead is what a carrier receives and why.

There is no other third party. We do not sell data, we share it for nobody's advertising, and no company is named here that is not in the path today.

§6 If somebody sent you a certificate as a gift

This section is for you, not for the person who bought it. You did not buy anything, you have no contract with us, and you did not give us your address — the buyer typed it in.

We hold your email address, and your name if they gave one. We used them to send you the certificate, once. You are not on a list, there is nothing to unsubscribe from, and we will not write to you again.

We may do that because the buyer paid for you to have it. The regulation calls that a legitimate interest — ours in delivering what the buyer paid for, and yours in receiving it — and it is one you can object to. Article 14 of the GDPR is the rule for data we get from someone other than the person it is about, and it is why the message we sent you says where your address came from.

Your address stays on the order record. Accounting law makes us keep the order for seven years — but it cares about the money, not about you, so if you ask us to remove your address from it we will, and the order stays.

You can ask what we hold, have it corrected or deleted, or object. Write to baldrick@lousydeal.com and say which certificate it was — we have no account to look you up by. §9 lists the rest of your rights, and they are yours as much as the buyer's.

§7 Where it is, and what leaves the European Economic Area

Your data is processed in the European Economic Area. The servers that run this shop and its database are within it.

Stripe and Cloudflare are United States companies, and using them means some data is processed in the United States. Each participates in the EU–US Data Privacy Framework, and standard contractual clauses apply where it does not cover a transfer.

Printful is a United States company too, and it does not participate in that Framework. Its certification was withdrawn in 2021 and the Framework's own public list records it as inactive, so what covers those transfers is standard contractual clauses alone — the 2021 clauses, the controller-to-processor module between us and it, and the processor-to-processor module for anyone it engages.

Printful also prints in more places than it is registered in. Its own facilities are in Latvia, Spain, the United Kingdom, the United States, Mexico and Canada, and it uses partner facilities in Brazil, Japan and Australia. Of those, only Latvia and Spain are inside the European Economic Area. Which one makes your item is decided by its system according to what you ordered and where it is going, and it is not a choice either of us gets to make — so we cannot promise you a parcel printed inside the Area, and we are not going to imply one.

Write to baldrick@lousydeal.com and we will send you a copy of the clauses we rely on.

§8 On what basis, and for how long

Having a thing made and posted to you is performance of a contract, and the delivery name and address are what performing it takes: without them there is nowhere to send the parcel. Taking your order and giving you what you paid for is performance of a contract. Keeping the accounting record, and confirming your order to you on a durable medium, are legal obligations. Operating and defending the site, and checking that a payment is not fraudulent, are our legitimate interests and Stripe's. Optional Google and Meta measurement runs only on your consent, which you can refuse or withdraw without affecting the shop.

Sending a gift certificate to the person a buyer named is our legitimate interest in delivering what they paid for, and theirs in receiving it — §6 says so to them directly. It is not consent either: the recipient was never asked, which is exactly why Article 14 applies rather than Article 13.

The cart cookie ends with your browser session. Stripe's last 30 minutes and a year, as §2 says.

Estonian accounting law requires us to keep the record of an order for seven years from the end of the financial year it falls in, and we keep it no longer than that. The payment details described in §4 are part of that record, and so is your email address; both are kept with it and for as long.

A gift recipient's address and name sit on the same order record. The accounting law requires the order; it does not require knowing who the certificate went to. We keep those details so we can show, if the buyer disputes it, that we sent what they paid for — and we remove them if the recipient asks.

The request lines described in §2 are kept for 30 days.

Printful keeps what we send it for as long as our arrangement with it lasts, and afterwards for as long as its own legal obligations require. It publishes no fixed period for that and we are not going to invent one on its behalf. The order record here is kept as the paragraphs above describe, whatever Printful does with its copy.

Cloudflare keeps its own record of the requests it carries, under its own retention and not ours. We do not control how long it holds them, and §5 says what it sees.

If you write to us we keep the message and your address for two years after the last message in the conversation, so that we can find it again if you come back about the same order.

§9 Your rights

You may ask what we hold about you, ask for it to be corrected, ask for it to be deleted, ask us to stop or limit what we do with it, ask for a copy in a portable form, or object to processing we do on the basis of our legitimate interests. Write to baldrick@lousydeal.com.

We hold no billing name — our own code never asks for one — so an order is identified by its number, by the email address you gave, and by the payment behind it. Where an order had something posted we also hold the delivery name you typed, and where somebody was sent a certificate as a gift we hold theirs; §4 and §6 say so. If you ask us about an order, write from that address or tell us which order it is, or we will not be able to find you in our own records.

If you think we have got it wrong you may complain to your national data protection authority. In Estonia that is the Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, info@aki.ee.