Privacy policy

Last updated: March 23, 2026

FERNFAWN LLC ("FERNFAWN," "we," "us," or "our") respects your privacy and is committed to protecting your personal data. This policy explains how we collect, use, store, and share your information when you visit fernfawn.com or place an order.

We sell to customers in the United States, United Kingdom, European Union, Canada, and Australia. This policy complies with the General Data Protection Regulation (EU GDPR), the UK General Data Protection Regulation (UK GDPR), the Privacy and Electronic Communications Regulations (PECR), the Personal Information Protection and Electronic Documents Act (PIPEDA), and applicable US state privacy laws including the California Consumer Privacy Act (CCPA/CPRA).

WHO WE ARE

FERNFAWN LLC is a Wyoming limited liability company based in Huntsville, Alabama, United States. We are the data controller for the purposes of data protection law.

Contact for privacy matters: support@fernfawn.com
FERNFAWN LLC, Huntsville, AL, United States 

WHAT WE COLLECT

Information you provide:
- Name, email address, phone number, and shipping address when you place an order
- Payment information (processed securely by Stripe; we do not store your full card details)
- Photographs you upload for your custom portrait
- Messages you send to our support team
- Email address if you subscribe to our newsletter

Information collected automatically:
- IP address, browser type, operating system, device information
- Pages visited, referring URLs, time on site
- Cookie data (see our Cookie Policy)

HOW WE USE YOUR DATA

We process your data on the following legal bases under GDPR Article 6 and UK GDPR Article 6:

Order fulfilment (Article 6(1)(b), contract performance): We use your name, address, email, payment details, and uploaded photograph to create, produce, and deliver your custom portrait.

Order communications (Article 6(1)(b), contract performance): We send proof previews, revision updates, shipping confirmations, and tracking information.

Customer support (Article 6(1)(b) and 6(1)(f), legitimate interests): We respond to questions and resolve order issues.

Legal obligations (Article 6(1)(c)): We retain order records for tax, accounting, and fraud prevention as required by law.

Marketing (Article 6(1)(a), consent): If you opt in, we send promotional emails. You can unsubscribe at any time via the link in any marketing email.

Website improvement (Article 6(1)(f), legitimate interests): We use anonymised analytics to improve the site experience.

Fraud prevention (Article 6(1)(f), legitimate interests): We screen orders for potential fraud.

YOUR PHOTOGRAPHS

Your photograph is personal data. Here is exactly what happens to it:

We use your uploaded photo solely to create your custom portrait. Our artist accesses your photo using professional design software. Your photo is shared with our print fulfilment partner only as part of the final artwork file needed to produce your order.

We retain your photo and portrait files for 90 days after confirmed delivery of your order. This allows us to handle replacements, quality issues, or support requests. After 90 days, your original photo and all working files are permanently deleted.

We do not use your photo for marketing, social media, advertising, or any other purpose without your separate, explicit written consent. If you want your photo deleted sooner, email support@fernfawn.com and we will delete it within 7 business days.

WHO WE SHARE DATA WITH

Our print fulfilment partner: They receive your shipping address and the final artwork file to produce and ship your poster. They operate facilities in the US, UK, Canada, Australia, and across Europe. They act as a data processor on our behalf.

Shopify: Our website is hosted on Shopify Inc. Shopify processes and stores your order data on our behalf. When you provide personal information through our store, Shopify collects this information in accordance with their privacy policy: https://www.shopify.com/legal/privacy. For more information about how Shopify uses your data, visit: https://www.shopify.com/legal/privacy.

Stripe: Our payment processor. Stripe handles your payment securely. We never see or store your full card number. Privacy policy: https://stripe.com/privacy.

Email service provider: Used for order confirmations, proof delivery, and (with your consent) marketing emails.

We do not sell your personal data. We do not share your data with advertisers.

INTERNATIONAL DATA TRANSFERS

Your data may be transferred to and processed in the United States. We protect these transfers using the following mechanisms:

For EU customers: Transfers to the United States are covered under the EU-US Data Privacy Framework where applicable, or by Standard Contractual Clauses (SCCs) approved by the European Commission.

For UK customers: Transfers are protected by the UK International Data Transfer Agreement or Standard Contractual Clauses as approved under UK law.

For Canadian customers: Your data is processed in the United States. US law enforcement may access data under applicable US laws.

DATA RETENTION

Order records (name, address, order details): 7 years (tax and legal requirements)
Uploaded photographs: 90 days after delivery confirmation, then permanently deleted
Portrait design files: 90 days after delivery confirmation, then permanently deleted
Customer support messages: 2 years
Newsletter subscriptions: Until you unsubscribe
Analytics data: 26 months (anonymised)

YOUR RIGHTS

UK and EEA residents (GDPR / UK GDPR): You have the right to access, correct, delete, restrict processing, port your data, object to processing, and withdraw consent. You may lodge a complaint with the UK ICO (ico.org.uk) or your local supervisory authority.

Canadian residents (PIPEDA): You have the right to access your information, request corrections, and withdraw consent. Complaints may be filed with the Office of the Privacy Commissioner of Canada (priv.gc.ca).

Australian residents: You have the right to access and correct your personal information under the Australian Privacy Act 1988. Complaints may be filed with the Office of the Australian Information Commissioner (oaic.gov.au).

US residents: Your rights depend on your state. California residents have rights under the CCPA/CPRA including the right to know, delete, and opt out of the sale of personal information. We do not sell personal information.

To exercise any of these rights, email support@fernfawn.com. We respond within 30 days.

DATA BREACH NOTIFICATION

In the event of a data breach that poses a risk to your rights, we will notify the relevant supervisory authority and affected individuals as required by applicable law, including GDPR Article 33, UK GDPR, and PIPEDA breach notification requirements.

CHILDREN

Our website is not intended for anyone under 16. We do not knowingly collect data from children.

CHANGES

We may update this policy. The date at the top reflects the most recent revision.

CONTACT

support@fernfawn.com
Huntsville, AL, United States