Privacy policy
PRIVACY POLICY
Last updated: March 2026
FERNFAWN ("we," "us," "our") respects your privacy. This policy explains
what we collect, why, who we share it with, and the control you have.
WHO WE ARE
FERNFAWN LLC, a Wyoming limited liability company, is the data controller.
Contact: support@fernfawn.com
We sell to customers in Australia, the United States, United Kingdom,
European Union and Canada. This policy is written to meet the Australian
Privacy Act 1988 (Cth) and the Australian Privacy Principles, the EU and
UK GDPR, PIPEDA, and applicable US state privacy laws including the
CCPA/CPRA.
WHAT WE COLLECT
You give us:
• Name, email, phone and shipping address when you order
• Payment details (handled by Stripe — we never see or store your full
card number)
• The photograph you upload for your portrait
• Messages you send our support team
• Your email, if you subscribe to our newsletter
We collect automatically:
• IP address, browser, device and operating system
• Pages visited, referring links, time on site
• Cookies and similar tracking (see "Advertising and analytics" below)
YOUR PHOTOGRAPHS — IN PLAIN TERMS
Your photo is personal information, and we treat it that way.
• We use it only to create your portrait.
• Our artist works on it in professional design software.
• It reaches our print partner only as part of the final artwork file
needed to produce your order.
• We keep your photo and working files for 90 days after delivery, so
we can handle reprints or quality issues. After 90 days they are
permanently deleted.
• We will never use your photo or your portrait in marketing, on social
media, or in advertising without your separate, explicit written
consent.
• Want it deleted sooner? Email us and we'll delete it within 7
business days.
WHY WE PROCESS YOUR DATA
Under GDPR/UK GDPR Article 6, our legal bases are:
• Fulfilling your order — contract, Art 6(1)(b)
• Order emails: proofs, revisions, dispatch, tracking — contract,
Art 6(1)(b)
• Customer support — contract and legitimate interests, Art 6(1)(b)
and (f)
• Tax, accounting and fraud records — legal obligation, Art 6(1)(c)
• Marketing emails — consent, Art 6(1)(a). Unsubscribe any time.
• Advertising and analytics cookies — consent, Art 6(1)(a)
• Fraud screening and site improvement — legitimate interests,
Art 6(1)(f)
ADVERTISING AND ANALYTICS
We advertise on Meta (Facebook and Instagram). To measure whether our ads
work, we use the Meta Pixel and Meta's Conversions API.
What this means in practice:
• These tools send Meta information such as your IP address, browser
and device details, pages you viewed, and actions you took (for
example: viewed a product, added to cart, purchased).
• Where enabled, they may also send a hashed (scrambled) version of
your email address to help Meta match the event to an account. We
never send Meta your photograph or your portrait.
• Meta acts as an independent controller for this data and may use it
for its own advertising purposes. Meta's privacy policy:
https://www.facebook.com/privacy/policy
• This data is processed on servers in the United States.
Where the law requires consent (EU, UK and other applicable regions),
these tools load only after you accept advertising cookies, and you can
change or withdraw that consent at any time via our cookie settings.
We do not sell your personal information. Sharing data with Meta for
advertising measurement may be treated as "sharing" for cross-context
behavioural advertising under California law — you can opt out at any
time by emailing us or using our cookie settings.
AUTOMATED DECISIONS
Our payment and store platforms (Stripe and Shopify) run automated fraud
screening on orders. This uses your payment details, IP address, billing
and shipping address, and order history to produce a risk score. A high
risk score may cause an order to be held or cancelled. No portrait is
ever created or altered by an automated decision. If an order of yours is
declined and you'd like it reviewed by a person, email us.
WHO WE SHARE DATA WITH
• Our print partner — receives your shipping address and the final
artwork file to produce and ship your order. They operate production
facilities in Australia, the US, UK, Canada and Europe, and act as
our processor.
• Shopify — hosts our store and processes order data on our behalf.
https://www.shopify.com/legal/privacy
• Stripe — processes payments. https://stripe.com/privacy
• Meta — see "Advertising and analytics" above.
• Our email provider — order emails, proofs, and (with consent)
marketing.
We do not sell your personal data.
SENDING DATA OVERSEAS
FERNFAWN is based in the United States, so your information is processed
there.
• Australian customers: we disclose your personal information to
overseas recipients, including in the United States. Under Australian
Privacy Principle 8 we remain accountable for how those recipients
handle it, and we take reasonable steps — including written data
processing terms — to require them to protect it consistently with
the APPs.
• EU customers: transfers to the US rely on Standard Contractual
Clauses approved by the European Commission, or the EU-US Data
Privacy Framework where the recipient is certified.
• UK customers: transfers rely on the UK International Data Transfer
Agreement or the UK Addendum to the SCCs.
• Canadian customers: your data is processed in the United States and
may be accessible to US authorities under US law.
HOW LONG WE KEEP THINGS
Order records (name, address, order details) 7 years (tax and legal)
Uploaded photographs 90 days after delivery
Portrait design files 90 days after delivery
Support messages 2 years
Newsletter subscription until you unsubscribe
Analytics data 26 months
YOUR RIGHTS
Australia (Privacy Act 1988): You may access and correct your personal
information, and complain to us first. If you're not satisfied, you can
complain to the Office of the Australian Information Commissioner —
oaic.gov.au.
EU / UK (GDPR): Access, correction, erasure, restriction, portability,
objection, and withdrawal of consent. You may complain to your local
supervisory authority, or the UK ICO at ico.org.uk.
Canada (PIPEDA): Access, correction, and withdrawal of consent.
Complaints: priv.gc.ca.
United States: Rights vary by state. California residents have the right
to know, delete, correct, and opt out of the sale or sharing of personal
information. We do not sell personal information. Several other states
provide a right to opt out of targeted advertising — email us to exercise
it.
To use any of these rights, email support@fernfawn.com. We respond within
30 days.
SECURITY AND DATA BREACHES
We use industry-standard measures to protect your information. If a
breach occurs that is likely to cause serious harm, we will notify the
relevant regulator and affected individuals as required — including under
the Notifiable Data Breaches scheme in Australia, GDPR Article 33, and
PIPEDA.
CHILDREN
Our site is not intended for anyone under 16, and we do not knowingly
collect their information.
CHANGES
We may update this policy. The date at the top shows the last revision.
CONTACT
support@fernfawn.com — we reply within 1 business day.
FERNFAWN LLC,