Privacy policy

Orders: your name, email, phone, billing and delivery address, the works you buy and the payment status — to make and deliver your order, issue the invoice and your certificate of authenticity. Legal basis: performing the contract (Art. 6(1)(b) GDPR) and our tax and accounting obligations (Art. 6(1)(c)).

Payment: card details go directly to Stripe and never reach our servers. Stripe also works out the VAT due from your address.

Certificates of authenticity: we keep a registry of every certificate — the work, the date and the owner’s name and country — so it can be verified and passed on. The public verification page shows only initials and country. Legal basis: our legitimate interest in keeping the provenance of each work (Art. 6(1)(f)).

Account: if you create one, your name, email, password (stored encrypted) and order history. Legal basis: the contract.

Newsletter: your email, only if you subscribe; every email has an unsubscribe link. Legal basis: consent (Art. 6(1)(a)).

Messages you send us, to answer them. Legal basis: legitimate interest.

Places: the place you choose on the map is stored with your order so the painting can be printed. While you browse the map, your browser loads map tiles from OpenFreeMap and elevation tiles from Amazon Web Services, which receive your IP address as any website you visit does. Place searches go from our server to OpenStreetMap’s Nominatim service, which sees the search text but not your IP address.

Pinta tu foto: the photo you choose is turned into a painting in your browser and does not leave your device until you add the painting to your cart. Then a reduced copy (1,280 px) and the outline of what you selected are uploaded to our server and stored outside the website, where only our printing process and the studio can open them. The outline is worked out on your device; it marks areas such as hair, skin or clothing and does not identify anyone. Legal basis: performing the contract. If your photo shows other people, you confirm they have agreed (see the terms of sale).

Your country: when you first visit, our server looks up the country of your IP address in a local database (IP Geolocation by DB-IP, dbip.com, CC BY 4.0) to show prices in your currency and the delivery time to your country. Only the country code is kept, in a cookie; the IP address is not stored. You can change the country at the bottom of any page. Legal basis: legitimate interest.

Analytics and advertising: only if you accept them in the cookie banner. See the cookie policy.

Printful, which prints, packs and ships your order — for a painting from your photo, Printful receives the finished painting, not the photo itself. Stripe, for payment and tax calculation. Brevo, which sends our emails and the newsletter. Vultr, which hosts the servers this site runs on. Google, for analytics and advertising measurement — only with your consent. Tax authorities and other public bodies when the law requires it.

Some of these providers are based in the United States. Those transfers rely on the EU–US Data Privacy Framework or on the European Commission’s standard contractual clauses.

Photos for Pinta tu foto: deleted 7 days after upload if no order is paid; from a paid order, the photo and the print file are deleted 60 days after the order is completed. The small preview of the painting stays with the order.

Order and invoice data: six years, as Spanish commercial law requires (Article 30 of the Commercial Code). Certificate registry: for as long as the certificate exists, since its purpose is to keep the provenance of the work. Account: until you delete it. Newsletter: until you unsubscribe. Messages: as long as needed to deal with them.

You can ask to access your data, correct or delete it, restrict or object to its use, and receive it in a portable format, by writing to info@silviero.com. Where we rely on your consent you can withdraw it at any time, without affecting what was done before.

If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).