Privacy Policy

QuillAndStar · quillandstar.shop · last updated 25 September 2026

This Privacy Policy describes how QuillAndStar collects, uses and shares personal information when you buy our digital or printed products, contact us, or use your personal page on quillandstar.shop. It applies wherever we sell, including Etsy. It does not cover Etsy or other platforms we don't control; see their own privacy policies for their practices.

Who Is Responsible

Iaroslav Pavlov, trading as QuillAndStar, Carrer de Sueca, 10, 46980 Paterna, Valencia, Spain, is the data controller of your personal information. You can reach us at [email protected], through Etsy messages or by post at that address.

Information We Collect

• Order details the platform gives us: your name, email address, order (receipt) number and the items you bought.
• For printed products, also your shipping address and the names, dates and other text you type in the personalization boxes.
• On your personal page for digital products: the names you choose for your file, your order number and a short download log (date, file format and a one-way scrambled code made from your IP address, so we can spot shared links). Other text you type there is used only to create your file and is not stored.
• If a product has a photo box, the photo you add on your personal page. Your browser makes it smaller before sending it, and we save it again without the hidden camera details, such as where and when it was taken. We use it only to make your file, and it isn't included in our backups.
• Messages you send us.

We don't use tracking cookies or advertising trackers, and we never see your payment details; the platform you buy from handles payment.

If your order includes other people's names or dates, please include only details they would be happy to see printed.

How We Use It and Why

• To make and deliver your order and to help with questions, reprints and disputes (performance of our contract with you).
• To prevent misuse of personal links, keep our systems secure and follow the rules of the platforms we sell on (our legitimate interests).
• To keep sales and tax records required by law (legal obligation).
• For marketing only if you have clearly asked for it, and you can withdraw that at any time (consent). We never send promotions through Etsy messages.

We never sell your information, and we don't make automated decisions about you.

Who We Share It With

Each recipient gets only what it needs for its task:

• The platform you bought from, such as Etsy. We look up orders through Etsy's official API.
• Print partners, for printed products. The partner that makes your order receives your name and shipping address, the print file and the order details, plus your email address if the delivery service needs it for tracking updates. It hands the parcel to a postal or courier service for delivery. Our print partners are Gelato (Norway), Prodigi (United Kingdom) and Printful (United States, with production sites in Europe). Each order goes to one of them, usually the one that prints closest to you. If we add a partner, we add it to this list.
• Service providers that run parts of our shop for us: our web server host (in the EU), Cloudflare (secure delivery of quillandstar.shop), Telegram (private sale notifications to the shop owner, with the order number and items only, no names or email addresses) and the software and cloud services we use for email, order processing and encrypted backups.
• Authorities or others where the law requires it, to protect rights and safety or to prevent fraud, and a buyer of the business if it is ever sold, as the law allows.

Our Website

Browsing quillandstar.shop needs no account and sets no cookies. To count visits we use Cloudflare Web Analytics, which works without cookies and doesn't identify you: it records the page you opened, the site that sent you, your browser and device type and your country. Our own server doesn't record your IP address when you browse the catalog. When you click "Buy on Etsy", you move to Etsy, and Etsy's privacy policy applies there.

Pinterest

We publish Pins of our own products to our own Pinterest account with a small internal tool that uses the Pinterest API. It only accesses our own account: our boards, our Pins and their statistics (impressions, saves, clicks). It does not access, collect or store information about other Pinterest users, and we don't use Pinterest data for advertising or share it with anyone. Our Pinterest access tokens are stored securely on our EU server and can be revoked at any time.

How Long We Keep It

• Print files, with the names and dates in them, are deleted 60 days after your order.
• Photos you add on your personal page are deleted automatically within a day after your 30 days of editing end, and no later than 45 days after you upload them. You can also remove a photo yourself on the page at any time.
• Personal page data and our own order records (including the shipping address and tracking number for printed products) are deleted 12 months after your order.
• Encrypted backups are overwritten within a few weeks.
• Where tax law requires us to keep sales records longer, we keep only what it requires.

Etsy and our print partners keep their own records under their own policies.

Transfers Outside the EU

Our server is in the EU, and Gelato is in Norway, which is part of the EEA. Some partners and service providers process data in other countries, such as the United Kingdom or the United States. We use them only where the European Commission has recognized the country's protection as adequate (this covers the UK and US companies certified under the EU-U.S. Data Privacy Framework) or under the Commission's Standard Contractual Clauses.

Your Rights

Depending on where you live (including the EU/EEA and the UK), you may have the right to:

• access and get a copy of the information we hold about you;
• correct, restrict or delete it (we delete on request unless the law requires us to keep it);
• object to processing based on our legitimate interests, and to marketing at any time;
• complain to your local data protection authority (in Spain: the AEPD, www.aepd.es).

To use these rights, email [email protected], message us through Etsy or write to the address above. We reply within 30 days. For information held by Etsy, contact Etsy at etsy.com/help.

Children

Our shop is not directed at children under 16, and we don't knowingly collect information from them.

Changes

When we change this policy, we update the date at the top. The current version is always at quillandstar.shop/privacy.