Privacy Policy
Draft for review. Highlighted parts wait for a business or legal decision and are not final.
Last updated / effective date: OPERATOR: date
1. Who is responsible for your data
The controller of your personal data is Suchmugs S.R.L., Romania (Trade Register J40/1626/2019, CUI RO40613870), registered office Aleea Coloana Infinitului 8, Bl. M, Sc. 1, Ap. 6, Sector 6, 062112 Bucharest, Romania. Contact for any privacy question or request: contact@suchmugs.com OPERATOR: or a dedicated privacy@ address.
We are established in the European Union, so the EU General Data Protection Regulation (GDPR) applies to all personal data we process, including data of customers in the United States. We have not appointed a Data Protection Officer because we believe we are not required to. LAWYER: confirm Art 37 does not apply.
2. What we collect, why, and on what legal basis
| Data | When | Purpose | Legal basis (GDPR Art 6(1)) | Kept for | |
|---|---|---|---|---|---|
| Name, shipping address, email, phone if given, items, personalization text | You place an order | Make, ship and support your order; send order and shipping emails | (b) contract | LAWYER: period; see below | |
| Payment and checkout details | At checkout | Take payment and prevent fraud. Card numbers are collected by Stripe and not shared with us in full; we receive the payment record and what you enter at checkout (for example name, email, billing and shipping address, card brand and last 4 digits) and Stripe's fraud-risk result OPERATOR: confirm the exact fields received from Stripe | (b) contract; (f) fraud prevention | As order records | |
| Order and invoice records | After purchase | Accounting and tax duties | (c) legal obligation | LAWYER: Romanian accounting retention period, secondary sources say 5 years for supporting documents after Law 36/2023 | |
| Discount or creator code used, referral link | At checkout | Apply the discount; pay the creator who referred you | (b) contract for the discount; (f) legitimate interest for creator attribution | OPERATOR: period, for example until the creator's commission is settled | |
| Emails and messages you send us | When you contact us | Answer you | (b) or (f) | OPERATOR: period | |
| Review request and your review | OPERATOR: once review collection starts; timing proposed, about 2-3 weeks after delivery | Ask every buyer the same way for a review; publish reviews | (f) legitimate interest; you choose whether to write one | OPERATOR: period | |
| Newsletter email | Only if you sign up OPERATOR: flow proposed, unticked box plus confirmation email, not built | Send marketing emails | (a) consent, which you can withdraw at any time | Until you unsubscribe | |
| Creator details (creators who sign our creator agreement only) | When you sign | Run the collaboration, ship your mug, pay commission, keep tax records | (b) contract; (c) legal obligation for tax and accounting records | LAWYER: period; tax records as accounting retention | |
| Technical data (IP address, browser, pages served) | When you visit | Run, secure and fix the site | (f) legitimate interest | OPERATOR: log retention of the hosting provider | |
| Ad measurement: the ChatGPT Ads pixel and Conversions API (see section 6) | Visits and clicks from our ads: page views, product views, add to cart, checkout start, and an order event with the order value and items. For the server-side order report also your IP address and browser type, the two ad references from the pixel cookies (section 6), a hashed email, hashed first and last name, and your city, state, postal code and country | United States visitors by default unless they opt out; visitors elsewhere only after they press Accept | Measure whether our ads lead to orders | (f) legitimate interest for United States visitors, (a) consent for everyone else LAWYER: confirm the basis for United States visitors, see OPEN-QUESTIONS Q6 | OPERATOR: period; the pixel cookies last 30 and 365 days, see section 6 |
| Cookies and similar storage | When you visit | See section 6 | Strictly necessary storage needs no consent; anything else only with consent where the law requires it | See section 6 |
Giving your name, address and email is needed to fulfil an order. Without them we cannot ship. Everything else is optional.
Where we rely on legitimate interest, our interest is running and improving a small online shop and paying the creators who refer customers. You can object at any time (section 5).
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. We do not sell your personal information. Where the ChatGPT Ads pixel is on (section 6), it sends the visit and order events listed above to OpenAI so that we can measure our ads. LAWYER: whether that is "sharing" for cross-context behavioral advertising under California and other state privacy laws, and whether a "Do Not Sell or Share" link and Global Privacy Control handling are required.
3. Who receives your data
We share data only with service providers that help us run the store, under contracts that limit their use of it:
- Payment processing: Stripe
- Order management and production: our print and fulfillment partners in the United States, which receive your name, shipping address and personalization to make and ship your mug
- Shipping carriers, which receive your name and address
- Email delivery (order emails, and the newsletter if you opt in)
- Website hosting and security
- Our accountant, for tax and accounting records
- Advertising measurement: OpenAI, which receives the pixel and Conversions API events described in sections 2 and 6 where the pixel is on
OPERATOR: decide whether to name each provider or keep categories. GDPR Art 13(1)(e) allows "categories of recipients". Each provider needs a processor agreement on file.
We may also disclose data where the law requires it, or to protect our rights in a dispute.
4. Transfers outside the EU
Most of our service providers, the print partners and the carriers are in the United States, and your order ships within the United States OPERATOR: US-only proposed. Transfers of personal data from us to the United States rely on LAWYER: per provider, either the EU-US Data Privacy Framework adequacy decision (2023/1795), where the provider is certified, or the European Commission's Standard Contractual Clauses. A copy of the safeguards is available on request at contact@suchmugs.com.
LAWYER: the Data Privacy Framework is under appeal at the EU Court of Justice (case C-703/25 P, pending as of the last search). Decide whether to rely on it or on SCCs as the stated mechanism.
5. Your rights
Under the GDPR you have the right to access your data, to have it corrected or deleted, to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting earlier processing. You can object to direct marketing at any time and we will stop. Email contact@suchmugs.com. We answer within one month, which can be extended in complex cases. We may ask you to confirm your identity.
You also have the right to complain to the Romanian data protection authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro LAWYER: confirm the complaint page URL and postal address, or to the authority where you live or work if you are in the EU.
California residents. You may ask what personal information we collected about you and request changes or deletion using the contact above. We will notify you of material changes to this policy by updating the date at the top OPERATOR: and by email for changes that affect existing customers. LAWYER: confirm CalOPPA wording and whether any state privacy law applies at our size.
Do Not Track and ad measurement. You can switch the ChatGPT Ads pixel off at any time with "Privacy choices" in the footer of every page. The choice is remembered on your device and also stops us reporting your order to OpenAI. LAWYER: state how the site responds to browser Do Not Track and Global Privacy Control signals, and whether the "Privacy choices" link satisfies state opt-out rules.
6. Cookies and similar storage
What the shop needs. We store your cart in your browser (sm_cart_v1, in local storage) until you clear it or finish checkout. We store your privacy choice (sm_consent_v1 in local storage and the cookie sm_ads_consent, which lasts one year) so that it is remembered and applied at checkout. For one visit we keep the country your connection comes from (sm_geo_v1, session storage) so that we can apply the rule below. This storage is strictly necessary to run the shop and needs no consent. The checkout page is hosted by Stripe and runs under Stripe's own privacy policy (https://stripe.com/privacy).
Ad measurement with the ChatGPT Ads pixel. Our ads on ChatGPT use a measurement pixel from OpenAI to tell us whether a visit from an ad ends in an order.
- If you are in the United States, the pixel is on when you arrive and the footer tells you so. Choose "Privacy choices" in the footer and press Decline to switch it off. It then stays off on this device, and your order is not reported to OpenAI.
- If you are anywhere else, or we cannot tell where you are, nothing loads until you press Accept in the bar at the bottom of the page.
- When it is on, the pixel sets two cookies on our domain:
__oppref, which lasts 30 days and links a click on an ad to an order, and__obref, a random browser reference that lasts 365 days. Pressing Decline deletes them. - We work out your country from your connection when the page opens, and we record your country and your choice with your order so that the server-side order report follows it.
If we add Meta or Pinterest tags, they load only after you press Accept, for every visitor, and we will update this section first.
LAWYER: confirm that default-on ad measurement with an opt-out is acceptable for United States visitors of a Romanian controller, and that the country check is an acceptable substitute for consent (OPEN-QUESTIONS Q6).
7. Children
This store is for adults buying gifts. It is not directed to children under 13 and we do not knowingly collect personal data from them. If you believe a child has given us data, email us and we will delete it.
8. Security
OPERATOR: describe the real security measures, for example HTTPS on every page and who has access to order data. If a breach is likely to put your rights at risk we will notify the authority within 72 hours where required, and tell you where required.
9. Changes
We will post any change here with a new date.
10. Contact
Suchmugs S.R.L., Aleea Coloana Infinitului 8, Bl. M, Sc. 1, Ap. 6, Sector 6, 062112 Bucharest, Romania. contact@suchmugs.com