Privacy notice
Who is responsible for your data
Storied Wall is a trading name of Samuel Thomas Woodrow Knight, a sole trader in Australia, ABN 37 798 389 559. We are the controller of your personal data. Contact us at hello@storiedwall.com.
To take an order we need your email address and, for a print, the delivery name and address. A phone number is optional. Without the required details we can’t take your order.
Cookies and tracking
We use no analytics, advertising cookies or tracking pixels. If you sign in to an account, we set one essential cookie, called __Host-sw_session. It holds a random code that keeps you signed in, is used for nothing else, and ends when you close your browser. If you don’t sign in, we set no cookies.
Your design
Everything you type into a design (names, dates, places and notes) is held in the page’s web address, in your browser. We don’t store it until you order. If you share the link, anyone with it can see the design.
If you add a route from a GPX, FIT or TCX file, the file is read in your browser and never uploaded. Only the simplified route line goes into the design.
A design often includes other people: their names, dates, places or photos, or the person you’re sending a print to. We use these only to make and deliver your order, which is our legitimate interest in doing what you asked, and delete them on the same timetable as the rest of your order.
If you add a photo
A photo is the one thing you add that is uploaded to us, because we need it to print your design. Before it leaves your device, your browser resizes it and saves it again as a JPEG, which leaves out its location, camera and date details. We store it on our own server under a long random code, and only that code goes into your design’s web address. Anyone with the link to your design can see a screen-size copy of the photo, so share the link only with people you’d show the photo to.
We use your photo only to show your preview and to print your order. We delete it 7 days after you upload it, unless it’s part of an order you’ve paid for, or part of a design you’ve saved to your account (kept until 90 days after you last save that design). Once you’ve paid for an order, we keep its photos until your order is on its way, and delete them 60 days after we send it, in case it arrives damaged and we need to make it again. For a digital file, we delete them 60 days after we make the file.
Maps, elevation and place search
While you design, your browser asks only our own site for these, and our server fetches them for you. The services below don’t receive your IP address.
- Place search: when you search for a place, our server sends the text you type to Photon, a place search run by komoot on OpenStreetMap data, as you type. We don’t keep your search text.
- Maps: our server fetches map data from OpenFreeMap.
- Elevation: our server fetches height data from Mapterhorn for prints that show relief or contours.
Cloudflare carries the traffic to our site on our behalf, as our processor, so it handles your IP address and what you send us, including your search text.
If you email yourself a design
“Email me this design” sends one email to the address you type, with a link to your design. We send it through ZeptoMail, Zoho’s email service, in the EU. We don’t keep your address or the design afterwards; ZeptoMail keeps a delivery record (the address, the subject and whether it arrived) for 60 days, but not the email itself. It isn’t a mailing list, and we won’t write again.
If you ask us to find a route (“Don’t have a route?”), we keep your email address, what you tell us about the route and the link to your design, so we can find it and send it back to you. We delete them 90 days after you ask, or straight away if you delete your account.
If you sign in to an account
An account is optional. It holds your email address, when you last used it, any designs you save to it, and, if you add one, your password, which we store only as a scrambled hash. To sign in, we email you a single-use code. We show you every paid order placed with your email address, including orders you placed before signing in. We use this data to provide the account you asked for, which is our contract with you. Accounts are for people aged 18 or over.
You can download your data or delete your account yourself from your account page. If you don’t use your account for 2 years, we email you, and delete it 30 days later unless you sign in. Deleting your account removes your list of saved designs, and removes your name, address, email and designs from your past orders. Your photos are then deleted by our daily clean-up once they’re 7 days old. We keep the rest of the order, without anything that links it to you, for as long as tax law requires.
If you sign up for emails
You only get our emails if you ask for them, by ticking the box at checkout or in your account, or with the form at the bottom of our pages. We record when you agreed and the words you agreed to. If you sign up, we send your email address to EmailOctopus, the service that sends our emails. EmailOctopus emails you first to ask you to confirm. Once you confirm, it sends you our emails about new designs and offers. We use your address only for these emails, because you asked for them (your consent).
Our emails have no tracking: we don’t record whether you open them or which links you click. Every email has a link to unsubscribe, or you can email us and we’ll remove you. We keep your address until you unsubscribe. After that, our own record of your consent keeps only a scrambled copy of your address, with when you agreed and when you left, and EmailOctopus keeps your address marked as unsubscribed so you aren’t emailed again.
When you order
Your basket is kept in your own browser (its local storage), not on our server and not in a cookie. It holds only the designs you added, their quantities and that you approved them.
When you check out, we store your order on our server: your email address, your country, the delivery name and address (for prints), your phone number if you give one (only for the courier), each design as you made it, the prices, any discount and VAT, and, for a digital file, when you asked us to send it straight away. We use it to make and deliver your order, which is our contract with you, and keep it because tax law requires. We don’t send your design to our payment provider: it gets only an order number.
Once you’ve paid, we make your finished files from your design: a PNG and a PDF for a digital print, and a print file for a print. We keep digital files for 30 days, for as long as your download link works, and then delete them. We keep a print file until 60 days after we send your print, in case it arrives damaged and we need to make it again. If your order is refunded, or you delete your account, we delete its files straight away.
We delete an order that was never paid after 30 days. We keep a paid order for 7 years, or 11 years if it includes a digital file, to cover the tax record periods.
Who we share data with
These services help us run the shop. Each gets only what it needs for the job in the table, and none of them may use it for anything else.
| Service | What it gets | Why |
|---|---|---|
| Stripe | Your order number and total from us. You give your card details to Stripe on its own page; we never see them. | To take your payment, and to refund it |
| Gelato | For delivery to Sweden or Belgium, your basket, country and postcode when you press Review order, to price delivery. Once you’ve paid for a print, the delivery name and address, your email address, your phone number if you gave one, and the print file. | To print and deliver your order |
| The delivery company | Your name, delivery address, email address and phone number (if you gave one), from Gelato, which chooses the company for your parcel (for example Australia Post, Royal Mail, DHL or UPS). | To deliver your parcel and send you delivery updates |
| Cloudflare | Your IP address and what you send our site. Print files on their way to Gelato, deleted within 8 days. Backup copies of our database (orders and accounts), stored in the EU. | To carry and protect traffic to our site, to store print files and to keep backups |
| Fly.io | Everything our site holds: your designs, photos, orders, account and the emails we send, on our server in London. | To host our site |
| ZeptoMail (Zoho, EU) | Your email address and the email we send you. It keeps a delivery record (address, subject, whether it arrived) for 60 days, not the email itself. | To send order, sign-in and design emails |
| EmailOctopus | Your email address, only if you sign up for our emails. | To send the emails you asked for |
| Photon (komoot), OpenFreeMap, Mapterhorn | The place you search for, and which map and height tiles are needed, from our server. Never your IP address. | Place search, maps and heights in the editor |
Gelato keeps its own copy of what it needs to make and send your order, and the delivery company’s own privacy notice covers its delivery messages.
Where your data goes
We’re based in Australia. Our server and its data are in London. Some of the services above are based elsewhere, and each one’s agreement with us protects your data when it leaves the UK:
- Fly.io, Cloudflare and Stripe are US companies. They’re covered by standard contractual clauses, and Cloudflare and Stripe also by the UK–US data bridge.
- Gelato is based in Norway, and ZeptoMail and EmailOctopus store data in the EU. The UK treats Norway and the EU as giving your data adequate protection.
- Our database backups are stored in the EU.
Why we’re allowed to use your data
| What we do | Lawful basis |
|---|---|
| Make, deliver and refund your order; keep your photos for it; run your account | Our contract with you |
| Keep order records for tax | A legal obligation |
| Marketing emails | Your consent, which you can withdraw at any time |
| Keep the site secure and stop abuse, such as counting requests from one address | Our legitimate interest in a safe shop |
| Use other people’s details that you put in a design | Our legitimate interest in making the order you asked for |
How we keep your data safe
Every connection to our site is encrypted. Our server’s storage is encrypted, passwords are stored only as a scrambled hash, and only we can reach the data. We make no decisions about you by automated means alone.
Your rights
You have the right to access your personal data, to have a copy you can take elsewhere, and to ask us to correct, delete or restrict it, or to object to how we use it. Where we rely on your consent, you can withdraw it at any time. If you sign in, you can download or delete your data from your account page, using the email address on your orders. For anything else, email us. We reply within one month.
If you’re unhappy with how we’ve handled your data, please send us a complaint. In the UK you can also complain to the Information Commission at ico.org.uk, and in the EU to your country’s data protection authority.
If you live in Australia: we’re a small business and are not currently bound by the Australian Privacy Principles, but we handle your data to the standard on this page. Your data is stored in the UK and handled by the services listed here, including in the US. You can ask to see or correct it, or complain, at hello@storiedwall.com. If you’re not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.
Changes to this notice
We’ll update this notice when what we do with your data changes, and show the new version here.