Privacy policy

Who this policy covers

This privacy policy applies to Papercut — Shop & Digital Studio, its shopping website, and its customer support and service-project records. The privacy contact is the Papercut studio team through the Contact & support form linked on this page. Please choose Privacy or Account deletion.

Information we collect

When you register, you provide your name, email login ID, password, and 8-digit account PIN. Passwords and PINs are stored as separate salted, server-protected hashes. A private recovery key is generated once; we store its hash rather than the original key. Signed-in sessions use expiring, secure, HttpOnly cookies. We collect the contact number and delivery address you enter, your bag and order details, personalization instructions, artwork you choose to upload, project briefs, and support or privacy requests. Payment records contain an order reference, amount, provider reference, and payment status. We do not collect card numbers, CVV, banking passwords, or wallet PINs.

Our hosting and payment providers may process network, browser, and security information to operate their services. Our own request limits use an account identifier or a hashed network identifier. This website does not include advertising pixels, advertising SDKs, or cross-site marketing tracking.

How we use it

We use this information to provide your account, price and produce your order, deliver physical products, scope and deliver professional projects, reconcile payments, respond to you, prevent misuse, and meet recordkeeping duties. Processing supports your requested transaction, legitimate operational and security needs, applicable legal obligations, or a separate consent where required. An email login ID is not represented as a verified email address. No email verification or emailed password-reset feature is currently provided; account recovery uses your saved private key or a manual ownership review. Checkout does not subscribe you to marketing. We do not sell personal information.

Providers and sharing

OpenAI/ChatGPT Sites provides hosting; Papercut manages its own customer accounts and sign-in; Cloudflare infrastructure stores site records and private artwork. Maya processes hosted payments when enabled. A courier receives the recipient name, delivery address, contact number, and parcel information needed to deliver. Authorized studio staff and production partners receive only information needed for fulfilment. We may disclose records where legally required or needed to resolve a genuine payment dispute.

These providers may process information outside the Philippines. We use access controls and limit disclosures to the stated purposes. External providers also publish their own privacy notices.

Security and browser storage

Customer orders and artwork require account authorization; studio administration is restricted. Transport uses HTTPS on the hosted site. No system can promise absolute security. Do not upload identity documents, payment credentials, or information unrelated to your order.

Your guest bag is stored in this browser’s local storage. Form drafts and support-request access codes use session storage. Signed-in bags and submitted records are stored on the server. Clearing browser storage removes local copies but does not erase submitted orders or your account. Papercut uses essential session and short-lived login-challenge cookies. No full customer session is created until both the password and PIN checks succeed. Browser drafts do not store passwords or PINs.

Retention and deletion

We keep account information and credential hashes while needed to provide the account and its orders. Session cookies expire after 12 hours, and a password-to-PIN challenge expires after 5 minutes. Recovery with the private recovery key replaces both credentials and invalidates earlier sessions and challenges. Order, payment, and dispute records may be retained for applicable accounting, tax, fraud-prevention, or legal obligations. They are restricted to those purposes rather than used for marketing. Artwork and project files are kept for fulfilment, revisions, and support, and may be deleted when no longer needed. Contact us if you want a specific upload removed.

After a verified deletion request, we remove the Papercut profile, saved bag, and associated personal data that is not required for a lawful retained purpose. We explain any retained categories, reason, and applicable retention period in the request response. Deletion is reviewed manually; our target is completion within 30 calendar days after reasonable ownership verification, with notice of any lawful extension. Provider backups follow their retention lifecycle and are not used to restore a deleted account for normal operations.

Your choices and rights

You may request access, correction, a copy, objection to processing, withdrawal of optional consent, or deletion through the form. A support reference and private access code let you check the response without reinstalling an app. Reasonable ownership checks protect against someone else deleting your data. You may also raise a concern with the Philippine National Privacy Commission.

This store is not directed to children under 13. Purchasers must be adults or act with appropriate parent or guardian authorization. If a child submitted personal information without authorization, use the privacy form so we can investigate and remove it where appropriate.

Changes and future apps

We update this notice when our practices change and show the updated date. Any future iOS or Android app must provide this notice within the app and publish additional disclosures for its actual permissions, SDKs, analytics, and data collection before release. No Google or Apple sign-in or native-app data collection is represented as active by this website.