Privacy Policy
Last updated
The short version
- We collect what we need to make and deliver your order, including the photos and text you upload.
- We share data only with the services that run the store (payments, production, hosting), never to sell it.
- Uploaded photos and AI images are deleted 90 days after delivery, or sooner if you ask.
- You can ask to see, correct or delete your data at any time.
This summary is here to help. The full text below is what applies.
This policy explains what personal data Sonaday collects, why, who we share it with, how long we keep it, and the rights you have. It's written to meet the EU and UK General Data Protection Regulation (GDPR and UK GDPR) and US state privacy laws, including the California Consumer Privacy Act as amended by the CPRA.
1. Who is responsible for your data
The controller of your personal data is Janzay LLC, trading as Sonaday, a Wyoming (USA) limited liability company.
- Address: [[BUSINESS_ADDRESS]]
- Email for privacy questions: support@sonaday.com
2. What we collect
| Data | Examples | Where it comes from |
|---|---|---|
| Contact details | Name, email address, phone number (if given) | You |
| Shipping details | Recipient name and address | You |
| Order details | Products, options, prices, order history, design previews and your approval at checkout | You and our systems |
| Payment information | Payment status, last four digits, card type | Our payment providers. We never see your full card number. |
| Your uploads and text | Photos you upload, names, dates, places and messages you type | You |
| AI Studio data | Prompts you write and the AI-generated images | You and the AI models |
| Reviews | Your star rating, what you write, an optional photo and, only if you choose, your first name and last initial | You |
| Launch list and contact form | Email, the page you signed up from, your marketing choice, messages you send | You |
| Device and usage data | IP address, browser type, pages viewed, cookies | Your device. See our Cookie Policy. |
Photos you upload may show other people, including children. Please only upload photos you have the right to use.
3. Why we use it, and our legal bases
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Making, previewing, delivering and supporting your order (including order confirmations) | Contract |
| Taking payment and preventing fraud | Contract; legitimate interests (keeping the store safe) |
| Moderating uploads and prompts for our content rules | Legitimate interests (preventing illegal and infringing content) |
| Answering your messages | Contract or legitimate interests |
| Asking for a review once, about a day after delivery, and showing the reviews you write | Legitimate interests (helping other gift-givers choose). It's one email you can ignore; ask us any time to remove your review |
| Emailing you when we launch (launch list) | Legitimate interests, because you asked us to |
| Gift ideas and reminders (marketing emails) | Consent: only if you ticked the box. You can unsubscribe any time. |
| Non-essential cookies (analytics, marketing) | Consent |
| Keeping tax and accounting records, responding to legal requests | Legal obligation |
4. Who we share it with
We share personal data only with the service providers that help us run Sonaday, and only for the purposes above. They act on our instructions (as processors) or, for payments, under their own privacy policies.
| Provider | What they do | What they receive |
|---|---|---|
| Shopify | Checkout and payments (Shopify Payments) | Contact, shipping, order and payment details |
| Airwallex | Payments | Contact and payment details |
| Printful | Production and shipping | Your print file (which includes your photos and text) and the shipping address |
| Supabase | Database and file storage | Order data, uploads, launch list and contact messages |
| Cloudflare | Website hosting, delivery network and security | IP address and technical data |
| OpenRouter and the AI model providers it routes to | AI Studio edits, only if you use the AI Studio | Your photo and your prompt |
| [[EMAIL_PROVIDER]] | Sending order and launch-list emails | Name and email address |
| Shipping carriers | Delivering your parcel | Recipient name, address and, where needed, phone number |
We may also share data if the law requires it, to protect our rights, or with a buyer if the business is ever sold (under the same protections).
We don't sell your personal information, and we don't share it for cross-context behavioural advertising.
5. International transfers
Sonaday is a US company, and many of our providers are based in the United States. When we transfer personal data from the EU, the UK or Switzerland to countries without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum), or on a provider's certification under the EU-US Data Privacy Framework where applicable.
6. How long we keep it
- Uploaded photos and AI images: deleted 90 days after delivery, unless you ask us to delete them sooner or a reprint claim is still open (then we delete them once it's settled).
- Reviews and review photos: shown for as long as the review is up. Ask us any time to remove yours, and we delete it and its photo.
- Order records (what you bought, prices, addresses, invoices): kept as long as tax and accounting law requires, typically up to 7 years.
- Launch-list data: kept until you unsubscribe or ask us to delete it.
- Contact messages: kept for up to 2 years after our last reply, unless they relate to an order.
- Spam-protection records: a salted one-way hash of your IP address, used only to limit repeated form submissions and deleted regularly.
7. Children
Sonaday isn't directed at children under 16, and we don't knowingly collect data from them. Parents and relatives often upload photos of children for gifts. We use those photos only to make that order, and delete them under the retention rule above.
8. Your rights
Everyone can ask us to see, correct or delete their data, and can unsubscribe from marketing at any time.
In the EU, the UK and similar places, you have the right to:
- access your data and get a copy;
- correct inaccurate data;
- delete your data ("right to be forgotten");
- receive your data in a portable format;
- object to processing based on legitimate interests;
- restrict processing in some cases;
- withdraw consent at any time, without affecting what we did before; and
- complain to your data protection authority (in the UK, the Information Commissioner's Office).
In California and other US states with privacy laws, you have the right to know what we collect and how we use it, to delete it, to correct it, and to opt out of the sale or sharing of personal information (we don't sell or share it), and we won't treat you differently for using these rights. You can use an authorised agent.
To use any of these rights, email support@sonaday.com. We'll reply within one month (or 45 days where US law allows) and may need to confirm your identity first.
9. Security
We use encryption in transit (HTTPS), access controls, and providers with strong security practices. Database tables are locked so they can only be read or written by our servers, never directly from a browser. No system is perfectly secure, but we work to protect your data and will tell you and the authorities about a breach where the law requires.
10. Cookies
See our Cookie Policy. You can change your choice any time with "Cookie settings" in the footer.
11. Changes
We'll update this policy when our practices change and change the "Last updated" date above. If a change is significant, we'll tell you by email or on the site.
12. Contact
Janzay LLC, trading as Sonaday · [[BUSINESS_ADDRESS]] · support@sonaday.com