Collector Access and marketing emails
When you select the clearly labelled Collector Access email subscription button, we save your email address, signup date and source, consent wording/version, subscription status and personal first-order discount code in a private Cloudflare database. Brevo processes the email address and sends your welcome code and the marketing emails you agree to receive. We rely on your consent for marketing and use the code/order records to operate the welcome offer and prevent repeated redemption. We do not share signup email addresses with Meta or Google.
Every marketing email includes an unsubscribe link. Unsubscribing stops marketing and does not invalidate an unused welcome code. We keep subscribed contact records until you unsubscribe or request deletion and review inactive contacts. A minimal suppression record and offer-redemption record may be retained to respect your preferences and prevent reuse. Contact info@mizunaart.com to exercise your rights.
With optional analytics consent, a successful first registration also records a signup event with its popup/footer source, without the email address. Aggregate registrations are available to the owner even when analytics is declined. Brevo may process information internationally under its published data-processing terms and transfer safeguards.
Who is responsible for your information?
Lukas Roe, trading as Mizuna Art, is responsible for the information described here. Our business address is 6 South Road, Baldock, SG7 6BY, Hertfordshire, United Kingdom. Contact info@mizunaart.com or +44 7709 789402. Lukas prints and dispatches the artwork himself.
Information we use and why
- We use your name, email, delivery address, selected artwork and payment status to process and fulfil your order, arrange delivery and provide support. This is necessary to perform your contract or take steps you request before purchasing.
- We use enquiries to respond and provide customer service, relying on our legitimate interests or steps you request before a purchase.
- We keep necessary transaction records to meet tax and accounting obligations.
- We use limited technical and security information to operate and protect the checkout, relying on our legitimate interests in a secure service.
Checkout and payment information
Artwork purchases use our custom checkout powered by Stripe. Contact and delivery details are entered into Mizuna’s form; payment details are entered into Stripe-hosted fields or the payment provider you choose. Card numbers, expiry dates and security codes go directly to Stripe; Mizuna does not store these card details. Stripe and the payment provider you select process payment and authentication information. Stripe also processes some information as a controller for its own security, fraud prevention and regulatory purposes.
Cloudflare hosts and protects the website and stores Mizuna order records. After a verified successful payment, Mizuna stores your email, delivery details, artwork format, amount and order/payment references in its order database. Billing and payment-method details remain with Stripe. Wix continues to provide catalogue services and may hold records from earlier purchases. Current artwork purchases on this website use Stripe.
Printing and delivery
Lukas Roe prints and dispatches your artwork. For unframed orders, delivery details are shared with Royal Mail. Framed orders use UPS or FedEx. We share only the details needed to arrange and complete delivery, such as your name, address and relevant delivery contact information. There is no automated carrier integration in this checkout.
Cookies and technical information
The Stripe checkout sets an essential mizuna_live_checkout cookie, or mizuna_test_checkout on the isolated test route. It contains a random value used to protect checkout and order-status access in your browser. It is HttpOnly, Secure and SameSite=Strict and expires after two hours. The shared artwork cart uses sessionStorage to remember selected artworks, formats and quantities for up to two hours in the current browser tab/session. This essential cart storage contains no contact or payment details. The database stores a digest rather than the cookie value.
Stripe and your selected wallet/payment provider may use cookies and device information to provide payment services, authentication and fraud prevention. The website also uses Cloudflare hosting and Google Fonts. Optional Meta Pixel and Google Ads measurement are used only after advertising consent. Cookie settings remember your preferences in essential local storage for up to 180 days. Optional first-party Mizuna analytics, hosted by Cloudflare, runs only with your consent. It records browser family/version, operating system, device family, screen and viewport size, language/timezone, approximate IP-derived city/region/country and network provider, referring domain, arrival source and owner/test or automation signals. Location can be inaccurate, especially with mobile networks or VPNs. Raw IP addresses, full user-agent strings, full referring URLs and device fingerprints are not stored. These details do not prove a visitor’s identity. It measures pages, active and section viewing time, artwork choices, cart/checkout progress, errors and verified purchases with campaign tags and random identifiers. Behaviour records contain no typed form contents, customer contacts, raw IP addresses or card details, and we do not use session recordings. Consented analytics may associate an internal order reference, amount and format with a browsing session. Browser identifiers last up to 30 days and the analytics-session cookie expires after 30 minutes of inactivity. Detailed measurement is retained for 90 days, with cleanup on the next collection or private-report request. Withdrawal stops collection and removes analytics browser storage; it does not automatically delete previously collected lawful records. With separate advertising consent, Meta receives page visits, artwork identifiers, cart/checkout events and server-verified purchase values in USD, with device/browser information, IP address, page URLs/referrers and its cookie identifiers. Meta may associate this activity with your Facebook or Instagram account to measure and improve ads. We do not send typed form values, customer contact/address details or card information to the pixel. Meta Platforms Ireland Limited provides the service and publishes its privacy policy (https://www.facebook.com/privacy/policy/) and business tools/transfer terms (https://www.facebook.com/legal/technology_terms). Meta-controlled retention follows those notices. Accessible Meta cookies normally last up to 90 days. Our browser purchase-deduplication records are removed after 90 days when consented tracking next runs, and both are removed on withdrawal; previously sent provider data is not automatically erased. Automatic advanced matching and automatic event detection are disabled. Google Ads receives consented page/artwork views, cart and checkout events, server-verified USD purchase values, random order references and technical/ad-attribution identifiers, including IP address, browser information, page URL and Google click/cookie IDs. Google Ireland Limited provides the service under its privacy policy (https://policies.google.com/privacy) and advertising data-processing terms (https://business.safety.google/adsprocessorterms/), including international processing safeguards. Google ad cookies and our purchase-deduplication storage last up to 90 days; withdrawal stops further events and removes accessible storage, without automatically deleting provider-held data. Google contact matching is disabled. The Google tag loads only after advertising consent, and Google Analytics is not connected. We ask for fresh consent for the new Google provider. You can change your preferences through Cookie settings at the bottom of every page. The cookie policy explains the storage and controls in more detail.
Sharing and international processing
We do not sell personal information. We share it with the service providers described above only where needed to provide their services, fulfil your order, handle support or meet legal obligations. Some provider processing takes place outside the United Kingdom. Stripe and Cloudflare publish data-processing and transfer terms covering appropriate safeguards, including standard contractual clauses and the UK International Data Transfer Addendum where applicable. Provider notices describe their own processing and retention.
How long we keep information
Necessary accounting and transaction records are kept for at least five years after the 31 January submission deadline of the relevant tax year, and longer where an unresolved dispute, enquiry or legal obligation requires it. Delivery and support information is reviewed when no longer needed for fulfilment, exchanges or resolving a complaint.
The checkout cookie expires after two hours. Expired or failed checkout records without a purchase are kept for troubleshooting and security review. Expired and failed records older than 30 days are removed when the checkout configuration endpoint runs. Open or unresolved records require separate reconciliation and review. Unresolved payments are retained until their outcome is reconciled. We review and remove records that no longer serve these purposes; provider-controlled payment and security records follow the relevant provider’s retention policy.
Your rights and complaints
Depending on why we use your information, you may ask for access, correction, deletion, restriction or a portable copy, or object to some processing. These rights are subject to legal exceptions. Where processing relies on consent, you may withdraw it. Contact us using the details above. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint/.
If you live in the United States
We do not sell your personal information, and we do not share it for advertising unless you opt in. Meta and Google advertising measurement runs only after you accept advertising cookies, and you can withdraw that choice at any time in Cookie settings.
Whichever state you live in, you can ask us to tell you what personal information we hold about you, to correct it or to delete it, and to stop marketing emails. Email info@mizunaart.com and we will respond within 45 days. We will not treat you differently for making a request.
Our website does not respond to browser Do Not Track signals. Optional analytics and advertising never run unless you have consented.
Your information is processed in the United Kingdom and by our service providers in the United States and elsewhere, as described above.
This website is not directed to children under 13, and we do not knowingly collect their personal information.
Updates
Effective 13 October 2026. We will update this policy when payment, fulfillment, analytics or marketing services change, and show the new effective date here.