Privacy policy
Last updated 12 October 2026
This Privacy Policy explains how Invecom Oy processes personal data in the paintbynumbers.fi and paintbynumbers.eu online stores, customer service, personalised products made from customer images, and the Diamond Painting Editor.
In short:
- We use personal data to fulfil orders, provide customer service, keep the service secure, and meet legal obligations.
- Photos for products made from your own photo are partly processed by AI services (OpenAI and Google) and are not used for AI training. Photos are deleted after about 30 days.
- Optional analytics, session recordings, and advertising rely on your consent.
- You can change your cookie choices in the site’s cookie settings and exercise your privacy rights by contacting us.
1. Controller
Invecom Oy
Business ID: 2886184-9
Contact and operating address: Asemakatu 4, Asema 14
55700 Imatra
Finland
Privacy contact: Tuomas Marttinen
Email: info@paintbynumbers.eu
Finnish customer service: info@paintbynumbers.fi
2. Personal data we process
- Contact and customer data: name, contact details, addresses, language, country, and customer account information.
- Order and payment data: products, personalisation choices, order number, price, payment method and status, and delivery, return, refund, and complaint information. We do not receive your full payment card details.
- Messages and published content: customer service messages, attachments, reviews, display name, ratings, and images.
- Uploaded images: images uploaded for personalised products or the editor, previews, crops, temporary versions, and technical metadata needed for processing.
- Marketing and consent data: newsletter subscription, marketing choices, cookie consents, and changes to those choices.
- Technical and usage data: IP address, browser, device, operating system, identifiers, referring page, and page-view, search, click, scroll, cart, and purchase events.
An image of an identifiable person is personal data. Please do not send health information, identity documents, or other unnecessary sensitive data through the service.
3. Why and on what basis do we process data?
| Purpose | Legal basis |
|---|---|
| Orders, payments, deliveries, returns, customer accounts, customer service, and processing custom images and editor projects | Performance of a contract or steps requested before entering into a contract |
| Accounting, taxation, and other legal requirements | Legal obligation |
| Fraud prevention, security, and legal claims | Our legitimate interest in protecting customers, the service, and our business |
| Review requests and reviewing and publishing customer reviews | Our legitimate interest in collecting genuine feedback; you may object |
| Email marketing | Consent or marketing to existing customers where permitted by law; you may opt out at any time |
| Optional analytics, session recordings, advertising measurement, remarketing, and personalisation | Consent |
| Recording, communicating, and honouring consent choices and limited consent-mode status signals | Our legitimate interest in managing and demonstrating privacy choices; this does not permit optional identifiers or advertising profiles |
Information needed to fulfil and deliver an order is mandatory. Other information is voluntary, although not providing it may prevent us from supplying a feature you request.
4. Products made from your own photo and the Diamond Painting Editor
We use your photo only to design and make the painting you ordered and for customer service related to that order. We do not publish the photo or use it for marketing without your permission. The processing is based on your order: we cannot make the product without the photo.
- The photo is stored privately in Cloudflare's cloud storage.
- The photo may be processed with AI using OpenAI and Google services. These services do not use the photo to train their AI and may process it in the United States (see section 8).
The photo and the files made from it are deleted about 30 days after upload. A photo that is not added to an order is deleted after about three days. The AI services may keep the photo for abuse monitoring for up to 55 days.
If other people appear in the photo, we also process their image so that we can fulfil the order (legitimate interest). Please make sure you have the right to use the photo.
Diamond Painting Editor. The editor creates the diamond pattern in your browser, and the photo you choose never leaves your device. An unfinished design is saved only in your browser (from a copy of the photo without location or other metadata). You can delete it on the editor's start screen, and the editor deletes work older than 30 days. When you add a design to the cart, the finished diamond pattern and its preview are stored with Cloudflare. The pattern, the preview and the print files of an ordered design are deleted within 30 days of adding it to the cart, also if no order is placed. If you use the editor's AI picture, the text you type is sent to OpenAI or Google to create the picture, and the created picture is stored with Cloudflare and deleted within 30 days.
5. Shopify
Our stores are hosted on Shopify. Shopify processes store, customer, order, payment, device, and usage data to provide the service, maintain security, process payments, prevent fraud, and provide Shopify Enhanced Services. Shopify Payments or your chosen payment provider processes payment data under its own terms.
Shopify Network Intelligence is enabled. When the applicable consent has been given, Shopify Enhanced Services may use information about your interactions with this store, other Shopify merchants, and Shopify to personalise your experience, target advertising, and understand the performance of services and advertising. For these purposes, information may be shared with Shopify and other service providers and processed in other countries subject to the safeguards described in section 8. For visitors in the EU and EEA, advertising based on activity in this store, with other Shopify merchants, and with Shopify is based on consent. You can withdraw your consent at any time through the cookie settings.
For more information, see Shopify’s Consumer Privacy Policy. You can exercise your rights regarding data processed by Shopify through the Shopify Privacy Portal.
6. Cookies, analytics, and advertising
Necessary cookies support functions such as the shopping cart, sign-in, checkout, security, and remembering consent choices. Optional cookies and similar technologies are used only with your consent. You can accept, reject, or later change your choices through the cookie banner or the site’s cookie settings.
| Service | Use and typical retention |
|---|---|
| Shopify | Necessary store functions, security, and consent settings; from the session up to about two years |
| Google Analytics and Google Ads | Analytics and advertising measurement; up to about two years |
| Microsoft Clarity | Session recordings, clicks, and heatmaps; ordinary recordings for 30 days and aggregates and marked recordings for up to about nine months |
| Meta | Advertising measurement and remarketing; usually about 90 days, with some identifiers lasting up to about two years |
| TikTok | Advertising measurement and remarketing; up to about 13 months |
| Advertising measurement and remarketing; up to about one year |
If a new visitor rejects optional cookies, Google, Meta, TikTok, and Pinterest marketing tags are blocked. The Clarity loader may load, but session recording does not start without consent. If you withdraw consent after previously granting it, a Google tag that has already loaded may send one limited, cookieless denied-state event (for example, gcs=G100, npa=1, and user_engagement) for aggregate measurement or modelling. Optional Google tags are then blocked until you consent again. Third-party cookies set before withdrawal may remain until they expire or you delete them in your browser.
Ad personalisation and Google. With your consent, we and our advertising partners, such as Google and Meta, use cookies and mobile advertising identifiers for both personalised and non-personalised advertising, for example ad targeting, remarketing, frequency capping, advertising measurement, and fraud prevention. For information on how Google uses personal data when you use its partners’ sites or apps, see Google’s Business Data Responsibility site: https://business.safety.google/privacy/. You can withdraw your consent at any time through the site’s cookie settings.
7. Who receives personal data?
We disclose personal data only as needed to provide the service. Recipients may include Shopify and payment providers; fulfilment, shipping, customer service, email, and review partners; Cloudflare, Vercel, and Modal; OpenAI and Google for the AI processing of products made from your own photo; and, based on your consent, Google, Microsoft, Meta, TikTok, and Pinterest. We may also disclose data when required by law or in connection with a business transaction subject to appropriate safeguards.
Depending on their role, service providers act as our processors or as independent controllers.
8. Transfers outside the EU and EEA
Some providers process data outside the EU or EEA, particularly in the United States. Transfers rely on a European Commission adequacy decision, the EU–US Data Privacy Framework where the recipient participates, the European Commission’s Standard Contractual Clauses, or another lawful transfer mechanism. We apply supplementary technical and organisational safeguards where necessary.
You can get a copy of the standard contractual clauses we rely on by writing to info@paintbynumbers.eu.
9. How long do we retain data?
- Order and customer service data is retained for the customer relationship and for as long as needed for complaints or legal claims.
- Accounting records are retained for six or ten years, depending on the record, as required by law.
- Customer account data is retained until the account is deleted or has been inactive for an extended period, unless law requires longer retention.
- Marketing and consent data is retained until you withdraw consent, object to marketing, or the data is no longer needed. Evidence of a choice may be retained for the applicable limitation period.
- Image and cookie retention periods are described in sections 4 and 6.
When data is no longer needed, it is deleted or anonymised.
10. Where do we obtain data?
We receive data mainly from you when you place an order, create an account, upload an image, use the editor, make cookie choices, subscribe to messages, or contact us. Technical data is created when you use the service. We also receive information from payment and shipping providers, Shopify, and—based on your consent—analytics and advertising providers.
11. Profiling and automated processing
With your consent, analytics and advertising providers may combine events to create audiences, measure advertising, and personalise content. Shopify and payment providers may use automated risk assessment to prevent fraud. We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you.
12. Your rights
Depending on the circumstances, you may have the right to access, correct, or delete your data; restrict or object to processing; and receive data you provided in a machine-readable format. You may withdraw consent at any time. Withdrawal does not affect processing that was lawful before it.
Send requests to info@paintbynumbers.eu. We may ask for information needed to verify your identity and normally respond within one month. You also have the right to complain to the Office of the Data Protection Ombudsman in Finland or your local supervisory authority.
13. Security
We protect personal data through access controls, encrypted connections, private object storage, time-limited links, logging, backups, and contractual and security requirements for service providers. Access is limited to people and partners who need the data for their work. No system is entirely risk-free.
14. Changes to this Policy
We may update this Policy when our services, providers, or legal requirements change. We publish the current version on this page and show its revision date at the top. If a change materially affects your rights, we will also provide notice in another reasonable way.