Privacy policy

Last updated 18 July 2026

This Privacy Policy explains how Invecom Oy processes personal data in the paintbynumbers.fi and paintbynumbers.eu online stores, customer service, personalised products made from customer images, and the Diamond Painting Editor.

In short:

• We use personal data to fulfil orders, provide customer service, keep the service secure, and meet legal obligations.
• Images uploaded for personalised products are stored privately and automatically deleted according to the schedule below.
• Optional analytics, session recordings, and advertising rely on your consent.
• You can change your cookie choices in the site’s cookie settings and exercise your privacy rights by contacting us.

1. Controller

Invecom Oy
Business ID: 2886184-9
Contact and operating address: Asemakatu 4, Asema 14
55700 Imatra
Finland

Privacy contact: Tuomas Marttinen
Email: info@paintbynumbers.eu
Finnish customer service: info@paintbynumbers.fi

2. Personal data we process

• Contact and customer data: name, contact details, addresses, language, country, and customer account information.
• Order and payment data: products, personalisation choices, order number, price, payment method and status, and delivery, return, refund, and complaint information. We do not receive your full payment card details.
• Messages and published content: customer service messages, attachments, reviews, display name, ratings, and images.
• Uploaded images: images uploaded for personalised products or the editor, previews, crops, temporary versions, and technical metadata needed for processing.
• Marketing and consent data: newsletter subscription, marketing choices, cookie consents, and changes to those choices.
• Technical and usage data: IP address, browser, device, operating system, identifiers, referring page, and page-view, search, click, scroll, cart, and purchase events.

An image of an identifiable person is personal data. Please do not send health information, identity documents, or other unnecessary sensitive data through the service.

3. Why and on what basis do we process data?

Information needed to fulfil and deliver an order is mandatory. Other information is voluntary, although not providing it may prevent us from supplying a feature you request.

4. Personalised products and the Diamond Painting Editor

We process an uploaded image only to provide the preview, editing, AI feature, customer service, or product manufacture you request. Please make sure you have the right to use the image and to submit the personal data of anyone shown in it.

Images are stored privately in Cloudflare R2 object storage. The application gives systems access only through time-limited or otherwise protected links. Do not share an image link with third parties.

• An image not attached to an order is scheduled for deletion after approximately 24 hours.
• An image attached to an order is scheduled for deletion 30 days after order confirmation.
• Editor images and temporary versions are scheduled for deletion within 30 days at the latest.

Cloudflare’s lifecycle deletion may complete shortly after the deadline. Vercel, which hosts the user interface, and Modal, which performs image processing, may process technical logs or temporary copies. If you choose an AI feature, the image may be sent to Google Gemini or OpenAI. R2 deletion rules do not apply to these services; they retain data only for as long as needed for processing, security, and troubleshooting under the provider’s applicable terms.

5. Shopify

Our stores are hosted on Shopify. Shopify processes store, customer, order, payment, device, and usage data to provide the service, maintain security, process payments, prevent fraud, and provide Shopify Enhanced Services. Shopify Payments or your chosen payment provider processes payment data under its own terms.

Shopify Network Intelligence is enabled. When the applicable consent has been given, Shopify Enhanced Services may use information about your interactions with this store, other Shopify merchants, and Shopify to personalise your experience, target advertising, and understand the performance of services and advertising. For these purposes, information may be shared with Shopify and other service providers and processed in other countries subject to the safeguards described in section 8. For visitors in the EU and EEA, advertising based on activity in this store, with other Shopify merchants, and with Shopify is based on consent. You can withdraw your consent at any time through the cookie settings.

For more information, see Shopify’s Consumer Privacy Policy. You can exercise your rights regarding data processed by Shopify through the Shopify Privacy Portal.

6. Cookies, analytics, and advertising

Necessary cookies support functions such as the shopping cart, sign-in, checkout, security, and remembering consent choices. Optional cookies and similar technologies are used only with your consent. You can accept, reject, or later change your choices through the cookie banner or the site’s cookie settings.

If a new visitor rejects optional cookies, Google, Meta, TikTok, and Pinterest marketing tags are blocked. The Clarity loader may load, but session recording does not start without consent. If you withdraw consent after previously granting it, a Google tag that has already loaded may send one limited, cookieless denied-state event (for example, gcs=G100, npa=1, and user_engagement) for aggregate measurement or modelling. Optional Google tags are then blocked until you consent again. Third-party cookies set before withdrawal may remain until they expire or you delete them in your browser.

7. Who receives personal data?

We disclose personal data only as needed to provide the service. Recipients may include Shopify and payment providers; fulfilment, shipping, customer service, email, and review partners; Cloudflare, Vercel, and Modal; and, based on your consent, Google, Microsoft, Meta, TikTok, and Pinterest. We may also disclose data when required by law or in connection with a business transaction subject to appropriate safeguards.

Depending on their role, service providers act as our processors or as independent controllers.

8. Transfers outside the EU and EEA

Some providers process data outside the EU or EEA, particularly in the United States. Transfers rely on a European Commission adequacy decision, the EU–US Data Privacy Framework where the recipient participates, the European Commission’s Standard Contractual Clauses, or another lawful transfer mechanism. We apply supplementary technical and organisational safeguards where necessary.

9. How long do we retain data?

• Order and customer service data is retained for the customer relationship and for as long as needed for complaints or legal claims.
• Accounting records are retained for six or ten years, depending on the record, as required by law.
• Customer account data is retained until the account is deleted or has been inactive for an extended period, unless law requires longer retention.
• Marketing and consent data is retained until you withdraw consent, object to marketing, or the data is no longer needed. Evidence of a choice may be retained for the applicable limitation period.
• Image and cookie retention periods are described in sections 4 and 6.

When data is no longer needed, it is deleted or anonymised.

10. Where do we obtain data?

We receive data mainly from you when you place an order, create an account, upload an image, use the editor, make cookie choices, subscribe to messages, or contact us. Technical data is created when you use the service. We also receive information from payment and shipping providers, Shopify, and—based on your consent—analytics and advertising providers.

11. Profiling and automated processing

With your consent, analytics and advertising providers may combine events to create audiences, measure advertising, and personalise content. Shopify and payment providers may use automated risk assessment to prevent fraud. We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you.

12. Your rights

Depending on the circumstances, you may have the right to access, correct, or delete your data; restrict or object to processing; and receive data you provided in a machine-readable format. You may withdraw consent at any time. Withdrawal does not affect processing that was lawful before it.

Send requests to info@paintbynumbers.eu. We may ask for information needed to verify your identity and normally respond within one month. You also have the right to complain to the Office of the Data Protection Ombudsman in Finland or your local supervisory authority.

13. Security

We protect personal data through access controls, encrypted connections, private object storage, time-limited links, logging, backups, and contractual and security requirements for service providers. Access is limited to people and partners who need the data for their work. No system is entirely risk-free.

14. Changes to this Policy

We may update this Policy when our services, providers, or legal requirements change. We publish the current version on this page and show its revision date at the top. If a change materially affects your rights, we will also provide notice in another reasonable way.