Privacy policy

This policy applies to personal information processed through the StickerMigo storefront, customer accounts, custom project workflow, checkout, order support, and related communications. The store operator is responsible for the processing it determines; a service provider may be separately responsible for activity performed under its own terms.

The identity and legally required seller or privacy contact information for a production market should be presented with the applicable checkout and order records. Requests can begin through the verified route published on the contact page once that support channel is activated.

Depending on how you use StickerMigo, information may include:

• account and contact data, such as name, email, organization, authentication records, and communication preferences;
• project data, such as uploaded artwork, prompts, descriptions, intended use, preferences, generated outputs, selected design details, and rights confirmations;
• transaction data, such as cart contents, products, quantities, currency, discounts, order history, payment status, refunds, and provider references;
• delivery data, such as recipient, postal address, telephone number, service choice, tracking, and delivery events;
• support and compliance data, such as messages, photographs, defect reports, IP reports, consent records, and audit events;
• technical and security data, such as IP-derived request information, browser or device details, essential cookies, timestamps, error records, and minimized abuse signals.
• optional analytics data, when you choose analytics, such as pages viewed, interaction events, and browser or device measurement information processed through Google Analytics 4.

Please avoid placing sensitive personal information in artwork or prompts unless it is genuinely required for the product.

We use information to provide requested services, authenticate customers, maintain carts, prepare custom artwork, process orders, confirm payment, arrange delivery, provide support, prevent fraud or abuse, protect rights, keep business records, and comply with valid legal obligations.

Where applicable, processing is based on performing a requested transaction, taking steps requested before a transaction, legitimate operational or security needs, consent, or legal obligations. The appropriate basis depends on the information, feature, and law that applies.

Marketing consent is optional and should not be preselected. Withdrawing marketing consent does not stop operational messages needed for account security, project status, order confirmation, payment, delivery, or policy changes.

Configured providers process limited information for specific functions:

• PayPal receives checkout and transaction information needed to authorize, capture, reconcile, or refund a payment. StickerMigo stores payment status and provider references, not a full payment-card number.
• Google Analytics 4 (Google LLC) is an optional analytics provider. It receives analytics information only after a visitor affirmatively chooses analytics through the cookie banner; StickerMigo uses the resulting reports in aggregate to understand storefront use and improve the service.
• Transactional email services receive the recipient address and message content needed to send verification, project, order, or support communications.
• Database, storage, hosting, and queue services hold account, project, asset, order, and operational records needed to run the storefront.
• Carriers and production partners receive the order and delivery information needed to make, pack, or deliver an order.

Provider credentials and secret keys are operational secrets and are never intentionally included in customer-facing pages, uploads, analytics, or ordinary support messages.

Original uploads, generated outputs, production files, and private-product images are treated as private project objects. Access is limited through authenticated ownership or revocable, expiring links; sensitive access tokens are stored in protected form rather than exposed as permanent public file locations.

If you separately opt in to Community Creations, a prepared or generated product image and public listing copy may be displayed in the storefront, product feed, search metadata, and related promotion. The public listing does not publish your email address, customer ID, private project slug, raw access token, original upload, or private order details. You may request that the public edition be removed; the private customer product can remain available to you.

If a customer chooses an AI-assisted feature and that feature is configured, selected artwork, instructions, and technical parameters may be sent to a configured Qwen-compatible vision or image processor for analysis or generation. The processor receives what is needed for that task, not account passwords, PayPal credentials, or unnecessary complete delivery data.

Submitting custom artwork does not transfer ownership or give StickerMigo a general right to train a public model on it. Any third-party AI processing remains subject to the configured account terms and privacy controls for that provider.

Information may be disclosed to the providers above, professional advisers, insurers, auditors, a successor in a legitimate business transaction, or authorities when required by valid law. We may also share information when reasonably necessary to protect customers, investigate fraud, defend legal claims, or respond to a substantiated rights report.

Providers may process information in countries different from the customer's location. When required, the operator should use an appropriate contractual or legal transfer mechanism and assess the services enabled for the relevant market.

StickerMigo does not describe service-provider processing as a sale of customer artwork. If targeted advertising or activity legally treated as selling or sharing personal information is introduced, this policy and the available choices must be updated before that use.

Records are kept only as long as reasonably needed for the purpose collected, including active accounts and projects, fulfillment, reorders requested by customers, tax or accounting records, fraud prevention, rights compliance, disputes, security, and legal obligations. Different records therefore have different retention periods.

An essential cart may remain in the browser for up to 30 days. Private access links can expire or be revoked. Order snapshots, payment references, consent evidence, and audit records may need to outlast the visible customer project. When deletion is appropriate, information may be deleted, de-identified, or isolated from ordinary use.

Safeguards include access controls, protected session and link tokens, minimized analytics, encrypted sensitive email payloads, provider-side payment handling, and operational audit records. No internet service can promise absolute security.

Depending on applicable law, you may ask to access, correct, delete, restrict, object to, or receive a copy of certain personal information, withdraw consent, or appeal a privacy decision. We may need to verify identity and may retain information where law or a valid exception requires it.

Use the verified route published on the contact page, identify the message as a privacy request, and avoid sending passwords or complete payment details. You can also use an account's available controls to update information or communication preferences.

You can change or withdraw an analytics choice through the cookie banner or its browser-local settings; withdrawal stops future Google Analytics loading in that browser and removes site-readable Google Analytics cookies. For cookies and browser storage, see the Cookie Policy.

StickerMigo is not designed for children to purchase from or submit private projects independently. If you believe a child provided personal information without appropriate involvement from a parent or guardian, submit a privacy request.

Links to PayPal, social platforms, or other external services lead to services with their own privacy practices. Read those notices before providing information directly to them.

We may update this policy when services or legal requirements change. The updated date identifies the current version. Material changes should be communicated in a manner appropriate to the affected service and market.