Privacy Policy

Who is responsible for your data

CreaVisionArt is a one-person studio: I run it alone, and I am the data controller, which means I decide how your data is used and I am responsible for it. For anything about your data you can write to me at info@creavisionart.com or use the contact page.

Data controller: Antonino Alfio Fonti Castelbonese, 95047 Paternò (CT), Italy · VAT No. 06322360873.

What I collect and why

When you browse the site — like any website, the server records some technical data when you open a page: IP address, browser, page requested and time. I use it only to keep the site working and secure and to find errors and abuse. Sign-ins and failed sign-in attempts are also recorded with IP address and browser, to protect accounts from people trying to guess passwords.

Your account — if you register, I keep your email address, the username you choose, your password (stored only in an encrypted, non-reversible form that nobody can read, me included), the profile photo you upload, the date you accepted the Terms and, if you turn them on, your two-factor authentication settings and passkeys. Of a passkey I store only the public part: your fingerprint or face never leave your device.

Signing in with Google — if you choose "Sign in with Google", Google sends me your name, email address and profile picture. I use them to create or open your account and to show your photo. I never receive your Google password.

Purchases and free downloads — when you buy or download something, I keep the email address you use, what you got, the amount paid, the date and how many times you downloaded the files, so that I can send you your links, show your purchases in "My content" and help you if something goes wrong. For a free download without an account, your email is also remembered for the rest of your visit, so you don't have to type it again. Card details go straight to Stripe and never reach my site.

Newsletter — if you subscribe, from the form at the bottom of every page, from the box inside articles, with the box when you download a free product or with the box at checkout, I keep your email address and language. Your subscription starts only when you click the link in the confirmation email I send you (double opt-in). To be able to prove that you agreed, I record the date, time and IP address of your consent and the version of this policy you accepted. I don't track whether you open my emails or click their links.

Reviews, comments and forum — what you write in a review, a comment or a forum post is published on the site together with the name you choose, after I have checked it. If you leave your email address with a comment, I use it only to let you know when the comment is published.

Contact form — when you write to me, I receive your name, email address and message by email and use them only to answer you. A technical copy of the message also remains in the site's server logs, which are overwritten periodically.

Wishlist and cart — if you save products to your wishlist or add them to the cart, I keep that list so you find it again when you come back. The cart of a visitor without an account is deleted after 30 days.

I don't use your data for profiling or automated decisions, I don't sell it and I don't share it with anyone for their own advertising.

Legal basis

I use your data only when the law allows it:

• to provide what you ask for — your account, your purchases and downloads and answers to your messages (contract, Art. 6(1)(b) GDPR);
• with your consent — the newsletter and the optional email address for comments. You can withdraw it at any time, without affecting what happened before (Art. 6(1)(a));
• for my legitimate interest in keeping the site secure, preventing fraud and abuse and moderating what is published (Art. 6(1)(f));
• to meet legal obligations, such as keeping accounting records (Art. 6(1)(c)).

Who else handles your data

I rely on a few trusted services that process data on my behalf, only for the purposes above and under contracts that oblige them to protect it:

• the hosting provider where the site runs;
• Stripe (Stripe Payments Europe, Ireland), for payments;
• Brevo (Sendinblue SAS, France), for the site's emails and the newsletter;
• Google (Google Ireland Limited), only if you choose to sign in with Google;
• Sentry (Functional Software, Inc., USA), which alerts me when the site has a technical error and receives technical details about it, not your account data.

Some of these providers may process data outside the European Union, for example in the United States. In that case the transfer is protected by the European Commission's Standard Contractual Clauses or by the EU-U.S. Data Privacy Framework.

How long I keep your data

• Account: until you delete it. When you do, your personal data is erased at once; reviews and posts you published stay online under "Deleted user".
• Purchases and orders: for as long as Italian accounting rules require, up to 10 years. If you delete your account, your name and email are removed from them and only amounts and dates remain.
• Newsletter: until you unsubscribe. Subscriptions never confirmed are deleted after 7 days. After you unsubscribe I keep only your email address with the dates of consent and withdrawal, as proof that I respected your choice and so that I don't write to you again.
• Welcome coupons: so that each welcome coupon is given only once, I keep a coded fingerprint of the email address that received it, from which the address cannot be read back, also after you unsubscribe or delete your account.
• Contact form messages: only as long as needed to handle your request.
• Records of sign-ins and sign-in attempts: up to 90 days.
• Carts of visitors without an account: 30 days.

Your rights

You can ask me at any time to access the data I hold about you, correct it, delete it, restrict how I use it or receive it in a portable format; you can also object to processing based on my legitimate interest and withdraw any consent you gave (Articles 15–22 GDPR).

If you have an account, two of these rights are one click away in your profile: "Download my data" gives you a copy of everything, and "Delete account" erases your personal data. For anything else, write to me at info@creavisionart.com: I will answer within one month. You can unsubscribe from the newsletter at any time with the link at the bottom of every email.

If you think I have handled your data wrongly, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or with the authority of the country where you live.

Children

The site is not meant for children under 14 and I don't knowingly collect their data. To buy something you need to be of legal age or have a parent's permission.

Security

I protect your data with an encrypted connection (HTTPS), passwords stored in a non-reversible form, optional two-factor authentication and limits on repeated sign-in attempts. No system is completely safe, though: if I ever discover a breach that puts your data at risk, I will inform you and the authority as the law requires.

Cookies

For cookies and similar technologies, see the Cookie Policy.

Changes to this policy

If I change this policy, I will publish the new version here with its date; if the change is important, I will let you know with a notice on the site or by email.