Document N° 02

Privacy.

Photographs are personal. So is the address we ship to and the date you wrote on the inscription. This document explains what personal information we collect, how we use it, and the rights you have under U.S. federal and state law to access, correct, or delete it.

Effective April 2026 · Plain English, lawyer-checked

The short version. We collect only what we need to make and ship your piece. We don't sell your information. We don't share it for cross-context behavioral advertising. We don't use it to train AI. We delete photographs 60 days after delivery; basic order records are kept as long as U.S. tax law requires.

1. Who we are

Ryan Signature Studio LLC (the "studio," "we," "us") operates this website and the commission service offered through it. Our mailing address is [Studio mailing address — required by CAN-SPAM]. We sell only to U.S. residents and ship only to U.S. addresses. For privacy questions, contact [email protected].

2. Information we collect

Identity & contact. Your name, email, U.S. shipping address, optional phone number.
Order content. The photograph or coordinates you upload, the inscription text, the wood and size you choose.
Payment. Handled by our PCI-DSS payment processor. We receive only the transaction reference and the last four digits of the card. We never store full card numbers.
Communication. Emails you send us, and our replies.
Site analytics. Aggregated, IP-anonymized page views via a first-party analytics tool. No third-party advertising trackers, no behavioral advertising cookies, no cross-site fingerprinting.

3. How we use your information

To make, inscribe, and ship the piece you commissioned.
To send transactional emails — order confirmation, concept preview, shipping updates, deletion confirmations.
To meet legal obligations — federal and state tax records, IRS reporting, sales-tax remittance.
To send marketing emails only if you opt in. Every marketing email contains a one-click unsubscribe link, as required by CAN-SPAM.
To prevent fraud, maintain security, and defend legal claims.

4. How we share your information

We share the minimum information necessary with the following service providers, each under a written confidentiality and data-processing agreement:

The single maker assigned to your piece (employed or contracted by the studio).
Our payment processor.
Our shipping carrier.
Our accountant and tax preparer.
Our email-delivery and hosting providers.

We may disclose information when required by a valid U.S. subpoena, court order, or other binding legal process; to protect our legal rights or the safety of others; or in connection with a sale of substantially all of the studio's assets, in which case the buyer will be bound by this Policy.

We do not sell your personal information. We do not share it for "cross-context behavioral advertising" as that term is defined in the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). We do not provide photographs, inscriptions, or any customer data to generative AI training systems.

5. How long we keep information

Photographs and inscription content: 60 days after delivery, then irreversibly deleted (see Image Rights & Upload).
Order records (name, billing address, total, tax): 7 years, the period required for federal income-tax recordkeeping.
Email correspondence: 24 months, then deleted unless required for an open dispute.
Marketing email list: until you unsubscribe.

6. Children's privacy (COPPA)

Our website and commission service are not directed to children under the age of 13, and we do not knowingly collect personal information from anyone under 13. The FIRST YEAR CHRONICLE is a product about — not for — children, and is always commissioned by an adult parent or legal guardian.

Where a parent uploads a photograph of their child for the FIRST YEAR CHRONICLE, the additional safeguards in §3 of Image Rights & Upload apply: shipment only to the guardian's address, no marketing use of children's images even with consent, and immediate deletion on guardian request. If you believe a child has provided personal information directly to us, contact [email protected] and we will delete it within 10 business days.

7. Your privacy rights — California residents

Under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), California residents have the following rights, free of charge, twice in any twelve-month period:

Right to know what personal information we have collected, used, disclosed, and (if any) sold or shared in the preceding 12 months.
Right to access a copy of the specific pieces of personal information we hold about you.
Right to correct inaccurate personal information.
Right to delete personal information we hold about you, subject to legal exceptions (e.g., tax records).
Right to limit use of sensitive personal information (we already limit ours to providing the service).
Right to opt out of sale or sharing — we don't sell or share, but the right is yours regardless. We honor the Global Privacy Control (GPC) browser signal as a valid opt-out request.
Right to non-discrimination — exercising any right will not change the price you pay or the service you receive.
Right to designate an authorized agent to make a request on your behalf, with verifiable authorization.

To exercise any right, email [email protected] from the address used at order. We respond within 45 days; we may extend once by another 45 days where reasonably necessary, with notice.

We did not sell or share personal information for cross-context behavioral advertising in the preceding 12 months, and we have no plans to do so. We do not knowingly sell or share personal information of consumers under 16.

8. Your privacy rights — other U.S. states

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Indiana, Tennessee, New Hampshire, New Jersey, Maryland, Minnesota, and other states with comparable privacy laws have substantially similar rights to access, correct, delete, and obtain a portable copy of personal information; to opt out of targeted advertising and the sale of personal data (we do neither); and to appeal a denied request.

To exercise any of these rights, write to [email protected]. If we deny your request, we will explain why and tell you how to appeal. If your state has a consumer-protection regulator, you may also lodge a complaint there.

9. Email & SMS communications

Email. Marketing emails are sent only with your opt-in. Every email includes our mailing address ([Studio mailing address — required by CAN-SPAM]) and a one-click unsubscribe link, as required by the CAN-SPAM Act. Unsubscribe requests take effect within 10 business days.

SMS. If you provide a phone number and opt in to text-message updates, we send only transactional and order-related messages. Carrier rates may apply. Reply STOP to opt out, HELP for help. We do not send marketing SMS without separate, prior express written consent, as required by the Telephone Consumer Protection Act (TCPA).

10. Cookies, Do Not Track, and GPC

We use a single first-party session cookie required for the order flow, and one privacy-respecting analytics cookie that anonymizes IPs before storage. We do not use third-party advertising cookies, retargeting pixels, or session-replay tools.

Most browsers offer a "Do Not Track" (DNT) signal. Because the DNT standard has not been finalized, we do not respond to it differently. We do recognize the Global Privacy Control (GPC) signal and treat it as a valid opt-out of any sale or sharing of personal information for California, Colorado, and Connecticut residents.

11. Security

Photographs and order content are encrypted in transit (TLS) and at rest. Access is limited to the maker assigned to your piece and the studio's order coordinator, both under access logs. Backups are encrypted and rotated; deleted images are unrecoverable after the next rotation cycle (never longer than 60 days).

No system can be guaranteed perfectly secure. If we become aware of a security incident affecting your personal information, we will notify you in accordance with the law of your state of residence — which in many states (including California, New York, and Texas) requires notice "without unreasonable delay."

12. Notice of financial incentives

We do not offer any program, discount, or service in exchange for the collection, sale, or retention of personal information. There is no financial incentive to disclose.

13. Changes to this Policy

Material changes will be emailed to active customers and posted at the top of this page with a new effective date. Continued use of the service after the effective date constitutes acceptance of the updated Policy.

14. Contact

Privacy questions and verifiable consumer requests: [email protected]
General questions: [email protected]
Mail: Ryan Signature Studio LLC, [Studio mailing address — required by CAN-SPAM]

This Policy is governed by the laws of [State of formation, USA], and, where applicable, the consumer-privacy law of your state of residence.