Privacy

Who is responsible for what

Naolito (Sor Teresa Prat 15, 29003 Málaga, Spain · contact@naolito.com) is responsible for your customer account in this shop, for your order history (including the orders you placed in our previous shop) and for our marketing emails.

Fourthwall, our printing and checkout partner, is responsible for the payment, the taxes and the production and shipping of each purchase. When you press Checkout you continue on Fourthwall’s checkout (checkout.naolito.com), which collects your payment and delivery details under Fourthwall’s privacy policy. Your card details never reach us.

What we keep and why

• Your account: your email, your name and the addresses you save, to let you into your account and show you your orders. Basis: the contract with you.
• Your orders: for each order, its number, status, products, amounts, the email and the shipping and billing addresses. Fourthwall sends them to us when you order and when the order changes; older orders come from our previous shop. We use them for your order history and to help you with any order. Basis: the contract with you and our legal obligations.
• Your marketing choice: whether you agreed to receive our emails about new designs and offers, when, and where (the sign-up form at the bottom of every page, the box at Fourthwall’s checkout, your account or our previous shop). Basis: your consent, which you can withdraw at any time in My account or with the one-click unsubscribe link of any of those emails.
• Our mailing list: when you sign up with the form at the bottom of the page, we email you a link to confirm; only when you use it (within 48 hours) do we add you to the list, with the date and that you came from the form. If your email already has an account or orders with us, the subscription goes with them; if not, we keep it as a subscriber without an account. To stop abuse of the form, we also keep a hash of your IP address (never the address itself) for 30 days. For each email we send to the list, we record that we sent it to you, so you never get the same one twice.
• Signing in: we send you single-use links by email and keep you signed in with a cookie. We only store a fingerprint (a hash) of each link and cookie, never the link or the cookie itself.

Our visit statistics

We count visits ourselves, without cookies and without anything that identifies you: the page, the website or campaign (utm_*) you came from, the type of device, your country and the network you connect from (to leave out robots), and the steps of a purchase (adding to the cart, going to checkout). A random id kept in your browser tab (sessionStorage, deleted when you close it) groups the pages of one visit, and goes with your cart to Fourthwall so we can tell which visits end in an order. We do not store your IP address and we do not count anything if your browser sends “Do Not Track”. Basis: our legitimate interest in knowing how the shop is used. Kept for 26 months.

Advertising: Meta Pixel and Conversions API

We advertise on Facebook and Instagram. Only if you accept advertising cookies (the notice when you arrive, or “Cookie settings” at the bottom of every page), we load the Meta Pixel, which tells Meta Platforms Ireland the pages you view, the products you look at, add to your cart and take to checkout, with the_fbp and _fbc cookies (90 days), and we remember the campaign that brought you here (up to 90 days). Our server sends the same cart and checkout events through Meta’s Conversions API, with your IP address, your browser’s user agent and those cookies, so each one counts once even if your browser blocks the pixel. Without your consent none of this happens, and withdrawing it deletes those cookies.

When you place an order, our server tells Meta that a purchase happened: the order number, the products, the amount and currency, a one-way hash of your email (not your email) and your browser’s user agent; and, only if you accepted advertising cookies, your IP address, the _fbp and _fbc cookies and the campaign you came from. We use it to measure which ads lead to purchases and to show our ads to people more likely to be interested. Meta acts as joint controller for this measurement, under Meta’s privacy policy. Basis: your consent for the cookies and the browser data, and our legitimate interest in measuring our advertising for the purchase itself; you can object at any time by writing to us.

Cookies and browser storage

Needed for the shop to work, always on:

• naolito_session: keeps you signed in, for 30 days or until you sign out.
• naolito_cart: remembers your cart, for 30 days.
• shop_cookie_consent (local storage): your cookie choice, for 12 months at most.
• naolito-shop-session and naolito-shop-utm (session storage): our visit statistics, until you close the tab.

Only with your consent for advertising:

• _fbp and _fbc: Meta Pixel, 90 days.
• shop_ad_campaign (local storage): the campaign that brought you here, 90 days.

Who helps us

• Cloudflare hosts the shop and its database and delivers the emails about your account and the confirmation of your subscription, on our behalf and under our instructions.
• An email delivery provider sends our marketing emails to the people on our list, on our behalf and under our instructions: it receives your email address and the email we send you.
• Fourthwall runs the checkout, as explained above, and tells us about your orders so they appear in your account. Your cart carries to it the id of your visit and, with your consent for advertising, the data of the ad you came from, which come back with your order.
• Meta Platforms Ireland receives the advertising events described above.

Some of them may process data outside the European Economic Area, with the safeguards the GDPR requires (such as the European Commission’s standard contractual clauses).

How long we keep it

• Your account, while you have it: ask us and we delete it.
• Your orders, for as long as the law requires us to keep commercial and tax records.
• Your marketing choices, for as long as we need to prove them, and the record of which emails we sent you, as long as you are on our list and for as long as we need to prove it afterwards.
• Sign-ups to the mailing list, with the hash of the IP address: 30 days (the confirmation link expires in 48 hours).
• Our visit statistics, 26 months.
• Sign-in links expire in 30 minutes (activation links, in 7 days) and work once; sessions end after 30 days.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to its use, or to receive it in a portable format, by writing to contact@naolito.com. You can also complain to the Spanish Data Protection Agency (aepd.es).

The privacy policy of our studio website is at naolito.com/privacy.