Privacy Policy

Last updated / effective date: 7 November 2026

1. Who is responsible for your data

The controller of your personal data is Suchmugs S.R.L., Romania (Trade Register J40/1626/2019, CUI RO40613870), registered office Aleea Coloana Infinitului 8, Sector 6, 062112 Bucharest, Romania. Contact for any privacy question or request: [email protected].

We are established in the European Union, so the EU General Data Protection Regulation (GDPR) applies to all personal data we process, including data of customers in the United States. We have not appointed a Data Protection Officer: the GDPR requires one only where the core activity is large-scale regular and systematic monitoring of people, or large-scale processing of special categories of data, and a small shop selling mugs does neither.

2. What we collect, why, and on what legal basis

Data	When	Purpose	Legal basis (GDPR Art 6(1))	Kept for
Name, shipping address, email, items, personalization text	You place an order	Make, ship and support your order; send order and shipping emails	(b) contract	As long as Romanian accounting law requires us to keep the records behind our accounts (Law 82/1991 art 25), because the order record supports the sale in our books
Payment and checkout details	At checkout	Take payment and prevent fraud. Card numbers are collected by Stripe and not shared with us in full. Our store receives the payment record with your name, email and shipping address. In Stripe's dashboard we can also see the card brand, the last 4 digits, the expiry date, the billing country and postal code, and Stripe's fraud-risk assessment	(b) contract; (f) fraud prevention	As order records
Order and invoice records	After purchase	Accounting and tax duties	(c) legal obligation	As long as Romanian accounting law requires (Law 82/1991 art 25)
Discount or creator code used, referral link	When you open a link that carries a code (kept in your browser, see section 6), and at checkout	Apply the discount; pay the creator who referred you	(b) contract for the discount; (f) legitimate interest for creator attribution	As order records
Emails and messages you send us	When you contact us	Answer you	(b) contract, or (f) legitimate interest where the message is not about an order	As long as we need them to answer you and to handle any claim about your order, and never longer than the order record
Review request and your review, including whether you ticked the optional box saying you know the people behind Suchmugs	We email every buyer one review request 21 days after the order ships; you choose whether to write a review	Ask every buyer the same way for a review; publish reviews, with a label on a review whose writer ticked that box or is someone we know (we keep a private list of the orders and the hashed email addresses of people we know, such as friends and family, and check each review request against it)	(f) legitimate interest; you choose whether to write one	A published review stays published until you ask us to remove it; the record that we asked you is kept with the order record
Newsletter email	Only if you tick the unticked box on the cart page and then press Confirm on the page linked from the one email we send after your order. If you sign up with the "Get 10% off your first order" form on the cart page instead, we keep your email, the sign-up wording you saw, the time and the one-time 10% code we give you, the code works on your first order straight away, and marketing emails start only after you press Confirm in the email we send	Send marketing emails; for the cart sign-up, also check that its code is used once, on a first order	(a) consent, which you can withdraw at any time	Until you unsubscribe. After that we keep only your address and the dates you signed up, confirmed and unsubscribed, so that we never email you again. A sign-up you never confirm is deleted 30 days after we send the confirmation email (a cart sign-up: 30 days after you sign up, unless its code was used on an order, which we keep as the record that it was used)
Creator details (creators who sign our creator agreement only)	When you sign	Run the collaboration, ship your mug, pay commission, keep tax records	(b) contract; (c) legal obligation for tax and accounting records	As the creator privacy notice states: the address is deleted from our creator list 90 days after delivery; records behind a payment are kept as long as Romanian accounting law requires
Withdrawal statement (EU residents, online withdrawal form)	When you use the withdrawal form on the Refunds and Returns page	Record your withdrawal, send you the acknowledgement, refund you	(c) legal obligation (EU consumer law); (b) contract	As order records
Technical data (IP address, browser, pages served)	When you visit	Run, secure and fix the site	(f) legitimate interest	We keep no web server access logs. To stop abuse, checkout requests and withdrawal form submissions are counted against a scrambled code made from your IP address (a hash, never the address itself). Each count covers one minute for checkout and one hour for the form, and is deleted once that period is over, at the next checkout or form submission or at our next scheduled store check, which runs every 30 minutes
Bot check on the withdrawal form (Cloudflare Turnstile)	Only when you open the withdrawal form	Stop automated abuse of the form	(f) legitimate interest	Cloudflare checks signals from your browser (your IP address, TLS fingerprint and browser type) to tell people from bots and tells us only whether the check passed. We keep nothing from it
Ad measurement: the ChatGPT Ads pixel and Conversions API (see section 6)	Every page you visit while the pixel is on, whether or not you came from an ad: page views, product views, add to cart, checkout start, and an order event with the order value and items. For the server-side order report also your IP address and browser type, the two ad references from the pixel cookies (section 6), a hashed email, hashed first and last name, and your city, state, postal code and country. While the pixel is on it also uses OpenAI's automatic advanced matching: it detects customer information on the page, such as what you type into a form, and sends it to OpenAI hashed (SHA-256, in your browser), not in readable form. OpenAI decides which fields it reads and does not publish the list	United States visitors by default unless they opt out; visitors elsewhere only after they press Accept	Measure whether our ads lead to visits and orders	(f) legitimate interest for United States visitors, (a) consent for everyone else	Your IP address, browser type and the two ad references are deleted from our records once the order report has been attempted, or when the checkout expires or fails. Any still held 7 days after the checkout started are deleted at the next checkout on the store. Your country and your choice are kept with the order record. The pixel cookies last 30 and 365 days, see section 6
Cookies and similar storage	When you visit	See section 6	Storage the shop needs to work needs no consent; anything else only with consent where the law requires it	See section 6

Giving your name, address and email is needed to fulfil an order. Without them we cannot ship. Everything else is optional.

Where we rely on legitimate interest, our interest is running and improving a small online shop, measuring whether our ads work, and paying the creators who refer customers. You can object at any time (section 5).

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. We do not sell your personal information for money. Where the ChatGPT Ads pixel is on (section 6), it sends the visit and order events listed above to OpenAI so that we can measure our ads, and OpenAI can collect information about your activity over time on our site that way. OpenAI can also use that data to personalise the ads it shows you, and some US state laws may treat that kind of sharing as a "sale" or as "targeted advertising". You can opt out of it at any time with Privacy choices, and a Global Privacy Control signal from your browser does the same (section 5).

3. Who receives your data

We share data with service providers that help us run the store, in these categories:

Payment processing: Stripe
Order management and production: our print and fulfillment partners in the United States, which receive your name, shipping address and personalization to make and ship your mug
Shipping carriers, which receive your name and address
Email delivery (order emails, and the newsletter if you opt in)
Website hosting and security
Bot check on the withdrawal form: Cloudflare Turnstile, which receives your IP address and browser signals when you open the form; Cloudflare also uses these signals on its own account to improve its bot detection (Turnstile Privacy Addendum, https://www.cloudflare.com/turnstile-privacy-policy/)
Our accountant, for tax and accounting records
Advertising measurement: OpenAI, which receives the pixel and Conversions API events described in sections 2 and 6 where the pixel is on
Order database and sales analytics: our order records are also kept in a hosted database that we use for accounting and sales figures
Email inbox provider: Google (Gmail), where the emails you send us are delivered
Parcel tracking service: Ship24, which receives your parcel's tracking number so that we can see when it is delivered
File storage and image processing for print files: the print file for your mug, which carries your personalization text, is made and stored with cloud file storage and image services, and sent to the print partner from there
A server that runs our scheduled jobs: the checks that every paid order reached production, the shipping emails and the review requests
AI assistants that help us look up orders and answer your emails, which can see the order details and the messages they work on

We may also disclose data where the law requires it, or to protect our rights in a dispute.

4. Transfers outside the EU

Most of our service providers, the print partners and the carriers are in the United States, and your order ships within the United States. Where a provider is certified under the EU-US Data Privacy Framework, the transfer relies on the European Commission's adequacy decision (EU) 2023/1795. Otherwise it relies on the European Commission's Standard Contractual Clauses in that provider's data processing terms. Our US print partner, which receives every order, is not certified, has no published data processing terms and has not signed Standard Contractual Clauses with us. We send it your name, shipping address, personalization and order number because that is necessary to make and ship the mug you ordered, which is our contract with you (GDPR Art 49(1)(b)). Our parcel-tracking service is in Hong Kong and receives only the tracking number, not your name or address. The print partner buys the shipping label, so the carriers receive your name and address from it, inside the United States, to deliver the parcel. Any other transfer that neither route covers also relies on its being necessary to perform our contract with you (GDPR Art 49(1)(b)). A copy of the safeguards is available on request at [email protected].

5. Your rights

Under the GDPR you have the right to access your data, to have it corrected or deleted, to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting earlier processing. You can object to direct marketing at any time and we will stop. Email [email protected]. We answer within one month, which can be extended in complex cases. We may ask you to confirm your identity.

You also have the right to complain to the Romanian data protection authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP), 28-30 G-ral Gheorghe Magheru Bld., District 1, 010336 Bucharest, Romania, [email protected], www.dataprotection.ro, or to the authority where you live or work if you are in the EU.

United States residents, including California. You may ask what personal information we collected about you, and ask us to correct or delete it, using the contact above, and you can switch off the ad measurement described in section 6 with Privacy choices; we answer every buyer the same way, wherever you live. If we turn down a request, reply to our answer and we will look at it again and tell you the outcome, and how to contact your state attorney general if you still disagree. We will tell you about material changes to this policy by updating the date at the top.

Do Not Track, Global Privacy Control and ad measurement. If your browser sends a Global Privacy Control signal, we treat it as Decline: the ChatGPT Ads pixel does not load by default and your order is not reported to OpenAI, unless you press Accept yourself. Our site does not change what it does for a Do Not Track signal. You can also switch the pixel off at any time with "Privacy choices" in the footer of every page. The choice is remembered on your device and also stops us reporting your order to OpenAI.

6. Cookies and similar storage

What the shop needs. We store your cart in your browser (sm_cart_v1, in local storage) until you clear it or finish checkout. We store your privacy choice (sm_consent_v1 in local storage and the cookie sm_ads_consent, which lasts one year) so that it is remembered and applied at checkout. This storage is strictly necessary to run the shop and needs no consent. For one visit we also keep the two-letter code of the country your connection comes from (sm_geo_v1, session storage, cleared when you close the tab). It is used only to decide whether the ad measurement pixel may load before you choose (the rule below), so that it stays off for visitors outside the United States, and it is never sent anywhere. If you open a link that carries a discount or creator code (?code=), we keep that code for the visit (sm_code_v1, session storage, cleared when you close the tab) so that the cart page can fill it in for you; you can change or delete it there, and it is sent to us only when you check out, to apply the discount and credit the creator whose link you used. It is strictly necessary to give you the discount you clicked for. Cloudflare, which hosts the shop, may set its own short-lived security cookie (such as __cf_bm or cf_clearance) if its bot protection checks a visit; that cookie is strictly necessary to keep the site secure. The online withdrawal form on the Refunds and Returns page uses Cloudflare Turnstile, a bot check that loads from challenges.cloudflare.com only when you open the form; Cloudflare may use its own strictly necessary security cookies for it (listed in Cloudflare's cookie policy), and it is not used to profile you or target ads. The checkout page is hosted by Stripe and runs under Stripe's own privacy policy (https://stripe.com/privacy).

Ad measurement with the ChatGPT Ads pixel. Our ads on ChatGPT use a measurement pixel from OpenAI. While it is on, it runs on every page of the shop except the review and newsletter pages we link from our emails (their links carry a private code, so they never load it). So it records your visits and orders whether or not you came from one of our ads, and it tells us whether a click on an ad ends in an order.

If you are in the United States, the pixel is on when you arrive and the footer tells you so. Choose "Privacy choices" in the footer and press Decline to switch it off. It then stays off on this device, and your order is not reported to OpenAI. If your browser sends a Global Privacy Control signal, the pixel stays off as it would after Decline, and the bar lets you press Accept if you want it on. If your browser blocks both local storage and cookies, so that no choice can be remembered, the pixel does not load until you press Accept.
If you are anywhere else, or we cannot tell where you are, nothing loads until you press Accept in the bar at the bottom of the page.
When it is on, the pixel sets two cookies on our domain: __oppref, which lasts 30 days and links a click on an ad to an order, and __obref, a random browser reference that lasts 365 days. Pressing Decline deletes them.
When it is on, our shop also keeps two notes in session storage, which your browser clears when you close the tab: sm_ads_pending, the mug you just added to your cart, so that the add-to-cart event can be sent from the next page, and sm_ads_done_ followed by your checkout reference, so that your order is reported only once.
We work out your country from your connection when the page opens, and we record your country and your choice with your order so that the server-side order report follows it.

If we add Meta or Pinterest tags, they load only after you press Accept, for every visitor, and we will update this section first.

7. Children

This store is for adults buying gifts. It is not directed to children under 13 and we do not knowingly collect personal data from them. If you believe a child has given us data, email us and we will delete it.

8. Security

Every page of the shop is served over an encrypted connection (HTTPS). Card details are entered only on Stripe's checkout page and never reach our servers. The secret keys that connect the shop to Stripe, our order system and our email provider are kept in our host's encrypted settings, not in our code. Order data is held by the service providers listed in section 3; we reach it through our own accounts with them. If a breach is likely to put your rights at risk we will notify the authority within 72 hours where required, and tell you where required.

9. Changes

We will post any change here with a new date.

10. Contact

Suchmugs S.R.L. (Trade Register J40/1626/2019), Aleea Coloana Infinitului 8, Sector 6, 062112 Bucharest, Romania. [email protected]