Privacy policy

Last updated: 23 September 2026

This Privacy Policy explains how Glowing Gallery collects and uses personal data when you visit www.glowing-gallery.com, place an order, upload a photo for a custom artwork, contact us or subscribe to marketing. It also explains your rights under the EU General Data Protection Regulation (GDPR), where applicable.

1. Who is responsible for your data?

The controller for our store operations is Glowing Gallery LLC, 30 N Gould St Ste N, Sheridan, WY 82801, United States. For privacy questions or requests, email support@glowing-gallery.com or write to this address.

2. Personal data we collect

  • Contact and order details: your name, email, phone number, billing and delivery addresses, purchased products, order history, payment status, delivery tracking and refund information.
  • Custom artwork: photos you upload, personalization instructions, design drafts, revisions and approval messages. Photos can contain personal data about you and other people.
  • Communications: messages, support requests, cancellation notices, reviews and any files you send us.
  • Device and browsing information: IP address, browser and device information, approximate location, pages viewed, referral sources, cart activity, cookie identifiers and interactions with our website or marketing.
  • Preferences: language, currency, marketing subscriptions and privacy choices.

We receive data directly from you, through website technologies, and from service providers such as our commerce platform, payment services, carriers and marketing platforms. Payment providers process payment credentials through their systems; the details available to us depend on the payment method.

Information needed to process payment, deliver your order or create your custom artwork is necessary to fulfil your purchase. Without it, we may be unable to complete the order. Marketing subscriptions are optional.

3. Purposes and legal bases

  • Processing orders, creating custom designs, arranging delivery and handling contractual requests: performance of a contract or steps you request before entering a contract (Article 6(1)(b) GDPR).
  • Tax, accounting and other binding legal obligations: compliance with applicable EU or Member State legal obligations where Article 6(1)(c) applies. Other lawful recordkeeping and legal-claims needs are assessed under Article 6(1)(f).
  • Security, fraud prevention, resolving enquiries and defending legal claims: legitimate interests in protecting customers, operating our business and establishing or defending claims (Article 6(1)(f)), subject to your rights and interests.
  • Optional analytics, advertising tracking, personalization and marketing requiring consent: your consent (Article 6(1)(a)), together with applicable cookie and electronic-marketing rules.
  • Privacy preference records: demonstrating compliance with applicable consent obligations and respecting your choices (Article 6(1)(c), or our legitimate interest under Article 6(1)(f), as applicable).

4. Photos and personalized designs

We use uploaded photos and instructions to prepare, revise and produce your artwork and to handle related customer support. We forward the necessary photos and instructions to a designer and to providers involved in production. The design process may also involve AI-assisted image-processing tools; where used, those tools may receive the uploaded photo and design instructions to generate or revise the artwork. These transfers are part of preparing your custom artwork. This notice does not grant AI providers permission to reuse your photos for unrelated purposes, such as training general-purpose models; any such use requires its own valid legal basis and appropriate information. Please contact us before uploading if you have questions about the providers or processing of a particular photo. Please only upload photos you are entitled to provide, and inform other identifiable people where appropriate. Avoid uploading identity documents or unnecessary sensitive information. An order upload is not, by itself, permission to publish your photo in advertising.

5. Service providers and other recipients

Recipients may include the following providers and categories, depending on the services you use and the integrations involved:

  • Shopify: hosting, storefront, checkout, order management, security and related commerce services.
  • Payment providers: the provider for your selected payment method, such as Shopify Payments, PayPal or Klarna, and relevant banking or wallet services. These providers may also act as independent controllers for payment security and their own legal obligations.
  • Design, AI-assisted image processing, production, order-management, invoicing and delivery providers: those needed to create and deliver your artwork, reconcile payments and manage records. Our store has integrations including Post & DHL Shipping, Synctrack, Billbee, Invoicify, Dianxiaomi and MabangERP.
  • Email and customer communication: Klaviyo and communication providers for subscriptions, order-related messages and support.
  • Analytics and advertising: Google services, Meta and TikTok integrations, and tools such as Triple Whale and GOAFFPRO for measurement and attribution, subject to applicable consent requirements.
  • Reviews and website tools: services such as Loox, Trustpilot, Privy and Consentmo. When you submit a public review, the information you choose to publish may be visible to other visitors.

We may also disclose necessary information to professional advisers or public authorities where legally required, or to establish or defend legal claims. Providers processing data on our behalf must be subject to the data-protection obligations applicable to that processing. Independent providers explain their own processing in their privacy notices.

6. Shopify services

Shopify processes personal data to provide and support our store. Where Shopify Enhanced Services are enabled, Shopify may also process interactions with our store and advertising to provide customized experiences, relevant advertising and insights, including processing as an independent controller and sharing information with service providers in other countries. Applicable consent choices must be respected. See Shopify's Consumer Privacy Policy and Shopify's Privacy Controls for further information and available choices.

7. Cookies, analytics and advertising

Essential cookies and similar technologies support functions such as the shopping cart, checkout, security and remembering privacy choices. Non-essential technologies can measure visits and purchases, recognize returning visitors and help tailor or measure advertising. Our integrations include Google analytics, Meta and TikTok tracking, and Klaviyo onsite functionality. These tools can process identifiers, device information and browsing or purchase events.

Our store also has a session-replay and heatmap integration (MIDA). Where enabled, this type of tool can record interactions such as clicks, scrolling and page navigation to understand usability. Non-essential recording requires consent where applicable.

For visitors in the EEA, non-essential storage or access on your device requires prior consent unless a legal exemption applies. You may refuse or withdraw that consent. Use the cookie-preference controls when displayed, or contact support@glowing-gallery.com for help with your choices. Browser settings can also restrict cookies, although blocking essential cookies may affect checkout. Advertising-platform opt-outs do not replace website consent choices.

8. Marketing choices

You can unsubscribe from promotional emails using the link in the message or by contacting us. This does not stop necessary order or service communications. Where enabled, marketing tools may measure email opens, clicks and associated purchases; processing that requires consent is subject to that consent. You can object to direct marketing, including related profiling, at any time.

9. International processing

Glowing Gallery LLC is based in the United States. Shopify and other service providers operate internationally, so personal data may be processed outside your country, including in the United States and Canada. Where GDPR transfer restrictions apply, a valid transfer mechanism is required, such as an applicable adequacy decision or approved Standard Contractual Clauses with any necessary additional safeguards. Shopify explains its transfer arrangements in its Data Processing Addendum. Contact us for information about recipients, processing locations and the safeguards applicable to your data, or to request a copy of relevant safeguards subject to necessary redactions.

10. How long data is retained

Retention depends on the purpose and type of record:

  • Order, payment and invoice records: for fulfilment and the applicable accounting, tax, refund and legal-claims periods.
  • Uploaded photos, design files and related messages: for completing and supporting the custom order and resolving related disputes; these are not automatically subject to the same retention needs as invoices.
  • Support correspondence: for resolving the enquiry and any necessary follow-up or legal claims.
  • Marketing details: while the subscription or other lawful basis remains valid. A limited suppression record may be retained to respect an unsubscribe request.
  • Cookie and analytics data: according to the technology's duration and the necessary measurement period, subject to consent choices and deletion requirements.

Data must not be retained longer than necessary for these purposes. You can ask us about the retention period for a particular record or request deletion. Legal recordkeeping requirements or ongoing claims may prevent immediate deletion of some information.

11. Your GDPR rights

Where applicable, you have the right to request access to your personal data, correction, deletion, restriction of processing and data portability. You may object to processing based on legitimate interests on grounds relating to your situation. You can object to direct marketing at any time, without giving a reason.

You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal. Where applicable, you also have rights concerning decisions based solely on automated processing that produce legal or similarly significant effects, including safeguards such as human intervention and an opportunity to contest the decision.

Send requests to support@glowing-gallery.com. We may request proportionate information to verify your identity. We will respond without undue delay and normally within one month. If a lawful extension is necessary because of complexity or the number of requests, we will explain this within that month. Requests are normally free of charge, subject to the exceptions in the GDPR.

You may complain to a data-protection authority, particularly in the EEA country where you live or work or where the alleged infringement occurred. You do not have to contact us first. Find your authority through the European Data Protection Board.

12. Changes and contact

We may revise this policy to reflect changes in our services or legal requirements. The date above identifies the latest revision. Material changes will be communicated as required by law; a policy update does not replace consent where consent is required.

For questions or requests, contact support@glowing-gallery.com.