Privacy Policy

1. Who is responsible for your data

The controller is [LEGAL ENTITY NAME] Ltd., company number [ISRAELI COMPANY REGISTRATION NUMBER], of [STREET, CITY, POSTAL CODE], Israel. Contact us about privacy at info [at] myverseshop [dot] com.

Representative in the European Union (GDPR Article 27): [EU REPRESENTATIVE — NAME AND ADDRESS, or leave as TBD].

Representative in the United Kingdom (UK GDPR Article 27): [UK REPRESENTATIVE — NAME AND ADDRESS, or leave as TBD].

Where a creator uses our tools to collect and message their own storefront subscribers, we and that creator each determine part of the purpose of that processing. In relation to your subscription to a creator's list, we and the creator act as joint controllers to that limited extent. You may exercise your rights against either of us, and we will pass a request to the other where needed. We remain solely responsible for the platform itself.

2. What we collect

Account data. Email address, password (stored only as a cryptographic hash, never in readable form), display name, handle, country, chosen currency, role, and any profile details or signature you add.

Creator data. Storefront settings, custom domain, poems, designs, uploaded images, product configuration, analytics about your own storefront, Ink balance and ledger, plan status, earnings and payout records, and identity or tax information where we need it to pay you.

Order data. Recipient name, delivery address, email address, telephone number where given, items ordered, prices, currency, order status, tracking number, and the transaction reference from our payment provider.

Payment data. Card details are entered into fields hosted by our payment service provider and are tokenised in your browser. We receive a token, the last digits and card type, the authorisation result, and a transaction identifier. We never receive or store your full card number or security code. For recurring plans, the provider holds a vaulted payment instrument on our instruction; we hold only its reference.

Marketing data. Whether you opted in to email from us or from a specific creator, when and from which page, and your engagement with those messages (delivery, open and click events, where the sending service reports them).

Technical and usage data. IP address, browser and device type, operating system, referring page, pages viewed, storefront and product view events, timestamps, language, approximate location derived from IP, and error diagnostics.

Consent records. Each time you accept a legal document we record the document, its version, the date and time, your account identifier or email where available, your IP address and your browser user-agent string. This is our evidence that the agreement was formed.

Support and reports. Anything you send us by email or through the contact page, including abuse reports and copyright notices.

We do not ask for, and ask that you do not send us, special-category data — health, biometrics, religion, political opinion, sexual life, trade-union membership. Poems are creative expression, and we do not treat their subject matter as data about you.

3. Why we use it, and on what legal basis

Where the GDPR or UK GDPR applies, we rely on the following bases:

• Performance of a contract — creating and running your account, processing and fulfilling orders, taking payment, paying creators, providing customer support, and sending transactional messages such as order confirmations, dispatch and tracking notices, password resets and billing receipts.
• Legal obligation — tax, accounting, invoicing, consumer-protection, sanctions screening, and responding to lawful requests.
• Legitimate interests — securing the platform and preventing fraud and abuse; measuring and improving the Service; producing aggregated statistics; enforcing our terms; handling infringement notices and disputes; and keeping consent and audit records. We balance these against your interests and rights, and you may object as described in section 8.
• Consent — optional marketing email, non-essential cookies and similar technologies, and any use we specifically ask you to agree to. You may withdraw consent at any time, without affecting processing already carried out.

Where Israeli privacy law applies, we process on the basis of your consent and of the purposes disclosed in this policy. Where United States state privacy laws apply, see section 9.

We do not use your personal data to train machine-learning models, and we do not permit our AI image provider to use inputs from the Service to train theirs beyond what their terms allow. Prompts derived from a creator's own verse are sent to that provider in order to generate the requested image.

We do not carry out any automated decision-making that produces legal or similarly significant effects on you. Automated checks may flag a transaction or an account for human review.

4. Who we share it with

We do not sell personal data. We do not share personal data for cross-context behavioural advertising. We share only what is needed, with:

• Production partners — the print-on-demand producer that makes your item receives the recipient name, delivery address, contact details needed for delivery, and the item and print file. It cannot use that data for its own marketing.
• Carriers — the delivery company receives the address and contact details needed to deliver and to provide tracking.
• Payment provider — receives the data needed to authorise, capture, refund and reconcile a payment, and to fight fraud and chargebacks. It acts as an independent controller for its own compliance purposes.
• Hosting, database and infrastructure providers — who store and serve the Service on our instruction.
• Email and messaging providers — who deliver transactional and, where you opted in, marketing email on our instruction.
• AI image provider — receives the generation prompt and generation parameters. Prompts are derived from the creator's own verse and design settings, not from buyer data.
• Analytics we run ourselves, on our own infrastructure, for storefront and platform statistics.
• Creators — a creator sees the order data needed to fulfil and support their sales, and the email address of anyone who subscribed to their storefront list.
• Professional advisers, insurers and auditors, under duties of confidence.
• Authorities, courts and other parties, where required by law or valid legal process, or where necessary to establish, exercise or defend legal claims, to prevent fraud or crime, or to protect anyone's safety.
• An acquirer, in a merger, acquisition, financing or sale of assets — subject to this policy continuing to apply.

Each processor acts on our documented instructions under a written contract with confidentiality, security and deletion obligations.

5. International transfers

We are established in Israel, and our providers, production partners and buyers are spread across the world. Your data will therefore be transferred and stored outside your own country, including in the European Economic Area, the United Kingdom, the United States and Israel.

The European Commission has recognised Israel as providing an adequate level of protection for personal data. For transfers to countries without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where relevant), together with technical and organisational measures appropriate to the transfer.

You may request a copy of the transfer safeguards we rely on by emailing info [at] myverseshop [dot] com.

6. Marketing email

Transactional messages are not marketing. We will always send order confirmations, dispatch and tracking notices, billing receipts, security notices and material changes to these documents, because we need them to run your account and your order.

Marketing email — new products, features, creator news, offers — is sent only where you actively opted in by ticking an unticked box, or where you subscribed to a specific creator's list. We do not pre-tick consent boxes, and we do not treat placing an order as consent to marketing.

Subscribing to a creator's storefront list means you consent to receive email about that creator's work, sent by them through our tools. It is not consent to platform-wide marketing, and it is not consent for any other creator.

Every marketing message identifies the sender, states that it is an advertisement where the law requires it, and contains a working unsubscribe link that takes effect promptly and at no cost to you. You may also write to info [at] myverseshop [dot] com.

We keep a record of when and how you opted in, and of any withdrawal, for as long as needed to prove compliance.

7. How long we keep it

• Account and creator content — while your account is open, then deleted or anonymised within a reasonable period after closure, except where a longer period is required below.
• Order, invoice, payment and tax records — for the period required by tax and accounting law in Israel and in the countries we sell into, generally seven years from the end of the relevant financial year.
• Consent and acceptance records — for as long as the agreement is capable of being disputed, and generally for seven years after it ends.
• Marketing opt-in and opt-out records — indefinitely, in a suppression list, so that we do not email someone who unsubscribed.
• Abuse reports, copyright notices, removed content and enforcement records — for as long as needed for legal and evidential purposes.
• Technical logs and analytics events — generally up to 24 months, then deleted or aggregated.
• Backups — deleted content persists in encrypted backups until they rotate out on our normal cycle.

8. Your rights

Depending on where you live, you may have the right to: access a copy of your personal data; correct inaccurate data; delete data; restrict or object to processing, including objecting to processing based on legitimate interests and to direct marketing at any time; receive your data in a portable format; withdraw consent; and complain to a supervisory authority.

To exercise a right, email info [at] myverseshop [dot] com from the address on your account, or use the contact page. We will ask for enough information to identify you and to be satisfied that the request is yours — we may refuse a request we cannot verify.

We respond within one month where the GDPR or UK GDPR applies, extendable by two further months for complex requests, and within the period required by other applicable law. There is no fee unless a request is manifestly unfounded or excessive.

Some rights are limited. We may keep data we are legally required to keep, data needed to establish or defend legal claims, and consent and enforcement records. Deleting your account does not delete orders already placed, invoices already issued, or evidence relating to an infringement notice.

You may complain to your local data-protection authority. In Israel this is the Privacy Protection Authority. In the EU it is the authority in your country of residence, and in the UK the Information Commissioner's Office. We would like the chance to resolve it first.

9. United States state privacy rights

If you are a resident of California or another US state with a comprehensive privacy law, you may have the right to know what personal information we collect and disclose, to access and delete it, to correct it, to obtain it in a portable form, to opt out of sale, sharing or targeted advertising, and not to be discriminated against for exercising a right.

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined in the California Consumer Privacy Act as amended. We do not process sensitive personal information for the purpose of inferring characteristics.

The categories we collect, our purposes and the categories of recipient are described in sections 2 to 4. We retain each category for the periods in section 7.

To exercise a right, email info [at] myverseshop [dot] com. An authorised agent may act for you with written authorisation and proof of identity. We will confirm receipt within ten business days and respond within forty-five days, extendable once by a further forty-five.

10. Israeli privacy law

Providing personal data to us is voluntary and is not required by law. If you do not provide it, we cannot open an account for you or fulfil an order. Data is used for the purposes described in this policy and is stored in databases operated by us and our providers.

You have the right to inspect information held about you, to request its correction or deletion where it is incorrect, incomplete, unclear or out of date, and to demand in writing that data held for the purpose of direct-mail solicitation be deleted from that database. Write to info [at] myverseshop [dot] com.

11. Security

We use encryption in transit, encryption at rest with our infrastructure providers, hashed passwords, row-level access controls in our database so that each account can reach only its own records, least-privilege service credentials held server-side only, and access logging.

No system is perfectly secure. You are responsible for keeping your password confidential and for using a unique one. Where a personal-data breach is likely to result in a risk to your rights, we will notify the relevant authority and, where required, you, within the periods the law sets.

12. Children

The Service is not directed at anyone under 18 and we do not knowingly collect their data. If you believe a child has given us personal data, write to info [at] myverseshop [dot] com and we will delete it.

13. Cookies

Cookies and similar technologies are described in the Cookie Policy, which forms part of this policy.

14. Changes

We may update this policy. The version and effective date are at the top of this page. Where a change materially affects how we use your data, we will give notice by email or in the Service before it takes effect, and where the law requires it we will ask for your consent again.

15. Contact

Privacy: info [at] myverseshop [dot] com. Postal: [LEGAL ENTITY NAME] Ltd., [STREET, CITY, POSTAL CODE], Israel.