Buy 12 shop stickers, pay for 10.Shop stickers →

Privacy Policy

Last updated 2026-10-02.

This page explains what PenPan Prints collects about you when you use the site, why we collect it, and how long we keep it. We're a small Indian business and we try to collect the minimum we can while still running a real store.

1. What we collect

1a. When you place an order

  • Your name, email, phone, and shipping address.
  • Optionally a GSTIN + business name (for B2B invoices).
  • The contents of your order (products, variants, quantities, custom artwork).
  • Payment metadata from Razorpay (we never see your card details, only the payment id + status).

1b. When you visit the site (analytics)

We run our own analytics on this server, and we use the Meta Pixel to measure our Instagram and Facebook ads. We don't use Google Analytics. Analytics is on by default and you can opt out at any time from the banner or the footer link; opting out turns off both our analytics cookie and the Meta Pixel.

  • Default (analytics on). We set a pp_anon cookie (a random ID, valid 1 year) so we can recognise a returning visitor without knowing who they are. We record the pages you view, your User-Agent (to bucket devices/browsers/OS), your referrer URL (to credit marketing channels), and your approximate location (country + region + city, looked up via MaxMind GeoLite2 from your IP). Each visit links to the events that happened during it (pageviews, product views, add-to-cart, checkout steps, payment attempts) so we can compute funnel and conversion stats and understand which stickers people like.
  • Opted out.We set no analytics cookie. Visits are still counted, but under a daily-rotating hash of your IP and User-Agent that cannot be reversed and is not linked across days, so we can't tell that you came back tomorrow.
  • Meta Pixel.Unless you opt out, a script from Meta (Facebook / Instagram) records page views, product views, searches, add-to-carts, checkout starts and purchases (order value, not your name or address) and sends them to Meta along with Meta's own cookies, so we can see which ads led to sales. Meta processes this under its own privacy policy.
  • Carts.If you add something to your cart and leave, we keep a record of what was in the cart and when it was last touched. If you reached checkout we also keep the email and phone you entered, so we can help if the order didn't go through. Cart records are deleted or anonymised when you ask us to erase your account.

Raw events are kept for 180 days.After that we archive them to cold storage and delete the live rows. Aggregated daily counts (number of sessions per day, conversion rate, etc.) are kept indefinitely. They don't identify you.

1c. When you create an account

We store the same fields as above plus the consent state at the time you signed up, the date of last password change, and any 2FA enrolment metadata. Order history is kept for at least the statutory GST retention period (8 years from the end of the financial year) even if you later ask us to forget you. Indian tax law requires it.

2. Why we collect it

  • To process and ship your orders.
  • To raise GST-compliant tax invoices and credit notes.
  • To detect and prevent fraud (e.g. card-testing on Razorpay).
  • To respond to your support questions.
  • With your consent, to understand which pages and products bring people in and where they drop off, so we can fix friction.

3. Who we share it with

Only the third-party processors we strictly need to run the store: Razorpay (payments), Shiprocket / our courier (shipping), Resend (transactional email), MSG91 (SMS OTP), Cloudflare (file storage, including images you upload). We do not sell your data, and we do not share with analytics or advertising networks.

Our free background remover runs in your browser. The first time you use it, your browser downloads the cut-out model from IMG.LY's server (staticimgly.com), which sees your IP address like any website would. Your photo is never sent to them.

4. Your rights under DPDPA 2023

  • Access.Email us and we'll send you a copy of everything we hold about you.
  • Correction. You can edit your profile + addresses in your account, or email us.
  • Erasure. Request deletion from your account settings. Orders + invoices retained for GST stay in our books but are anonymised: your name + email are scrubbed.
  • Opting out. You can change your analytics choice anytime via the link at the bottom of every page. Opting out immediately clears the pp_anon cookie.
  • Grievances. Email penpanprints@gmail.com and we'll respond within 30 days. If we don't resolve it to your satisfaction, you can escalate to the Data Protection Board of India.

5. Cookies we set

  • pp_consent: essential. Records your cookie choice. One year.
  • pp_cart: essential. Lets guests keep a cart across page loads. 30 days.
  • pp_anon: analytics (first-party, on by default). Random UUID, HttpOnly. One year. Not set, and cleared, if you opt out.
  • pp_otp: essential. Phone OTP session for COD orders. Short-lived.
  • Auth.js session cookies: essential. Only set after you sign in.

6. Security

Customer artwork uploaded for custom prints is private and only accessible to you and our review staff via short-lived signed URLs. Passwords are hashed with bcrypt. Razorpay webhook payloads are verified with HMAC-SHA256. Quarterly we rotate API keys + the IP hashing salt.

Custom sticker images

Images you upload for custom stickers are kept for 30 daysif you don't order, and for 2 years after your last order that uses them, so you can reorder. After that, we delete them. Photos you send with a problem report follow the same 2 years rule. You can ask us to delete them sooner by emailing penpanprints@gmail.com.

7. Contact

For any privacy question, email penpanprints@gmail.com.