Privacy Policy

Last updated: May 21, 2026

Sillycon Studio ("we," "us," "our") is the data controller for personal information collected through this website. This policy explains how we collect, use, store, and protect your data under Canada's PIPEDA, Ontario privacy law, and the EU/UK General Data Protection Regulation (GDPR) where it applies to you.

1. Information We Collect

• Order information: name, email address, shipping address, and order details when you purchase a product.
• Payment information: processed directly by Stripe. We do not store your full credit card number on our servers.
• Contact form: name, email, message content, and your explicit consent to process this data.
• Admin session: a minimal httpOnly session cookie for store administration only (not used for customer tracking or marketing).
• Cart data: stored in your browser (localStorage) only if you accept functional cookies on our cookie banner.
• Cookie consent preference: stored locally to remember your choice.

2. Legal Basis for Processing (GDPR)

• Contract (Art. 6(1)(b)): processing orders, payments, shipping, and customer support related to your purchase.
• Consent (Art. 6(1)(a)): contact form submissions, functional cart persistence, and optional marketing if we ever offer it (we do not send marketing emails without opt-in).
• Legitimate interests (Art. 6(1)(f)): fraud prevention, site security, and essential cookies required to operate the store.
• Legal obligation (Art. 6(1)(c)): tax, accounting, and regulatory record-keeping.

3. Why We Use Your Information

• Process and fulfill orders
• Send order confirmations and shipping updates
• Respond to customer inquiries
• Operate and secure our admin panel
• Comply with legal obligations

4. How Information Is Stored

Order and product data are stored in Vercel Postgres (hosted in secure data centres). Payment data is handled by Stripe. Product images may be stored on Vercel Blob. We use industry-standard measures including HTTPS, httpOnly admin cookies, and access controls on the admin dashboard.

5. International Transfers

Our service providers (Vercel, Stripe, Resend) may process data in Canada, the United States, or other countries. Where GDPR applies, transfers rely on appropriate safeguards such as Standard Contractual Clauses offered by those providers. You may request details by contacting us.

6. Your Rights

Depending on your location, you may have the right to access, rectify, erase, restrict processing, object, data portability, and withdraw consent at any time (without affecting prior lawful processing).

Under PIPEDA and GDPR you may also:

• Request a copy of personal data we hold about you
• Request correction of inaccurate information
• Request deletion where we have no legal reason to retain data
• Lodge a complaint with a supervisory authority (EU/UK users)
• File a complaint with the Office of the Privacy Commissioner of Canada

To exercise your rights, email hello@sillyconstudio.com or use our contact page. We respond within 30 days (GDPR) or a reasonable time under PIPEDA.

7. Cookies

See our Cookie Policy for full details. We do not use third-party advertising or analytics trackers on this site.

8. Third Parties (Processors)

• Stripe — payment processing
• Resend — transactional and contact emails
• Vercel — hosting, database (Postgres), and image storage

We do not sell your personal information.

9. Retention

Order records are kept as long as needed for accounting, tax, warranty, and customer support (typically up to 7 years where required by law), then deleted or anonymized. Contact form messages are retained only as long as needed to resolve your inquiry.

10. Children

Our store is not directed at children under 16. We do not knowingly collect personal data from children.

11. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects.

12. Contact & Data Protection

Data controller: Sillycon Studio, Ontario, Canada.
Privacy inquiries: hello@sillyconstudio.com