Privacy notice

The controller is CATS S.R.L., registered office Via Friuli 8/B, 20135 Milano (MI), Italy, VAT no. and tax code 08558220961 ("we", "us"). For any question about your data or to exercise your rights write to ordini@ordito.art or by certified email (PEC) to cats@legalmail.it.

We have not appointed a data protection officer (DPO), as this is not required for our activities.

This notice is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and covers the ordito.art website, your account area, the emails we send you and the related programmes (waiting list, invitations, "invite a friend", creator affiliate programme).

Account. First and last name, email, password (handled in encrypted form by the authentication service: we never see it), language, saved addresses. If you sign in with Google we receive from Google your name, email and confirmation that the email is verified; we do not receive your Google password or other account data.

Orders. Products purchased, the associated design, shipping and billing addresses, phone number, amounts, VAT, delivery country, discount codes used, invoice details (tax code or VAT number, recipient code or certified email), statements given at checkout (acceptance of the terms, exclusion of withdrawal, duties) with date and time, payment outcome, shipping status and tracking number. Full card details are processed only by Stripe.

Images and designs. The photos you upload, designs and previews, weaving files. If an artificial intelligence transformation is applied to the image, also the chosen style and the generated image. Styles are predefined: we do not process instructions written by you. Photos may show people, including minors: by uploading them you confirm you are entitled to do so (see the Content rules).

In the no-account trial ("Try" page) the photo stays in your browser and is not sent to us until you create an account; it is automatically deleted from your device after 30 days.

Programmes. Waiting list: email, any occasion and date you give us, optional newsletter consent, confirmation date. Invitations and "invite a friend": the invitation code, who invited whom, any rewards; if from your account you ask us to send an invitation to a friend, the email address you enter. Creator affiliate programme: name, contact details, assigned code, orders attributed to the code (without the buyers' personal data), commissions. The data needed to pay commissions is collected outside the site, at the time of payment.

Country requests. Email and requested country, to let you know when we start shipping there.

Technical data. To protect the service from abuse we compute a non-reversible fingerprint (hash) of your IP address, used to limit the number of requests and automatically deleted after about one hour. Our systems record technical request data in logs for security and troubleshooting.

Statistics. Only if you accept it in the cookie banner, Google Analytics 4 (loaded through Google Tag Manager) collects data on how the site is used under a pseudonym: pages viewed, device and browser, navigation events, never names, email addresses or photo content. Details are in the Cookie policy.

Communications. Emails you send us and our replies.

For each purpose we state the legal basis under Article 6 GDPR:

Providing the data marked as required in forms is necessary to create an account and complete an order; without it we cannot provide the service. We do not take decisions based solely on automated processing that produce legal effects concerning you.

We use providers that process data on our behalf as processors (Art. 28 GDPR):

AI transformation requests use Google Gemini models. In every request we ask OpenRouter to route them only to providers that state they do not retain the data or use it to train models ("zero data retention" and "data collection: deny" options).

The following act as independent controllers under their own privacy notices: Google, when you choose to sign in with your Google account; Stripe, for the anti-money-laundering and anti-fraud obligations imposed on it by law; the carriers delivering your parcel; customs authorities for non-EU shipments; our accountant and advisers, bound by professional secrecy; tax and judicial authorities where required by law.

We do not sell your data or share it with third parties for marketing. Uploaded images are not published and are not visible to other users.

Some providers (OpenRouter, Google, Stripe, and AWS for some support functions) may process data in the United States or other countries outside the European Economic Area. In those cases the transfer relies on the European Commission's adequacy decision for companies certified under the EU-US Data Privacy Framework, or on the standard contractual clauses approved by the Commission, with the supplementary measures adopted by the provider. You can request a copy of the safeguards by writing to ordini@ordito.art.

We keep data for as long as needed for the purposes described in this notice and to meet our legal obligations:

You have the right to access your data, rectify it, obtain its erasure or restriction, object to processing based on legitimate interest, receive the data you provided in a structured format (portability) and withdraw consent at any time, without affecting processing already carried out (Articles 15-22 GDPR).

You can exercise them by writing to ordini@ordito.art; we reply within one month. In your account area you can at any time edit your profile and addresses, delete saved designs and request deletion of your account: access is disabled immediately and the data is erased within 30 days; if you have an order not yet concluded (that is, not yet delivered, cancelled or refunded), deletion happens once it is concluded. Deleting your account does not affect order data we are required by law to keep. Consent to statistics is withdrawn from the "Cookie preferences" link at the bottom of every page.

You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the supervisory authority of the country where you live or work.

Data is transmitted over encrypted connections (HTTPS) and stored on cloud infrastructure with access controls and encryption at rest. Access to order data is limited to the people who need it for production, shipping and support.

The service is for adults only. We do not knowingly collect data from minors as users. If you believe a minor has provided us with data, write to us and we will delete it. Photos of minors uploaded by an adult are processed only to make the requested product.

We update this notice when processing or providers change, stating the version date. We will notify you by email or with a notice on the site of any material change.