Last updated: 21/07/2026

Facade Club is a trading name of Yellowbear Ltd (company number 13405702), Forma House, 40 Bowling Green Lane, London, England, EC1R 0NE, United Kingdom. Yellowbear Ltd is the data controller for the personal data described in this policy.

Questions, requests, deletions: hello@facadeclub.com. A person will answer.

This policy is written for customers and visitors in the UK and the EU. We comply with the UK GDPR and the EU GDPR.

---

1. The short version

Your photograph is used for one thing: making your artwork. It is handled securely, never sold, never shared for anyone else's marketing, and never used to train AI models. We delete it on request — just ask.

2. What we collect

You give us:

• Your photograph of a place, uploaded to create artwork, and the artwork generated from it.
• Order details — name, email, delivery address, phone number (for the courier), and what you bought.
• Account details, if you save artworks to an account — email and password (stored hashed).
• Messages you send us (support emails, photo of a damaged delivery, etc.).

Collected automatically:

• Payment data is handled by Shopify Payments; we never see or store your full card number.
• Technical data — IP address, device and browser information, and how you use the site, via cookies and similar technologies (see our [Cookie Policy]).

We do not collect any special-category data, and our service is not directed at children.

3. What we use it for, and on what legal basis

Purpose	Legal basis
Creating your artwork from your photograph, showing you the preview, printing and delivering your order	Performance of a contract (Art. 6(1)(b))
Payment processing, fraud prevention	Contract; legitimate interests (Art. 6(1)(f))
Transactional emails (order confirmation, delivery updates)	Contract
Customer support, handling reprints and complaints	Contract; legal obligation (Art. 6(1)(c))
Keeping records for tax and accounting	Legal obligation
Marketing emails (only if you opt in)	Consent (Art. 6(1)(a)) — withdraw any time, one click
Site analytics and improving the product	Consent (cookies) and/or legitimate interests, depending on the tool

What we do not do: we do not sell personal data; we do not share your photograph or artwork for anyone else's marketing; we do not use your photographs or artworks to train AI models, and our AI providers are engaged on terms that do not permit them to do so either.

4. Who we share data with (processors and partners)

We use a small set of service providers to run Facade Club. They act on our instructions and only receive what they need:

• Shopify (e-commerce platform and Shopify Payments) — checkout, orders, payment.
• Gelato — our print and fulfilment partner. Receives the final print file and your delivery details (name, address, phone, email) so the piece can be produced near you and delivered. Production happens in the UK and EU.
• AI image services (Google and OpenAI) — receive the uploaded photograph transiently to generate the artwork. Used via their business APIs, which do not use your content to train their models.
• Magnific — upscaling of the final artwork file.
• Amazon Web Services (S3, EU region) — secure storage of photographs and artwork files.
• Supabase (EU region) — our database.
• Fly.io — application hosting.
• [Email provider] — transactional emails.

We may also disclose data where the law requires it, or in connection with a business sale or restructuring (your rights stay protected).

5. International transfers

We keep photo and artwork storage and our database in the UK/EU. Some providers (for example the AI image services and our hosting provider) may process data in the United States or other countries. Where that happens, transfers are protected by an adequacy decision (including the EU–US and UK–US Data Privacy Frameworks, where the provider is certified) or by Standard Contractual Clauses / the UK IDTA.

6. How long we keep things

• Uploaded photographs and generated artworks (with an order): kept for [12 months] after delivery so we can handle reprints, then deleted. Deleted earlier on request.
• Preview artworks not ordered: deleted automatically after [30 days], unless saved to your account.
• Order and invoice records: kept 6 years (UK tax law) — this covers the order facts, not your photograph.
• Account data: for as long as the account exists; ask us to close it any time.
• Support correspondence: up to [2 years].

You can ask us to delete your photograph and artwork at any time; we will do so unless we are mid-way through fulfilling your order or legally required to keep something.

7. Your rights

You have the right to access your data, correct it, delete it, restrict or object to processing, take your data with you (portability), and withdraw consent at any time. Email hello@facadeclub.com and we will respond within one month.

You also have the right to complain to a supervisory authority: in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, the data protection authority of the country where you live — for example CNIL (France), BfDI or your Land authority (Germany), APD/GBA (Belgium), AP (Netherlands), DSB (Austria), or DPC (Ireland). We would appreciate the chance to sort it out directly first.

8. Security

Data in transit is encrypted (TLS); files are stored in access-controlled EU-region storage; payment details are handled entirely by Shopify Payments (PCI-DSS compliant); access to production systems is restricted. No system is perfectly secure, but your photographs are treated as private by default — they are never public, and previews are watermarked.

9. Cookies

See our [Cookie Policy] for what we set, why, and how to change your choices.

10. Changes to this policy

If we change this policy in a meaningful way, we will post the new version here with a new date, and for significant changes we will tell account holders by email.