Contour Posters

Privacy Policy

The short version

There are no customer accounts. For visitors in the United States, the storefront uses the Meta Pixel to measure how its advertising performs: it sets Meta cookies and reports page views, the opening of a design or the checkout page (with the print size, frame and price) — and, after checkout, that a purchase was made, with its amount and print size, but never your name, address or card — to Meta Platforms, Inc., which handles that data under its own privacy policy. The TikTok Pixel reports the same page views, design and checkout openings and purchases, with the same limits, to TikTok Technologies, Inc. For orders shipping to the United States, the storefront also reports the purchase to Meta from its own server, with the buyer’s email address, name and delivery address in hashed form so Meta can match it to an ad; Meta does not receive them in the clear. Visitors elsewhere are not measured at all. You can limit this with Meta’s ad settings or a tracker-blocking browser setting. Hosting and service providers may still keep ordinary security and access logs.

Who is responsible

The storefront is operated by Joseph Thompson, 179 Cowpath Rd, Medford, NJ 08055, United States, who decides how order data is used. Privacy questions and requests can be sent to [email protected] or to that address.

Design and browsing data

Poster choices are encoded in the page URL. They can remain in browser history and are visible to anyone or any service with whom you share the link. Before checkout, the storefront does not separately save the design. The settings-panel width is stored locally on your device.

Search terms pass through the Cloudflare-hosted search endpoint to LocationIQ. Terrain tiles are requested directly from Amazon Web Services, which receives the requesting IP address and tile coordinates.

To limit abuse, the API keeps short-lived, pseudonymised request counters derived from a salted hash of the requesting network address. Raw addresses are not stored in those counters, and each counter becomes deletable within minutes of its one-minute window ending.

Order and payment data

Stripe provides the secure checkout form and processes card data; full card details do not reach this storefront. After checkout, the order record can include the Stripe order reference, name, email address, delivery address, poster design and options, amount, currency, payment status, fulfillment status and timestamps. Those details are used to take payment, make and deliver the print, send transactional messages, prevent duplicate fulfillment, handle support, returns, refunds, disputes and accounting.

Where EU or UK data-protection law applies, this processing rests on performing the contract with you, on legal record-keeping obligations for the retained transaction record, and on legitimate interests in preventing fraud and keeping the service secure.

Email sign-up

If you ask for the welcome discount, your email address is stored with the date, the page you signed up from and your country as the network reports it. We first email you a link to confirm the address is yours; nothing else is sent until you confirm. After that it is used to send the code you asked for and occasional emails about new collections and offers. Where EU or UK data-protection law applies, this rests on your consent, which you give by confirming from that email. An address that is never confirmed receives nothing further. Every such email carries an unsubscribe link, and unsubscribing stops them. Signing up is never needed to place an order, and order emails are separate: they are sent whether or not you are on this list.

Retention

Recipient name, email address, delivery address, free-form design and title data, and carrier tracking URL or code are retained for up to 120 days after delivery, or for up to 120 days after payment if an order never reaches delivery, so fulfillment and return issues can be handled. They are then erased from the storefront order record. Order and provider references, item size and frame, amount and currency, status and timestamps may be retained for up to seven years for accounting, tax, fraud and refund reconciliation. Data needed for an active refund, chargeback, fraud review or legal dispute may be kept until that matter is resolved.

Service providers

Order and site data is processed only as needed by these services:

  • Cloudflare hosts the site and API, stores order records, and processes IP addresses and request logs for delivery and security.
  • Stripe provides the checkout form and processes payment, customer contact and delivery information.
  • Gelato is the fulfillment processor. It receives the print file, order options, recipient name, email and delivery address so it can make and ship the order.
  • Resend is the transactional email processor. It receives the buyer's email address, the order, status or tracking details included in a message, and — in the order confirmation — the design's title and location text and a rendered preview image of the poster.
  • Meta Platforms, Inc. receives page-view and purchase events from visitors in the United States — amount and print options, and for U.S. orders the buyer’s email, name and delivery address as hashes — and sets its own cookies through the Meta Pixel, for advertising measurement.
  • LocationIQ processes place-search terms. OpenStreetMap supplies the underlying place data, and Amazon Web Services supplies terrain tiles.
  • If an operator-alert integration is configured, its provider (for example Slack or a compatible relay) receives an order reference, size, frame, amount, status and any operational provider or hold reference. These alerts exclude the buyer's name, email address, delivery address and poster design.
  • The provider of the support mailbox processes messages you choose to send to [email protected].

Personal data is not sold, rented or used for third-party advertising. Each provider may retain its own service records under its terms and privacy policy.

Some of these providers process data in the United States and other countries outside yours. Where EU or UK law applies, those transfers rely on the safeguards each provider maintains, such as EU–U.S. Data Privacy Framework certification or standard contractual clauses.

Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, restrict or receive a copy of personal data, or to object to certain processing. Email [email protected] with the order reference and request. A deletion request cannot override a record-keeping duty or an active payment, fraud, dispute or legal matter. If you are in the EU or UK, you also have the right to lodge a complaint with your data-protection supervisory authority.

Last updated: September 26, 2026