This policy explains what we collect, why, who else sees it, and what you can ask us to do about it. It covers both the sellers who hold an ABEM account and the buyers whose orders pass through our workshop.
Last updated: 9 October 2026
ABEM is operated by [LEGAL ENTITY NAME], [ENTITY TYPE] registered in [STATE], United States, at [REGISTERED ADDRESS]. In this policy “we”, “us”, and “ABEM” mean that company.
For privacy questions, write to [email protected].
ABEM is a production partner. Sellers list artwork on their own storefronts; we print, frame, and ship the resulting orders under the seller's name. That means we handle personal data in two distinct capacities, and your rights depend on which one applies.
For seller account data, we are the controller. We decide what an ABEM account needs in order to work, and you deal with us directly.
For buyer data, we are a processor acting for the seller.If you bought a print from a shop that uses ABEM, your name and address reached us so that we could make and ship your parcel. Your relationship is with that shop. We do not market to you, do not build a profile of you, and act only on the seller's instructions. If you want your data deleted, the fastest route is the shop you ordered from; if you come to us directly, we will act on it and tell that seller.
Email address, optional name, and the date the account was created. Authentication is handled by Supabase, which also holds your password in hashed form; we never see or store the password itself.
If you save a card to pay for orders, the card is held by Stripe. We store Stripe's customer reference and the date you agreed to be charged for your orders, which Stripe requires us to keep. We can see the card brand, last four digits, and expiry date, so that we can show you which card is on file.
When you ask us about a frame, we also keep a record of it: which frame colour and size you asked to hear about when it is back in stock, and which made-to-order framed sizes you asked for on the pricing page, each with the date you asked. We use these to answer you and to decide what to stock. Our own team can see who asked; no one else can. They are kept while your account is open.
Artwork files, along with the original filename and pixel dimensions, plus the products you build from them: size, orientation, frame, surface, the layout you arranged in the editor, the mockup image, and the print-ready PDF we generate.
Name, shipping address, city, state, postal code, country, the quantity ordered, and the carrier tracking number once it ships. This reaches us either because a seller entered it or, where a store integration is connected, because the sales channel passed it on. We ask for nothing beyond what a parcel needs.
We do not collect buyer payment details. Buyers pay the seller on the seller's own storefront; no card number, bank detail, or payment token ever reaches ABEM.
When you use the contact form or ask for a quote, with or without an account, we receive what you type: your name, email, and the details of your question or order. It arrives as an email in our inbox and is not stored in the site's database. We use it to answer you and keep it as ordinary business correspondence.
Standard server logs kept by our hosting providers, such as IP address, browser type, and the pages requested. We run no analytics, no advertising pixels, and no cross-site tracking of any kind.
One kind only: the session cookie that keeps you logged in, set by our authentication provider. It is strictly necessary, because without it the site cannot tell one logged-in seller from another. So it is not something we ask consent for and not something you can switch off while using an account. We set no advertising, analytics, or profiling cookies.
We do not sell personal data and we do not share it for advertising. We use the following processors, and nothing beyond what each one needs to do its job:
We also disclose data where the law requires it, and to shipping carriers, who receive the delivery address in order to deliver the parcel. If ABEM is ever sold or merged, personal data would transfer with the business; you would be told before that changed anything about this policy.
We are based in the United States and our providers are largely US-based, so data about sellers and buyers in the European Economic Area, the United Kingdom, and Switzerland is transferred to the United States. Where that transfer needs a legal basis, we rely on the European Commission's Standard Contractual Clauses with the providers listed above.
Be aware of one thing in particular: deleting a design, product, or order in your dashboard hides it, it does not erase it. The record is marked as deleted and disappears from your lists, but it stays in our database so that production history and past orders remain coherent. We would rather say this plainly than let you assume otherwise.
Order records, including buyer name and address, are kept for [RETENTION PERIOD] to support delivery, disputes, returns, and tax and accounting obligations. Account data is kept while the account is open. Artwork files are kept while the account is open, because they are what we print from.
If you want the underlying records genuinely erased rather than hidden, ask us and we will do it, subject to the records we are legally required to retain.
Artwork lives in private storage that is not publicly reachable; each seller's files sit in their own folder, and access rules at the storage layer stop one account from reading another's. Files are served through short-lived signed links rather than public URLs. Traffic runs over HTTPS. Production files needed by our workshop are reachable only by staff accounts, not by sellers. No system is perfect, and we do not claim otherwise; if a breach ever affects your data we will notify you and the relevant authority as the law requires.
If the GDPR or UK GDPR applies to you, you can ask for a copy of your data, have it corrected, have it erased, restrict or object to how we use it, and receive it in a portable format. Where we rely on consent you can withdraw it at any time. You can also complain to your national supervisory authority.
If you are a California resident, you can ask what we have collected about you, ask us to delete or correct it, and are entitled not to be discriminated against for asking. California also gives you the right to opt out of the “sale” or “sharing” of personal information and to limit the use of sensitive information: we do neither, so there is nothing to opt out of. We have not sold or shared personal information in the past twelve months.
To exercise any of this, write to [email protected]. We will verify who you are before acting, and answer within the time the applicable law allows. Requests are free unless they are repetitive or excessive.
ABEM is a service for businesses and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us data, tell us and we will remove it.
If we change this policy we will update the date at the top, and for anything that materially affects your rights we will tell account holders directly rather than relying on you to re-read the page. See also our Terms of Service.