Privacy Policy

1. Data Controller

Your personal data is processed by Barcodeclothing AS, a company registered in Norway, operating under the brand name Wallesque. For any privacy-related enquiries, contact us at hello@wallesque.com.

2. Data We Collect

• Name, email address, and shipping address — collected at checkout to fulfil your order
• AI prompts — the text descriptions you submit to generate artwork
• Anonymous session tokens — a cookie (poster_session_id) used for rate limiting and service integrity
• Payment data — we do not store your card details; payments are handled entirely by Stripe

3. Legal Basis for Processing (GDPR Article 6)

• Performance of a contract (Art. 6(1)(b)): We process your name, email, shipping address, and order data because it is necessary to fulfil your order.
• Legitimate interests (Art. 6(1)(f)): We process session tokens and prompt data for fraud prevention, abuse detection, and service integrity. We have assessed that this does not override your fundamental rights.
• Legal obligation (Art. 6(1)(c)): We retain transaction records for the period required by Norwegian accounting law.

4. How We Use Your Data

• Processing and shipping your order
• Sending you order confirmation and status updates
• Preventing fraud and rate-limit abuse

We do not use your data for advertising, and we do not sell your personal data to any third party.

5. Data Retention

• Order data (name, address, email, order details): retained for 5 years to comply with Norwegian accounting obligations
• Generated artworks: stored in our cloud storage for up to 12 months, then automatically deleted
• Session tokens: expire after 24 hours

You may request earlier deletion of your personal data by contacting hello@wallesque.com, subject to our legal retention obligations.

6. Data Sharing & International Transfers

We share your data with the following third parties only as necessary to operate our service:

• Gelato AS (print fulfilment partner) — receives your shipping address and generated artwork to print and ship your order. Gelato may process data in the United States.
• Stripe, Inc. (payment processor) — processes your payment. Stripe operates in the United States.
• OpenAI, Inc. (AI processing) — your prompts may be processed by OpenAI for enhancement before image generation. OpenAI operates in the United States.

All US-based partners operate under Standard Contractual Clauses (SCCs) or equivalent safeguards as required by GDPR Chapter V. We do not sell your data.

7. Cookies

We use a single functional cookie (poster_session_id) solely for rate limiting and service integrity. This cookie contains no personal information and expires after 24 hours. We do not use advertising, tracking, or analytics cookies.

8. Your Rights (GDPR)

Under GDPR, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (subject to legal retention requirements)
• Restrict or object to processing
• Receive your data in a portable format

To exercise any of these rights, contact us at hello@wallesque.com.

You also have the right to lodge a complaint with the Norwegian Data Protection Authority: Datatilsynet — www.datatilsynet.no.

9. Changes to This Policy

We will notify you of any material changes to this Privacy Policy by email or by displaying a prominent notice on our website prior to the change taking effect.