Privacy Policy

Who is responsible

Wall Club AS, organisation number 938 433 100, Møllergata 6, 0179 Oslo, Norway, operates thewallclub.co and is the controller responsible for the personal data described here. Wall Club AS is part of World Of Eureka AS. Contact us at [email protected].

Information we process

We process photos you upload, the artwork generated from them, edits and crops, and the files prepared for printing. Photos may contain personal information about you or other people.

We process the guest-session or registered-account identifiers that connect your saved work to you, and account details you choose to provide. When you order, we process your contact and delivery details, selected products, payment status, and correspondence about the order. Stripe handles payment details; we do not receive your full card number.

We also process technical information needed to operate and protect the service, such as browser and device details, requests, errors and security logs. Where you consent, analytics and advertising services process interaction and campaign information. Optional product analytics can include session recordings of how you interact with the website.

Why we use it

We process your uploads, artwork, account and order details to provide the service you request, take payment, print and deliver products, and handle support and complaints. The legal basis is taking steps at your request before a contract or performing our contract with you.

We process information needed for accounting and other statutory duties to comply with legal obligations. We use necessary security, fraud-prevention, error-monitoring and limited service-performance information for our legitimate interest in operating a safe, reliable service.

We rely on consent for optional analytics storage, session recording, advertising storage and advertising personalization. You can change your choices on our Cookie Policy page. Google consent mode may send limited cookieless measurement requests while optional consent is denied; declining optional cookies does not prevent every technical network request needed to deliver or measure the service in that mode.

Who receives information

We use service providers for the functions you request and for operating the website. These include Supabase for accounts, database and file storage; Vercel for hosting and website-usage measurement; Sanity for public website content; fal.ai for AI processing when you request an AI feature; Gelato and its production and delivery partners for printing and shipping; Stripe for payment processing; Resend for order emails; and Sentry for error monitoring.

Google services and Stape support measurement and advertising through our tag configuration and consent signals. PostHog supports product analytics and session recording when analytics consent is enabled. Cookie-Script provides the cookie preference interface when configured. Providers receive the information needed for their respective functions. For example, the printer receives print files and delivery details; payment checkout may include an order-preview image.

We may disclose information where required by law or necessary to establish, exercise or defend a legal claim. We do not sell your uploaded photos or use them as public promotional examples merely because you placed an order.

Processing outside Norway and the EEA

Some providers and production partners may process information outside Norway and the European Economic Area, including in the United States and in the country where an order is fulfilled. Where a transfer requires safeguards under data-protection law, the applicable arrangement must provide an appropriate legal basis, such as an adequacy decision or approved contractual safeguards. Contact us for information about the arrangements relevant to your data.

How long information is kept

Saved artwork remains associated with your account while it is needed to provide your saved-work features, subject to deletion and cleanup. The application is configured to make deleted artwork eligible for cleanup after seven days, and inactive guest accounts without orders eligible after 30 days. Unpaid order print files are eligible for cleanup after 30 days. Cleanup is periodic, so these are eligibility windows rather than guarantees of deletion at an exact hour; files still needed by another retained artwork or order may remain.

Paid-order records and print files may be retained separately from the editor to fulfil orders, handle complaints and reprints, meet accounting obligations, and establish or defend claims. Deleting an artwork from your gallery does not by itself delete an existing order's files. Records required by law are kept for the applicable statutory period. Other information is retained only while needed for the purpose for which it was collected, including resolving support or security incidents.

You can request deletion or further information about a particular record at [email protected]. Account settings provide a deletion option; outstanding orders may need to be resolved before account deletion can complete. Where we must retain a business record, we remove or limit personal information where possible. Provider backups and logs can have separate retention cycles.

Your rights and choices

Subject to applicable law, you can ask to access or correct your data, request erasure, restrict or object to processing, and receive data in a portable format. You can withdraw consent without affecting processing that was lawful before withdrawal. We may need to verify your identity before acting on a request.

Email [email protected] to exercise these rights. You can also complain to Datatilsynet, Norway's data-protection authority, or the competent authority where you live. Mandatory privacy rights in your country continue to apply.

Photos of other people and children

Upload photos only where you have the necessary rights and permission. Take particular care with photos of children and obtain permission from their parent or guardian where required. Our ordering service is intended for adults. Contact us if you believe personal information has been uploaded or used without authorization.

Security and changes

We use access controls and encrypted connections to protect customer content. Print and processing partners receive access needed for their functions; no online service can guarantee absolute security. We update this notice when our practices change. The effective date shown on this page identifies the current version.