Privacy Policy

1. Who is responsible

Wall Club AS, organization number 938 433 100, Møllergata 6, 0179 Oslo, Norway, operates thewallclub.co and is the controller responsible for the personal data described in this policy. Wall Club AS is part of World of Eureka AS. Contact us at [email protected].

2. Information we process

Your photos and artwork. We process the photos you upload, the artwork created from them, your edits and crops, and the files prepared for printing. Photos may contain personal information about you or other people.

Your account and saved work. We process the identifiers that connect your saved work to your guest session or account, and any account details you choose to provide.

Your orders. When you order, we process your contact and delivery details, selected products, payment status and correspondence about the order. We also keep a record of the preview and options you approved, including the time of approval. Payments are handled by Stripe, and we never receive your full card number.

Complaints and support. If you report a problem with an order, we process the information and photos you send us.

Marketing. If you subscribe to our newsletter or consent to marketing, we process your email address or phone number for this purpose.

Technical information. We process information needed to run and protect the website, such as browser and device details, requests, errors and security logs. If you consent, analytics and advertising services also process information about how you use the website and which campaigns brought you here. This can include session recordings.

3. Why we use it

To provide the service and deliver your order. We use your photos, artwork, account and order details to create your artwork, take payment, print and deliver your products, and handle support and complaints. The legal basis is performing our contract with you, or taking steps at your request before entering into one.

To document your approval. We keep a record of the preview you approved so we can handle complaints and establish or defend legal claims. The legal basis is our legitimate interest.

To meet legal obligations. We keep information required for accounting and other statutory duties. The legal basis is compliance with legal obligations.

To keep the service safe and working. We use security, fraud prevention and error monitoring information to operate a safe and reliable service. The legal basis is our legitimate interest.

Analytics and advertising. We only use optional analytics, session recordings and advertising cookies if you consent. You can change your choices at any time on our Cookie Policy page. If you decline, we may still receive limited measurement data without cookies, as described in our Cookie Policy.

Marketing. We send newsletters and offers if you have consented. As an existing customer, we may also send you marketing about similar products, as permitted by law. You can unsubscribe at any time using the link in each message or by contacting us.

4. Your photos

We only use your photos to create, print and deliver your order, and to handle support, reprints and complaints. Your photos are not used to train AI models. We do not sell your photos unless you have given separate consent, and we only use customer photos or artwork in our marketing if you have given separate consent.

5. Who receives information

We use trusted service providers to run the website and deliver your order. Each provider only receives the information needed for its function:

• Supabase: accounts, database and file storage
• Vercel: hosting and website measurement
• Sanity: website content
• fal.ai: AI processing when you use an AI style
• Gelato and its production and delivery partners: printing and shipping, including print files, delivery details and, where needed, information about complaints
• Stripe: payment processing, which may include a preview image of your order
• Resend: order emails
• Sentry: error monitoring
• PostHog: product analytics and session recordings, if you consent
• Google and Stape: measurement and advertising, based on your consent choices
• Cookie-Script: cookie preference settings

We may also disclose information where required by law, or where necessary to establish, exercise or defend a legal claim.

6. Processing outside Norway and the EEA

Some providers and production partners process information outside Norway and the European Economic Area, including in the United States and in the country where your order is produced. When this happens, we make sure there is a valid legal basis for the transfer, such as an adequacy decision or the EU standard contractual clauses. Contact us if you want more information about this.

7. How long information is kept

Saved artwork. Your saved artwork is kept while you have an account and need it. Deleted artwork is removed after about 7 days. Guest sessions without orders are removed after about 30 days of inactivity. Print files for unpaid orders are removed after about 30 days. Deletion runs periodically, so the exact timing may vary slightly.

Orders. Print files and records of approved previews are kept for 2 years after delivery, so we can handle complaints and reprints. Accounting records are kept for 5 years, as required by Norwegian accounting law. Deleting artwork from your gallery does not delete files connected to an order you have already placed.

Other information is kept only as long as needed for the purpose it was collected for. Backups and logs at our providers may have their own deletion cycles.

You can delete your account in your account settings. Any ongoing orders must be completed first. Where we are required to keep a record, we limit the personal information in it as far as possible.

8. Your rights

Subject to applicable law, you can ask to access or correct your data, request erasure, restrict or object to processing, and receive data in a portable format. You can withdraw consent without affecting processing that was lawful before withdrawal. We may need to verify your identity before acting on a request.

Email [email protected] to exercise these rights. You can also complain to Datatilsynet, Norway's data-protection authority, or the competent authority where you live. Mandatory privacy rights in your country continue to apply.

9. Photos of other people and children

Only upload photos you have the right to use, and make sure you have permission from the people in them. Take particular care with photos of children, and get permission from a parent or guardian where needed. Our service is intended for adults. Contact us if you believe personal information has been uploaded or used without permission.

10. Security and changes

We protect your data with access controls and encrypted connections, and our partners only get the access they need. No online service can guarantee complete security, but we work to keep your data safe. We update this policy when our practices change. The effective date at the top shows the current version.