What we know about you,
and what we do with it.

ZAANVO LLC, operating under the brand name Zaanvo, designs, manufactures, and sells tempered glass backsplashes, wall art, and custom photo panels through zaanvo.com. The studio is located in Florida, USA, and we ship directly to customers worldwide.

For the purposes of this Privacy Policy and applicable data-protection laws, including the GDPR where applicable, ZAANVO LLC is the data controller responsible for deciding how and why personal data is processed.

Email us at info@zaanvo.com with any privacy question.

We only collect data you give us, in one of three ways:

1. When you place an order

• Your name (so we can address you and label the parcel)
• Your email (to send the order confirmation once online checkout launches)
• Your shipping address (so UPS or FedEx can deliver)
• Your phone number, if you provide it (the shipping carrier uses it for delivery contact)
• The items, sizes, and prices in your order

2. When you write to us

• Your name and email
• The subject and message you sent us

3. Automatically, when you visit

• Our hosting provider (Vercel) records basic request information — IP address, time, page requested, browser user-agent — in short-lived server logs, to keep the site running and to detect abuse.
• We keep your cart in your browser's localStorage so it survives page refreshes. That data never leaves your device.

4. Analytics & advertising (only if you opt in)

If you accept the analytics category in our cookie banner, two processors load:

• Vercel Web Analytics counts page views and which pages people read. It is cookie-free, IP-anonymised before storage, and aggregated per day.
• Pinterest Tag — a small JavaScript pixel from Pinterest. It records that a browser visited zaanvo.com and, if a purchase happens, reports the order value + our internal order number back to Pinterest so we can measure whether our pins and Pinterest ads are actually driving orders. It sets Pinterest cookies. We do not send Pinterest your name, email, address, or any information about the items you viewed beyond the fact that a purchase occurred and its USD total.

If you don't accept, nothing in this section is loaded — no scripts, no cookies, no requests to Vercel Analytics or Pinterest. You appear in our server logs the same as everyone else (see #3 above) but not in any analytics dashboard or advertising audience.

5. When you use a custom design builder

Our custom photo backsplash and custom glass wall art builders let you turn your own image into a tempered-glass panel. When you use them we may collect:

• The uploaded photograph, artwork, pattern, or design file
• Its original pixel dimensions
• The glass dimensions you selected (width and height)
• The orientation (portrait, landscape, or square)
• Image positioning or fit information (the custom-backsplash builder scales your full image to the selected panel proportions rather than cropping)
• The image-quality result (effective PPI + rating)
• The mounting option you chose
• A saved-design identifier, if you use "Save my design"
• Your email address only if you choose to email a saved link to yourself
• The link between the saved design and your order, if the design is later purchased

What we still don't collect: no Google Analytics, no Meta / Facebook pixel, no cross-site fingerprinting. If any of that changes, this page changes first.

Under the UK and EU General Data Protection Regulation ("GDPR"), every collection of personal data needs a lawful basis. Ours:

• Order data— to perform our contract with you (Article 6(1)(b)). We can't make and ship a panel without knowing where to send it.
• Contact form data — your consent when you submit the form (Article 6(1)(a)), and our legitimate interest in replying to your message (Article 6(1)(f)).
• Server logs — our legitimate interest in keeping the site secure and operational (Article 6(1)(f)).
• Uploaded design data— depends on what you do with it. Uploading and previewing are steps you request before entering into a contract (Article 6(1)(b)); if you purchase, the image and configuration become necessary to perform your order (Article 6(1)(b)). If you tick "Keep my image securely for easier future reprints" at checkout, we hold the file for a longer window based on your specific consent (Article 6(1)(a)) — you can withdraw that at any time. Basic security and fraud-prevention checks on saved designs and shared preview links rely on our legitimate interest (Article 6(1)(f)).

We never sell your data. We use a small set of service providers to run the site — each acts as a processor on our instructions:

• Supabase Inc.
• Resend Inc.
• Vercel Inc.
• Cloudflare, Inc.
• Pinterest, Inc. (only if you accept analytics — see #4 above)

For shipping, we also share your name, address, and (when provided) phone with the carrier that delivers your parcel: UPS for United States orders shipped from our Florida studio, and FedEx for international orders shipped from our Turkey studio.

We never sell your data. The only advertising-adjacent processor we use is the Pinterest Tag noted above, and only for visitors who explicitly opt in.

Because Supabase, Resend, and Vercel host data in the United States, your data leaves the EU/UK when we serve EU/UK customers. Each of those providers offers Standard Contractual Clauses or equivalent transfer safeguards approved by the European Commission, which we've accepted.

• Order records— 10 years from the order date. We're required to keep them this long under applicable tax law.
• Contact-form messages — 2 years from the date you wrote in, then deleted.
• Server logs — retained by Vercel for around 30 days, then automatically purged.
• Cart in localStorage— sits on your device until you clear your browser or finish checkout. We can't delete it from your end; you can clear your browser's site data at any time.
• Uploaded custom-design images and saved-design records — governed by their own timetable (60 days unpurchased, 180 days after fulfilment, up to 3 years if you explicitly opt in to reprint retention). See the dedicated section below for the full detail.

When you use the custom photo backsplash or custom glass wall art builders, the image you upload is stored privately on our behalf so we can generate a preview, save your design, and — if you buy — produce your panel. What follows is what actually happens to that image, in plain English.

How your image is fitted to the panel

When you upload an image for a custom backsplash, Zaanvo places the full design onto the selected glass-panel proportions. The image may be resized or proportionally adjusted to fit the selected width and height, but the builder is designed to keep the complete image visible rather than removing parts of it through cropping.

The preview allows you to review how the image will appear at the selected panel proportions before approving the design. The custom wall-art builder shows the image inside a center-fit preview so you can confirm placement, and any crop / zoom controls added in a future update will be opt-in rather than applied silently.

Where we store it

Uploaded images and saved design records live on Supabase Storage in a private bucket. We do not attach direct storage URLs to public pages, private preview links, or emails. When someone with a valid /design/… link views a saved design, our server issues a short-lived, access-controlled URL that expires within about an hour and never exposes the underlying storage path.

Who can see it

• You, while you have the browser session or the private preview link.
• Anyone else you send the preview link to, until the link expires. The link is unguessable but you do choose to share it — treat it the way you would a "view-only" link to a photo album.
• The ZAANVO LLC team members responsible for producing your panel and handling your support requests, if the design is purchased.

We do not share your uploaded images with advertisers, data brokers, social networks, or with any other customer. We do not use them to train generative-AI models — ours or anyone else's.

How long we keep it

Unpurchased designs. If you save or share a design but do not purchase it, we delete the uploaded image, generated previews and saved design data 60 days after the design was last saved or updated. Viewing a shared preview link does not extend that window — only saving or editing does.

Purchased production files. When you purchase a custom product, we normally retain the uploaded image and production files for 180 days after the order is delivered or fulfilled so that we can review production issues and handle reasonable damage or replacement requests. We then delete those image files unless you have asked us to keep them for future reprints.

Optional reprints. If you choose "Keep my image securely for easier future reprints", we may retain the image for up to three years after the most recent order using that image. You can withdraw this permission at any time by contacting us. If you place a new order using the same image, the three-year window may renew from the date of that new order.

Deletion requests. You may ask us to delete an uploaded image at any time. We may need to verify your identity first. We may retain limited order and transaction records when required for tax, accounting, fraud-prevention or legal purposes, but those records do not require us to retain your uploaded image indefinitely.

Requests reach us at info@zaanvo.com. Where technically feasible we will process a verified deletion promptly rather than waiting for the automatic expiration date. Where our storage provider keeps deleted files in short-lived backups, those copies age out on the provider's own schedule; we do not use those backups for any purpose other than disaster recovery.

Ownership

By uploading an image, you confirm that you own the copyright or have permission from the copyright holder to reproduce it on a printed product. If you believe a Zaanvo product infringes your copyright, write to us at info@zaanvo.com with a description of the work, evidence of ownership, and the product URL in question, and we will remove the listing while we review.

Shared preview links

Private preview pages at zaanvo.com/design/… use an unguessable token in the URL and are marked noindex, nofollow— search engines will not index them. They expire on the same schedule as the design itself and never display the email address of the person who created the design. A recipient can start their own design based on what they saw but cannot overwrite or purchase the original owner's saved design.

We use a small number of cookies — all strictly necessary for the site to work — and no advertising cookies of any kind:

• Cart state — stored in your browser's localStorage, not in a cookie. It only contains the items you added.

If we ever add analytics or non-essential cookies, we'll present a clear consent prompt before they load — and update this page first.

If you're in the EU, UK, or another GDPR-equivalent region, you have the right to:

• Access a copy of the personal data we hold about you
• Correct inaccurate data
• Delete your data, subject to our tax-law retention obligation on completed orders
• Restrict or object to specific uses of your data
• Port your data to another service in a machine-readable format
• Complainto your local data-protection supervisory authority if you think we're mishandling your data

To exercise any of these rights, email info@zaanvo.com. We aim to respond within 30 days. We may ask you to confirm your identity first, so we don't hand your data to someone else.

Our products aren't marketed to children, and we don't knowingly collect data from anyone under 16. If you believe a child has submitted personal data through our site, email us and we'll delete it.

• All traffic to the site is encrypted with TLS (HTTPS).
• Our database is protected by Row-Level Security policies that deny anonymous access to order, contact, and custom-design data by default.
• Uploaded custom-design images are stored in a private storage bucket and served through short-lived, access-controlled URLs — the raw storage path is never exposed to the browser.
• Private preview links use unguessable tokens and expire automatically. A daily cleanup job deletes expired uploaded images, saved-design records and their share tokens on the schedule described in the previous section.
• Admin access requires a signed-in account with a strong password and short-lived session cookies.
• Service-role credentials (which can bypass database security) are never sent to your browser — they live only on our server.

No system is completely secure. We follow the safeguards above and update this list when we change the underlying setup, but we cannot promise absolute protection against every possible threat.

When we update this policy, the "last updated" date at the top of this page changes. For material changes — for example, adding a new third-party service that processes personal data — we will email customers with active orders before the new policy takes effect.