Your privacy matters to us. We are committed to protecting your personal data and being transparent about how we use it.
Bolot Studio processes contact, order, payment, usage and uploaded-content data for the purposes described here. Service providers may receive data where needed. Rights and deletion requests remain subject to identity checks, legal exceptions and required retention.
Last updated: March 2026
BOLOT Sp. z o.o.
ul. Władysława Sikorskiego 6A/10, 44-196 Knurów, Poland
Tax ID (NIP): 9691668738
Business Registry (REGON): 540261047
National Court Register (KRS): 0001139800
Privacy contact: privacy@bolotstudio.com. This notice does not currently name a statutory data protection officer, a person in charge of the protection of personal information under Quebec Law 25, or a UK Article 27 representative. Send privacy questions and rights requests to the Polish controller at that address. If a destination-specific contact is legally required and formally appointed, its details will be published in this notice.
We collect only the data necessary to provide our services and improve your experience
Name, email address, shipping address, and phone number (optional) to process and deliver your orders.
Payment details are processed securely through Shopify Payments. We never store your full card details.
IP address, browser type, pages visited, and time spent on our site to improve our services.
Files uploaded for custom prints may be stored in Google Cloud Storage and processed through Google Gemini/Imagen or Anthropic-supported features when those workflows are used. Access, purpose and retention depend on the workflow and provider configuration.
Under Article 6 of the GDPR, we process your personal data based on the following legal grounds:
Processing your order, payment, shipping, and providing customer support for your purchases.
Marketing communications, newsletters, and non-essential cookies. You can withdraw consent at any time.
Website analytics, fraud prevention, security monitoring, and improving our services.
Tax records, invoices, and accounting documentation as required by Polish and EU law.
To process and fulfill your orders, send confirmations and shipping updates.
To respond to your questions, requests, and provide assistance when needed.
To improve our website, products, and overall customer experience.
With your consent, to send promotional offers and newsletters. You can unsubscribe anytime.
We use cookies and similar technologies to enhance your browsing experience and analyze site traffic.
You can manage your cookie preferences in your browser settings at any time.
We use the providers listed below for specified functions. The recipient entity, processing location and transfer safeguards can vary with the service and account configuration; contact privacy@bolotstudio.com for information relevant to your data.
In accordance with GDPR Art. 13(2)(f), we inform you about automated processing of your data:
We analyse browsing patterns (pages visited, time spent, products viewed) to classify your shopping intent into categories (e.g., casual browser, ready-to-buy). This helps us personalise your experience and show relevant content. No automated decisions with legal effects are made based solely on this profiling.
With your marketing consent, we use your purchase history and browsing behaviour to show you relevant advertisements on third-party platforms (Meta, TikTok, Google). You can opt out by withdrawing marketing consent in cookie settings.
You have the right to object to profiling under GDPR Art. 21. To exercise this right, contact us at support@bolotstudio.com or withdraw marketing consent in your cookie settings.
Under GDPR and other privacy regulations, you have the following rights regarding your personal data:
Request a copy of all personal data we hold about you.
Request correction of any inaccurate or incomplete data.
Request deletion of your personal data from our systems.
Receive your data in a machine-readable format.
Object to processing of your data for direct marketing.
Withdraw your consent for data processing at any time.
To exercise any of these rights, contact us at support@bolotstudio.com
We implement appropriate technical and organizational measures to protect your personal data:
Some providers may process data outside the EEA. The recipient, location and transfer mechanism depend on the current provider entity, service and account. We describe a DPA, SCCs, DPF, adequacy decision or TIA only where current records support it; contact privacy@bolotstudio.com for information relevant to your transfer.
Shopify Inc.
Canada & USA
EU-US Data Privacy Framework & Standard Contractual Clauses (SCCs)
Stripe, Inc.
USA
EU-US Data Privacy Framework & Standard Contractual Clauses (SCCs)
Google LLC
USA
EU-US Data Privacy Framework
Microsoft (Clarity)
USA
EU-US Data Privacy Framework & Standard Contractual Clauses (SCCs)
TikTok (ByteDance Ltd.)
USA, Singapore, and potentially the People's Republic of China
Recipients and transfer mechanisms vary with the service and account configuration. Contact privacy@bolotstudio.com for information about safeguards relevant to your data.
You can request information about the specific safeguards in place by contacting us at support@bolotstudio.com.
To ask which TikTok entity, recipient location and transfer safeguard applies to your data, contact privacy@bolotstudio.com.
The periods below are category-specific guides, not a blanket deletion guarantee. We may retain data longer where needed to comply with law, resolve disputes, protect security, establish or defend legal claims, complete backup cycles, or account for a processor's retention rules. Subject to those needs, data is deleted or anonymized when it is no longer required for the stated purposes.
Generally 5 years for accounting and tax records, counted under the rule applicable to the relevant year or period; other order data follows contract, claims and legal-necessity periods. Longer holds may apply.
Until account deletion request or 3 years of inactivity
Until consent withdrawal, or maximum 3 years from last active engagement
For as long as needed for the selected feature, production, support or claims under the approved schedule. Our deletion and GCS, Gemini or Anthropic processor retention are separate; no immediate or 90-day deletion is promised.
According to the configured analytics service and consent settings; identifiers, event data and aggregated or anonymized outputs may have different periods.
This covers the messages you exchange with our AI shopping assistant and a technical session identifier. We store them on our servers for a maximum of 24 hours, after which they are deleted automatically. You can delete the conversation sooner with the “Clear conversation” control, which removes it from our servers, not only from your browser. Access requests (Art. 15) and erasure requests (Art. 17) include this chat history, for guests as well as signed-in customers.
Our workflow retention is separate from processor-side retention. Provider logging and retention depend on the service and account configuration, and Google Cloud Storage objects follow configured lifecycle controls. Contact privacy@bolotstudio.com for current information relevant to your data or request.
3 years from last interaction
3 years (GDPR compliance documentation)
Our services are not intended for children under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.
We may update this privacy policy from time to time. Significant changes will be communicated via email or a prominent notice on our website before they take effect.
If you have concerns about our handling of personal data, contact us first. You may also complain to your local supervisory authority. In Poland: President of the Personal Data Protection Office (UODO), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, uodo.gov.pl, tel. 22 531-03-00.
President of the Personal Data Protection Office (UODO)
ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland
www.uodo.gov.pl · 22 531-03-00
Our team is here to help with questions about your data or privacy rights. We respond as soon as reasonably possible on business days.
Contact Us