Privacy Policy

Effective date: October 13, 2026

This Privacy Policy explains how Quillmoss Studio collects, uses, shares, stores and protects personal information, and the choices and rights you have. Please read it together with the terms and privacy policies of the platforms we sell through, which govern the information those platforms collect themselves.

1. Who we are

Quillmoss Studio is the trade name of Roman Cintula, a sole proprietor based in Calgary, Alberta, Canada ("Quillmoss", "we", "us" or "our"). We sell printable digital products and made-to-order goods through our Etsy shop, QuillmossStudio, and publish books on Amazon under the imprints Quillmoss Press and Little Quillmoss. We also operate the website quillmoss.ca, a Pinterest business account, and a private software tool, Quillmoss Studio Manager, that we use to run our own shop.

Roman Cintula is responsible for how we handle personal information and for our compliance with this policy and applicable privacy law, and is the person who can answer your questions about it. You can contact him at info@quillmoss.ca.

2. What this policy covers

This policy applies to personal information we handle when you:

• buy from, or message, our Etsy shop;
• visit quillmoss.ca;
• interact with our Pinterest account or content;
• email us at info@quillmoss.ca or contact us in any other way; or
• buy one of our books on Amazon (to the limited extent described in section 3.5).

It also describes how Quillmoss Studio Manager, our internal tool, uses data received from the Etsy, Pinterest, Printify and Printful application programming interfaces (APIs). That tool is used only by our owner to manage our own accounts. It is not offered to the public, is not intended for or used by children, and does not access other people's accounts.

This policy does not cover the practices of Etsy, Amazon, Pinterest, payment processors, or other third parties, which collect and use information under their own privacy policies.

3. Personal information we collect

3.1 When you buy from our Etsy shop

Etsy shares with us the information we need to complete your order. This may include:

• your name and Etsy username;
• your shipping address and, for some orders, your email address or phone number where Etsy provides it for delivery;
• the items you ordered, quantities, prices, order dates and order status;
• any personalisation text, notes to seller, or files you provide for your order;
• messages you send us through Etsy; and
• reviews you leave for our shop, which Etsy shows to us and to the public.

If you order a gift, we receive the recipient's name, shipping address and any gift message. Personalisation requests may also include the names of other people, such as a child. Please share another person's information only if you are entitled to do so.

Providing your shipping details, and any personalisation for a personalised item, is necessary for us to fulfil your order. Without them we cannot complete it.

Etsy processes your payment. We do not receive or store your full payment card number, bank details or payment credentials.

3.2 When you visit quillmoss.ca

Our website is a simple information site. We do not use advertising cookies, tracking pixels or analytics tools on it, and we do not ask you to create an account. Our website hosting provider may automatically record technical information such as IP addresses, browser type and the date and time of requests in server logs, which it uses to deliver and secure the site. If we ever add analytics or cookies, we will update this policy first.

3.3 When you contact us

If you email us at info@quillmoss.ca or contact us another way, we receive your name, contact details and the content of your message, and we keep a record of our correspondence.

3.4 On Pinterest

We use Pinterest to share images of our own products. We do not collect personal information about people who view, save or click our Pins, other than the aggregated, non-identifying statistics that Pinterest provides to account owners about their own content.

3.5 When you buy our books on Amazon

Amazon sells and delivers our books and handles all customer data for those sales. Amazon does not give us the names, addresses or contact details of book buyers. We receive only sales and royalty reports, which we use for accounting and to understand which books sell.

3.6 Information we do not collect

We do not knowingly collect sensitive personal information, such as health, financial account, or government identification information. Please do not include such information in personalisation fields or messages.

4. How we use personal information

We use personal information only for the purposes below, and only to the extent reasonably necessary for them:

• to make, personalise, package and ship your order, and to deliver digital downloads through Etsy;
• to answer your questions, handle problems with orders, and process replacements or refunds;
• to keep business, accounting and tax records and to meet our legal obligations;
• to prevent, detect and respond to fraud, abuse, security incidents and violations of platform rules; and
• to improve our products and listings using aggregated, non-identifying information such as views and sales counts.

We do not sell personal information, and we do not use it to build advertising profiles. We do not send you marketing emails unless you have agreed or the law otherwise permits. Etsy may send offers or messages on our behalf through its own tools, under Etsy's policies, with an option to opt out.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

4.1 Software and AI-assisted tools

We use software tools to help run our shop. Some run on our own computer and some are online services. In particular:

• Design: we create our product designs with online design and AI image services, currently Canva, Higgsfield and Recraft. These services receive only design instructions and artwork. They never receive your name, address, messages, order details or personalisation text.
• Personalised items: when you order a personalised item, your personalisation text is added to the design on our own computer, or by our print-on-demand partner as part of making your order (see section 7). It is never sent to design or AI image services.
• Research and listings: we use AI-assisted tools to research products and prepare listings, using market and keyword data that contains no customer information.
• Replies to you: where an AI-assisted tool helps draft a reply to a message you send us, it runs on our own computer, or our owner writes the reply without it. Our owner reviews every reply before it is sent.

We do not send data obtained through the Etsy or Pinterest APIs, or your order details, to third-party AI services, and we do not use personal information about our customers to train artificial intelligence or machine learning models.

5. Legal bases for processing (United Kingdom and European Economic Area)

If you are in the United Kingdom or the European Economic Area, we rely on the following legal bases:

• performance of a contract: to process, make and deliver your order and handle any problems with it;
• legitimate interests: to run and protect our business, prevent fraud, improve our products, keep the tax and accounting records required of us under Canadian law, and respond to lawful requests from authorities, where those interests are not overridden by your rights;
• legal obligation: where a law of the United Kingdom or of an EEA country that applies to us requires the processing; and
• consent: where we ask for it, such as for optional marketing. You may withdraw consent at any time without affecting processing that took place before you withdrew it.

Right to object: where we rely on legitimate interests, you may object to our processing at any time on grounds relating to your particular situation, and we will stop unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need the information to establish, exercise or defend legal claims.

6. Consent (Canada)

In Canada, we collect, use and disclose personal information with your knowledge and consent, except where the law permits or requires otherwise. By placing an order, you consent to our using the information described in section 3.1 for the purposes in section 4, including sharing it with the service providers in section 7 to fulfil your order. You may withdraw consent, subject to legal and contractual restrictions and reasonable notice, by contacting us. If you do, we may be unable to complete an order.

7. Who we share personal information with

We share personal information only as needed for the purposes in section 4, and only with:

• Etsy, which operates the marketplace, processes payments and delivers digital downloads;
• print-on-demand production partners, currently Printify and, for some products, Printful, and the print facilities they use, which receive your name, shipping address, order details and any personalisation needed to make and ship your item. Orders reach these partners through their own official Etsy integrations;
• shipping carriers and postal services, which receive the information needed to deliver your order;
• design and AI image services (currently Canva, Higgsfield and Recraft), which receive only design instructions and artwork and no customer personal information (see section 4.1);
• providers of software and technology services that help us run our business, such as email, website hosting and secure data storage, which process information on our behalf;
• professional advisers, such as accountants and lawyers, where needed; and
• government authorities, courts or others, where required by law or to protect our rights, our customers, or the public.

Our service providers may use personal information only to provide services to us, and they are bound by contracts or terms that require them to protect it.

If the business, or part of it, is sold or transferred, personal information may be transferred to the new owner, who may use it only for the purposes for which it was collected. We or the new owner will notify you of the transfer where the law requires it.

8. International transfers

We are based in Canada, but the platforms and service providers we use operate in other countries, so your personal information may be collected, stored or processed outside your province or country, where it may be accessible to courts, law enforcement and national security authorities under local law.

The countries outside Canada where this may occur are: the United States, where Etsy, Pinterest, Amazon and our technology providers process data; and the countries where our production partners make and ship orders. For Printful these are currently the United States, the United Kingdom, Mexico, Latvia, Spain, Japan, Brazil and Australia. For Printify they are the countries of the print providers we select for each product, which we list here as we select them.

Where UK or EEA law requires it, we rely on appropriate safeguards for these transfers, such as the transfer mechanisms our service providers put in place. For written information about our policies for service providers outside Canada, for details or a copy of the safeguards we rely on, or for any question about international transfers, contact Roman Cintula at info@quillmoss.ca.

9. How long we keep personal information

• Order and transaction records: for as long as required for tax and accounting purposes. In Canada this is generally six years from the end of the last tax year to which the records relate.
• Messages and correspondence: for up to two years after our last contact with you, unless needed longer to resolve a dispute or meet a legal requirement.
• Personalisation text and files you provide: until your order is delivered and any return or replacement period has ended, then deleted from our own files and tools, unless needed for a dispute.
• Data received through platform APIs: no longer than reasonably necessary to provide the service it was obtained for, and in line with each platform's API terms (see section 11).
• If you have made an access request, we keep the relevant information for as long as needed for you to use any remedies available to you.

When we no longer need personal information, we delete it or make it anonymous. Copies may remain in Etsy's order records and in our production partners' systems under their own policies, and order details may form part of the tax records described above.

10. How we protect personal information

We use safeguards appropriate to the sensitivity of the information, including: storing access credentials for our accounts and APIs using encryption and restricting access to them; using multi-factor authentication on our business accounts where available; limiting access to personal information to our owner and to service providers who need it; and keeping our software up to date. No method of transmission or storage is completely secure, but we work to protect your information and will notify you and the relevant authorities of a breach where the law requires it.

11. Our internal tool and platform API data

Quillmoss Studio Manager is a private tool used only by our owner to manage our own Etsy shop, Pinterest account and print-on-demand products. In using data from platform APIs, we follow these commitments:

• Authorised access only: the tool connects only to our own accounts, using the authorisation methods the platforms provide. It never asks for, collects or stores anyone's username and password.
• Pinterest: the tool creates Pins of our own products on our own boards, each approved individually by our owner, and reads analytics about our own account. We do not access other Pinterest users' Pins or boards. We do not store information obtained through the Pinterest API, except campaign analytics information about our own account as Pinterest permits; we retrieve other information from the API each time we need it. We do not sell or share Pinterest API data with third parties, and we do not use Pinterest materials to train AI or machine learning models.
• Etsy: we use Etsy API data only to provide the services of our own shop, request no more data than we need, do not keep it longer than reasonably necessary, keep shop and listing information current, and do not transfer it to third parties or use it for machine learning or AI training. If Etsy member data in our care is ever compromised, we will notify Etsy at dpo@etsy.com within 24 hours of discovery, and notify affected people and regulators as the law requires.
• Printify and Printful: we send them only the product information needed to create and update our products. Orders reach them through their own official Etsy integrations.
• Security: API credentials are kept private, stored using encryption, and never shared.

The term "Etsy" is a trademark of Etsy, Inc. This application uses the Etsy API but is not endorsed or certified by Etsy, Inc.

12. Your rights and choices

Depending on where you live, you may have the right to:

• ask whether we hold personal information about you and request access to it;
• ask us to correct information that is inaccurate or incomplete;
• withdraw your consent, as described in section 6;
• ask us to delete your information, or to restrict or object to certain processing (UK and EEA);
• receive a copy of information you provided in a portable format (UK and EEA); and
• complain to a privacy regulator.

We will also consider deletion requests from anyone, wherever they live, subject to our legal record-keeping obligations.

To make a request, email info@quillmoss.ca. We may need to verify your identity before responding. We will respond within 30 days, or within any shorter period required by the law that applies to you, and will tell you if we need more time, and why, where the law allows an extension. We do not charge a fee for reasonable requests. If we cannot fulfil a request, for example because the law requires us to keep certain records, we will explain why.

For information held by Etsy, Amazon or Pinterest, you may also need to contact those platforms directly.

13. Complaints and regulators

Please contact us first at info@quillmoss.ca so we can try to resolve your concern. You also have the right to complain to a regulator, including:

• the Office of the Information and Privacy Commissioner of Alberta;
• the Office of the Privacy Commissioner of Canada;
• the UK Information Commissioner's Office, if you are in the United Kingdom; or
• your local data protection authority, if you are in the European Economic Area.

14. Children

Some of our products, such as colouring and story books, are made for children, but they are bought by adults. Our shop, website and accounts are intended for adults and are not directed at children. We do not knowingly collect personal information from children under 13, or under the age of digital consent where you live. If you believe a child has given us personal information, contact us and we will delete it from our own files and tools. If a parent includes a child's name in a personalisation request, we use it only to make that order and delete it as described in section 9.

15. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page with a new effective date. If we make significant changes to how we use personal information, we will take reasonable steps to let you know before the change takes effect, and will ask for your consent where the law requires it.

16. Contact us

Quillmoss Studio (Roman Cintula, sole proprietor), Calgary, Alberta, Canada. Email: info@quillmoss.ca