Privacy Policy

1. Who is responsible

Eddie Ahmadi is the data controller for personal data processed through eddieahmadi.com and the studio’s apps and services. The studio is based in Jessheim, Norway. Privacy questions and requests can be sent to contact@eddieahmadi.com.

2. What data is processed

The table below reflects what the site and its services actually handle.

Contact emails

Your name, email address, the content of your message and the correspondence that follows when you email the studio.

Admin authentication

The administrator email address, a password hash, login attempt records and a secure HttpOnly session cookie. This data belongs to the site operator and is not collected from visitors.

Cart in the browser

The cart stores variant identifiers and quantities in your browser’s localStorage under eddieahmadi.cart.v1. It is not sent to the server unless a checkout flow is used.

Orders and payments

When checkout is enabled: order records, order lines, totals, payment status, customer name, email address, shipping address for physical orders, and Stripe identifiers such as checkout session and payment references.

Site media

Images uploaded through the private administration area, their metadata and the alt text entered for them. These may incidentally contain personal data.

Server logs

Cloudflare may record IP address, user agent, requested URL, timestamp and security events as part of hosting and protecting the site.

No analytics or advertising products are currently used, and no special category data is intentionally collected.

3. Payments

When checkout is enabled, card entry takes place on Stripe’s hosted payment page. This site does not receive or store card numbers or security codes. Stripe processes payment data as an independent payment provider under its own privacy terms.

The site receives the payment result and the identifiers needed to connect an order to its payment, issue a receipt and grant digital access.

4. Cookies and local storage

• Admin session cookie. Essential for the private administration area. It is HttpOnly, SameSite=Lax, Secure when the site is served over HTTPS, and expires after seven days or on logout.
• Receipt and download capability cookie. When checkout is enabled, a cookie or signed link may be used to keep a receipt or a private download available to the buyer.
• Cart storage. The cart is kept in localStorage, not in a cookie, and remains until you clear your browser storage.

No analytics or advertising cookies are currently set. If that changes, this policy will be updated before those cookies are used.

5. Legal bases

• Contract and pre-contract steps. Handling orders, delivering purchases and answering enquiries about a possible commission or purchase.
• Legal obligation. Keeping accounting and order records where Norwegian law requires it.
• Legitimate interests. Running and securing the site, preventing abuse, maintaining the administration area and responding to correspondence.
• Consent. Where consent is required, it is requested separately and can be withdrawn at any time.

6. How long data is kept

• Contact emails are kept while the correspondence is active and for a reasonable follow-up period, then deleted unless a legal obligation requires otherwise.
• Order and accounting records are kept for five years in line with Norwegian bookkeeping requirements.
• Admin sessions end after seven days or on logout; login attempt records are kept only as long as needed for security.
• Server logs are retained for the period configured by Cloudflare for security and operational purposes.
• Cart data stays in your browser until you clear it. Site media stays until it is removed through the administration area.

7. Sharing and processors

Personal data is not sold. It is shared only where needed to run the service:

• Cloudflare provides hosting, database, object storage and security logging for the site.
• Stripe processes payments when checkout is enabled.
• Third-party sites linked from this site, including app stores, social platforms and Datatilsynet, receive data only if you choose to visit them.
• Data may be disclosed where required by law or to establish, exercise or defend legal claims.

8. International transfers

Cloudflare and Stripe may process data outside the European Economic Area. Where that happens, transfers rely on an appropriate safeguard, such as the European Commission’s standard contractual clauses or another lawful transfer mechanism offered by the provider.

9. Security

The site uses HTTPS, HttpOnly session cookies, access controls and an allowlisted administrator account. Data collection is kept to what the service needs. No system is completely secure, and absolute security cannot be guaranteed.

10. Your rights

Under the GDPR, you have the right to access, rectify, erase, restrict and object to the processing of your personal data, and to receive your data in a portable format. To exercise any of these rights, email contact@eddieahmadi.com.

You also have the right to complain to the Norwegian Data Protection Authority, Datatilsynet (opens in a new tab). Doing so does not affect any other legal remedy you may have.

11. Children

The site is not directed at children and does not knowingly collect personal data from children. If you believe a child has provided personal data, contact the studio so it can be reviewed and removed where appropriate.

12. Changes to this policy

This policy may be updated as the site and the shop change. The date at the top of the page shows the latest revision. Material changes will be reflected in the content of this page.

13. Contact

For any privacy question or request, email contact@eddieahmadi.com. The controller is Eddie Ahmadi, Jessheim, Norway.