# Privacy Policy > **Draft for counsel review — not yet in force.** This document may change > before it takes effect. Dated 17 October 2026 · Version 2026-10-17 Ochre Editions is a service operated by Valor Security. **Valor Security is the data controller** for the personal information described here. The registered company is {{VALOR_REGISTERED_NAME}}, {{VALOR_REGISTERED_ADDRESS}}. You can reach us about privacy at {{PRIVACY_EMAIL}}. This policy explains what we collect, why, who we share it with, how long we keep it, and what you can do about it. ## In short - You can browse and download works with no account and no email. - We collect what we need to run your account, make and ship your prints, keep the service secure, and meet tax law. - Every request to the site is logged for security. The "Security logging" section below explains exactly what. - We don't sell your personal information, and we don't use it for advertising. ## What we collect **When you browse or download.** The request details in our security logs (below). We count downloads per work; beyond the access log, we don't record who downloaded what. **Your account.** - Email address, and a password if you set one. Passwords are stored only as a one-way hash. - Passkeys (we hold only the public key), two-factor settings and recovery codes, stored so we can check them. - If you sign in with Google or GitHub, the email address and basic profile those services share with us. - Your active sessions and the devices they're on. - The version of our Terms you accepted, and when. - Saved shipping addresses (up to 10), and a record of each change. **Orders.** - Name, email, shipping and billing address, the works and options you chose, and what you paid. - For gifts: the recipient's name and address and your gift message. - Order status, shipping and tracking details, returns and refunds. - Promo codes, store credit and referrals you used or earned. - Limited-edition records: your place in the queue, your hold, and your edition number. **Payments.** Stripe handles your card. We never see or store your full card number. Stripe tells us the card's brand, last four digits, country, the outcome of each payment attempt (including decline codes), and a fingerprint that lets us recognise the same card again without knowing its number. We use the fingerprint to apply the one-per-card limit in drops and to detect card testing. **Uploads.** - Wall photos, your own photos for printing, review photos and return photos. - When you print your own photo, your confirmation that you hold the rights, with the time and the terms version. - We remove all metadata from the copy we keep, including any location data. The file exactly as you sent it is held in a quarantine store for up to 30 days and then deleted. **Reviews.** Your rating, text and photos. Reviews are public; review photos appear after moderation. We store your text exactly as written. **Agents and API keys.** - The agents you authorise: the client's name, the address of its metadata document, its redirect address, the scopes you granted, the spending cap you set, what it has spent, and the orders it placed. - Access tokens and API keys, stored only as hashes, with a visible prefix and when each was last used. - A record of every MCP tool call: which tool, the shape of the request (not its full contents), the result and any cost. **When you contact us.** Your message, your email address, and anything you send with it, including reports made with "Report this work" and order lookups. **Newsletter and reminders.** Your email address and your consent, if you sign up. ## Security logging **What we log on every request:** - your **IP address**; - your **approximate location** (country, region and city), worked out from the IP address; - your **network**, as its autonomous system number (ASN); - your **user agent** (the browser or software you use, as it describes itself); - your connection's **TLS fingerprint** (JA3 and JA4), which describes how your software sets up a secure connection; - **request details**: the time, address requested, method, response status, sizes, timing and referring page. Query values that carry secrets (tokens, codes, keys, signatures, passwords, emails and session ids) are removed before logging; - **agent signatures**: whether the request carried a Web Bot Auth signature, whether it verified, and who signed it, plus any agent named in the user agent; - which account, agent or API key made the request, if any. **Security events.** We also record events such as **sign-in attempts, including the email or username typed** (even if it doesn't match an account), whether each attempt succeeded, lockouts, two-factor failures, password resets, address and email changes, agent consents and token issues, rate-limit hits, rejected uploads, failed and disputed payments, promo codes that don't work, and text that matches known attack patterns. **What we never log:** passwords, card numbers, two-factor secrets, session tokens or OAuth tokens. **Where it comes from.** Requests pass through our load balancer and through security tooling we operate at the network edge, which examines the same request details to detect attacks. The load balancer keeps its own request log for 90 days. **Why:** to keep the service and your account secure, to prevent fraud and abuse (card testing, account takeover, promo-code guessing, scalping), and to study automated traffic, including AI agents, so we can protect the service. We don't use these logs for advertising and we don't sell them. **How long:** 90 days, then deleted. The most recent 30 days are kept readily searchable; older entries sit in storage until they age out. ## How long we keep information | Information | Kept | | --------------------------------- | ------------------------------------------------------------------------------------------- | | Access logs | 90 days; the last 30 days readily searchable | | Load balancer request logs | 90 days | | Security and audit events | 90 days | | Uploaded files as originally sent | 30 days, in quarantine | | Orders, payments and tax records | 7 years; when you delete your account, personal fields are removed as far as tax law allows | | Your account and its content | Until you delete it; then removed within 30 days, except the records above | Deleted information can remain in encrypted database backups until those backups roll over. Security logs are not edited on request; they are deleted on the schedule above. ## Who we share it with We share personal information only as needed to run the service: - **Stripe** processes payments, calculates sales tax (Stripe Tax) and screens for fraud. Stripe also uses some payment data under its own privacy policy. - **Prodigi**, our print partner, receives the recipient's name and shipping address, the order's contents, and the print file, so it can make and ship your print. - **Carriers** receive what they need to deliver and track your parcel. - **Google Cloud** hosts the site, the database, file storage and logs, in the United States. - **{{EMAIL_PROVIDER}}** sends our emails: sign-in links, verifications, receipts, order updates and, if you asked for them, newsletters and drop reminders. - **Google and GitHub**, only if you choose to sign in with them. - **Pwned Passwords.** When you set a password, we send the first five characters of a hash of it to check it against known breaches. The password itself never leaves us. - **Agents you authorise** receive the information their scopes allow. Their own privacy policies govern what they do with it. We may also disclose information when the law requires it, to protect people or the service from harm or fraud, or to a successor if the service is transferred, under this policy. ## Why we use it, and our legal bases | Purpose | Legal basis | | ------------------------------------------------------------------------ | ----------------------------------------- | | Running your account and your orders, prints, returns and drops | Performing our contract with you | | Security logging, fraud and abuse prevention, studying automated traffic | Our legitimate interest in a safe service | | Keeping order, payment and tax records | Legal obligation | | Newsletter and drop reminders | Your consent, which you can withdraw | | Answering your messages and reports | Our legitimate interest, or our contract | ## Your rights and choices - **Access and export.** Download your data as a JSON file from your account page. - **Deletion.** Delete your account from your account page. We remove it within 30 days, except the records the retention table says we keep. - **Correction.** Change your details in your account settings, or ask us. - **Unsubscribe** from newsletters and reminders with the link in any of them. - **Revoke an agent** from your account page at any time. - If you checked out as a guest, write to {{PRIVACY_EMAIL}} from the email on your order. Depending on where you live, you may have further rights, such as the right to know, delete or correct information, to object to or restrict some uses, and not to be treated differently for exercising them. California and several other US states give residents such rights, and so do the laws of the EU and UK. We honour these requests whatever state you live in. You can use an authorised agent, and we will verify your identity before acting. If we decline a request, you can appeal by replying to our answer. If you are in the EU or UK, you can also complain to your data protection authority. We do not sell personal information or share it for cross-context behavioural advertising, so there is nothing to opt out of. We treat a Global Privacy Control signal as a request not to sell or share. ## Cookies We use essential cookies only. See the [Cookie Policy](/legal/cookies). ## Children You must be 13 or older to create an account, and purchases are for adults or with a parent's permission. We don't knowingly collect personal information from children under 13. If we learn that we have, we delete it. A parent who thinks their child has given us information can write to {{PRIVACY_EMAIL}}. ## International transfers We store and process information in the United States. If you use the site from elsewhere, for example to download works, your information is transferred to the United States, where the law may protect it differently. Where the law requires it, we use appropriate safeguards for these transfers. ## How we protect it Encryption in transit, hashed passwords and tokens, two-factor sign-in, access limited to the people who need it, and the security logging described above. No system is perfectly secure; if a breach affects you, we will tell you as the law requires. ## Changes We will post any update here with a new date and version, and tell you by email or on the site before a material change takes effect. ## Contact - Privacy questions and requests: {{PRIVACY_EMAIL}} - Post: {{VALOR_REGISTERED_NAME}}, operating Ochre Editions, {{VALOR_REGISTERED_ADDRESS}}