Skip to content

Privacy Policy

What MRSM collects, why, who processes it, how long it is kept, and how to delete it.

Last updated

This policy describes how MRSM, trading as MRSM, handles personal data across the MRSM website and mobile apps.

It describes what the software actually does. Where a section says data is deleted, it is deleted; where it says data is kept, the reason it is kept is given.

What we collect

We collect only what a given feature needs to work.

  • Account: your email address, your name, and your password (stored only as a hash we cannot reverse). If you sign in with Google or Apple, we receive your email address and name from them instead — never your password.
  • Orders: your delivery address, phone number, the items you ordered, and the design you arranged on each product.
  • Payments: card payments are processed by Stripe. Card numbers never reach our servers and we never store them. For cash on delivery we store no payment instrument at all.
  • Uploads: images you upload — artwork you publish, a photo you send for a portrait commission, or a personal design you place on a product.
  • Creator profile: if you sell on MRSM, your public handle, display name, biography, avatar and the work you publish.
  • Notifications: if you enable push notifications, a device token. If you order with cash on delivery, your phone number is used to send a WhatsApp confirmation.
  • Technical: your language and currency preference, and standard server logs including IP address, kept for security and abuse investigation.

Why we collect it

  • To create and secure your account, and to sign you in.
  • To produce, deliver and support your orders — including sending them to our production team, who see the design and the delivery address.
  • To pay artists for work sold through the marketplace.
  • To detect fraud and abuse, and to investigate security incidents.
  • To meet accounting and tax obligations, which require transaction records to be retained.

Who processes it

We use a small number of service providers. Each receives only what its function requires, and none of them are permitted to use your data for their own purposes.

  • Supabase — database, file storage and authentication. Hosted in the EU (eu-west-1).
  • Vercel — application hosting and content delivery.
  • Stripe — card payment processing.
  • Meta Platforms (WhatsApp Business) — order confirmation messages, where you have chosen cash on delivery.
  • Resend — transactional email such as verification and password-reset codes.

What we never do

  • We do not sell your personal data.
  • We do not share it for third-party advertising.
  • We do not use your uploaded images to train machine-learning models.
  • We do not send marketing email to an address you have not opted in with.

How long we keep it

  • Account data: until you delete your account.
  • Order records: retained after account deletion, with your name, phone number and street address removed. The order, its items and its totals remain, because tax law requires transaction records to be kept and because cash-on-delivery balances are collected against them.
  • Notifications: 90 days, or 365 days for security notifications.
  • One-time codes: 10 minutes.
  • Server logs: retained for a limited period for security investigation.

Your rights

You can view and correct your name, email, avatar and addresses at any time from your profile.

You can delete your account from inside the app or website. Deletion is confirmed with a code sent to your email, then completed within 5 working days. It is not subject to approval — see the account deletion page for exactly what is removed and what is kept.

To request a copy of your data, or to ask a question about this policy, write to [privacy@mrsm.online].

Children

MRSM is not directed at children under 13, and we do not knowingly create accounts for them. If you believe a child has an account, contact us and we will remove it.

Changes

If this policy changes in a way that affects how your data is used, we will tell you in the app before the change takes effect. The date at the top of this page always reflects the current version.