Privacy policy
Privacy Policy
Magneto SF — MAGNETOSFCOM LLC. Last updated 26 August 2026.
This policy explains what personal information we collect, why, how long we keep it, and what you can ask us to do with it. Because our product is made from a photograph you send us, section 3 — about your photos — is the part most people will care about.
1. Who is responsible for your data
MAGNETOSFCOM LLC, trading as Magneto SF, 233 E Harris Ave # E6, South San Francisco, CA 94080-6807, United States. hello@magnetosf.com
We are the business deciding how your information is used. If you have a question or a request about your data, that email address is the place to send it.
2. What we collect
You give us:
- your name, email address, shipping address and phone number (if provided)
- the photograph or image you upload for printing
- any text you send us — order notes, emails, complaints
- payment details, which go directly to Shopify Payments and its processors. We see only the last four digits of your card, the card brand, and whether the payment succeeded. We never see or store your full card number or security code.
Collected automatically when you visit:
- IP address, browser and device type, operating system
- pages viewed, what you clicked, how you arrived at the site
- cookies and similar technologies (see section 8)
From others:
- order, fraud-screening and analytics information from Shopify
- delivery status from our shipping carriers
3. Your uploaded photographs — how we treat them
This deserves its own section, because a photograph is not like an email address. It may show your face, your family, your children, your home. We treat uploaded images as sensitive personal information and handle them accordingly.
What we use them for. One thing only: printing and delivering your order, and handling any reprint, refund or complaint that follows. Nothing else.
What we will never do without your separate written permission:
- use your photo in our advertising, on our website, or on social media
- sell, rent or license your photo to anyone
- use your photo to train artificial intelligence or machine-learning systems
- publish it anywhere
Uploading a photo to place an order is not permission for any of the above.
Who can see them. Only the people who need to: the person or people producing your magnet, and, where we use an external printing partner, that partner — under contract, for that order only. Our storage is access-controlled and images are transmitted over encrypted connections.
Faces, children and other people in your photos. Many uploads contain images of identifiable people, and many contain children. We do not attempt to identify anyone in your photograph. We do not run facial recognition, biometric matching or face-tagging on uploaded images, and we do not create biometric identifiers or templates from them. We do not sell them and we do not share them for advertising.
Under our Terms of Service, it is your responsibility to have permission from anyone identifiable in the image, and to be the parent or guardian of any child in it. If you upload a photo of someone who has not agreed to it, that is a problem you have created, not us.
How long we keep them:
| Stage | What happens |
|---|---|
| While your order is being made | Image stored and used to print |
| After delivery | Kept for 90 days, so we can reprint if something goes wrong or a dispute arises |
| After 90 days | Deleted from our active systems |
| Backups | Encrypted backups may hold a copy for up to a further 90 days before they are overwritten |
Deleting your photo sooner. Email hello@magnetosf.com with your order number and ask us to delete the image. If your order has shipped we will delete it from active systems within 30 days and confirm to you by email. If your order is still in production, deleting the photo means cancelling the order — we will confirm that with you first and refund you.
Two honest exceptions: we may keep an image longer if we are legally required to, or if it is needed for an active legal claim, chargeback or law-enforcement matter. And where content appears to be child sexual abuse material, we are legally obliged to preserve and report it (see our Terms of Service, section 5).
4. Why we use your information
| What we use it for | Why we're allowed to |
|---|---|
| Making and delivering your order | To perform our contract with you |
| Payment and fraud screening | Contract; our legitimate interest in preventing fraud |
| Customer service and complaints | Contract; legitimate interest |
| Order confirmations, shipping notices | Contract |
| Marketing emails | Only if you opt in. Unsubscribe any time |
| Keeping tax and transaction records | Legal obligation |
| Improving the website | Legitimate interest; consent for non-essential cookies |
| Enforcing our terms, defending claims | Legitimate interest; legal obligation |
5. Who we share it with
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. See section 7.
We share only what is necessary with:
- Shopify Inc. — our store platform, and Shopify Payments, our live payment processor
- Card networks and payment processors used by Shopify Payments, including for fraud screening and chargeback handling
- Tax authorities — we are registered with the California Department of Tax and Fee Administration (CDTFA) and report transaction totals as required. We do not send them your photograph.
- Shipping carriers — your name and address, so your parcel arrives
- Printing and fulfilment partners, where used — your image and delivery details, for that order
- Email service providers — for order and, if you opted in, marketing email
- Professional advisers — accountants and lawyers, where needed
- Law enforcement or authorities — where legally required, or to report unlawful content
- A buyer of the business, if we are ever sold, on the same protections as this policy
6. How long we keep everything else
- Order and transaction records: 7 years (tax and accounting)
- Customer service emails: 3 years
- Marketing list: until you unsubscribe, then a suppression record so we don't email you again
- Website analytics: typically 26 months
- Uploaded images: see section 3
7. Your rights if you live in California (CCPA/CPRA)
A note on honesty first. The California Consumer Privacy Act applies to businesses above certain thresholds — broadly, over $25 million in annual revenue, or handling the personal information of 100,000 or more California consumers or households, or making half their revenue from selling personal information. Magneto SF is a new and small business and probably falls below all of these, so the CCPA may not strictly apply to us today. We are setting out these rights anyway, and we will honour them, because they are the right way to treat people's information — and because thresholds change as a business grows.
You may ask us to:
- Know what personal information we hold about you, where it came from, why we have it, and who we've shared it with
- Access a copy of it, in a portable format
- Delete it, including uploaded photographs, subject to the legal-retention exceptions in section 3
- Correct anything inaccurate
- Opt out of sale or sharing — we do not sell or share your data for advertising, so there is nothing to opt out of, but the right stands
- Limit use of sensitive personal information — we already use it only to fulfil your order
We will never discriminate against you for exercising these rights. Same prices, same service.
How to make a request: email hello@magnetosf.com with the subject "Privacy request". Tell us what you want and give us enough detail to find your records — usually your order number and the email address you used. We will verify it's really you (we may ask you to confirm order details) and respond within 45 days, extendable once by a further 45 days if the request is complex, in which case we'll tell you.
Someone acting for you may make a request on your behalf with written authorisation, and we may still contact you to confirm.
Shine the Light (California Civil Code section 1798.83): we do not share your personal information with third parties for their own direct-marketing purposes.
Do Not Track: browsers send DNT signals inconsistently and there is no agreed standard, so we do not respond to them. We do honour Global Privacy Control (GPC) opt-out signals where our platform supports them.
8. Cookies
We use:
- Essential cookies — your cart, checkout, security. The site doesn't work without these.
- Analytics cookies — how many people visit, which pages they read.
- Functional cookies — remembering preferences.
You can block or delete cookies in your browser settings; blocking essential ones will break checkout. Where a cookie banner is shown, your choices there are respected.
9. Security
We use encrypted connections (HTTPS), access controls, and reputable service providers. Payment data goes straight to Shopify's PCI-DSS compliant systems and never touches our own servers.
Honestly: no system is completely secure. We cannot promise a breach will never happen. If one does and it affects your personal information, we will notify you and the relevant authorities as California law requires.
10. Children
Our store is not directed at children and we do not knowingly collect personal information from anyone under 13. If you are under 13, please don't use the site or send us your details.
Note the difference. A photograph of a child, uploaded by their parent or guardian, is fine — that is the point of the product. What is not fine is a child under 13 giving us their own details as a customer. If we learn we have collected a child's personal information directly, we will delete it. If you believe this has happened, email us.
11. Where your data is held
We operate in the United States and ship only within it. Your information is processed in the US. Some of our providers (including Shopify) may process data in other countries under appropriate safeguards.
12. Changes
We may update this policy. The "last updated" date at the top shows the current version. Material changes will be highlighted on the site, and where required we will ask for your consent.
13. Contact us
Questions, requests, or complaints about your privacy:
Email: hello@magnetosf.com (subject: "Privacy request")
Post: MAGNETOSFCOM LLC (trading as Magneto SF), 233 E Harris Ave # E6, South San Francisco, CA 94080-6807, United States
If you are unhappy with our response, you may complain to the California Privacy Protection Agency or the California Attorney General.
This policy is provided for information and is not legal advice.