Privacy Policy

Last updated [Effective date]

The short version

We collect what it takes to make and ship your poster: your email, your shows, your design choices and where to send it.
Your show details go to AI services that research them and draw your poster. Your name, email and address never do.
We never sell your information, and we don’t run ad trackers.
Email [support email] any time to see, fix or delete your data.

Concert Keepsake Co. (“we”, “us”) is a small business based in [State], USA. This policy explains how we handle personal information when you use our website and the Concert Keepsake Co. service: researching your concert history, designing your poster and printing and shipping it to you.

What we collect

What you give us

Account details. Your email address. If you sign in with Google, we also receive the name, email address and profile picture on your Google account.
Your shows. What you tell us about concerts you’ve been to: artists, venues, cities, dates or rough years, festivals, anything else you remember, and any personal notes you add.
Your poster. The style and headline you choose, the designs we generate for you, and anything you tell us when you flag a problem.
Your order. The name and shipping address for delivery, and the email we send order updates to.
Messages. Anything you send us by email.

What we collect automatically

How the site is used. Pages viewed, steps taken in the design flow, browser and device type, and an approximate location worked out from your IP address. This is recorded under a random identifier kept in a cookie or your browser’s storage.
Security logs. Our host records IP addresses and browser details for each request, to keep the service running and protect it from abuse.

What we get from others

Stripe tells us whether your payment went through and gives us the shipping address and email you entered at checkout, plus a link to your receipt. We never see or store your full card number.
Prodigi tells us when your poster is printed and shipped, with the carrier and tracking number.
Public sources such as setlist archives and news reports tell us about the concerts themselves. We look up shows, not people.

How we use it

To run your account and keep your shows saved while you work on them.
To research your shows, design your poster, print it and deliver it.
To send you emails about your account, your poster and your order.
To send you occasional updates and offers, and a reminder if you leave a poster unfinished. You can unsubscribe from these at any time.
To understand how the site is used and make it better.
To prevent fraud and abuse, keep the service secure, and meet our legal, tax and accounting obligations.

If you’re in the European Economic Area or the UK, our legal bases are: performing our contract with you (making and delivering your poster), our legitimate interests (improving and securing the service, and telling existing customers about similar products), your consent (analytics cookies and marketing where the law requires it, which you can withdraw at any time), and legal obligations (tax and accounting records).

How AI is involved

Your poster is designed with AI. To research a show, we send the details you gave us about it to Google’s Gemini models, which search the web. To draw your poster, we send your confirmed show list and headline to OpenAI’s image models, and we may send the finished image to an OpenAI model to check its lettering. To print it, Replicate enlarges the image. We never send your name, email address or shipping address to these AI services. They process the data under their business API terms. A person checks your poster before it prints, and no decision with legal or similar effects on you is made by automated means alone.

We share personal information only with the service providers that help us run Concert Keepsake Co., and only what each one needs:

Supabase: Hosts our database, sign-in and file storage: your account, shows, posters and orders.
Vercel: Hosts the website and runs it.
Google: Google sign-in, if you use it. Google’s Gemini models, with Google Search, research the details of your shows.
OpenAI: Generates your poster artwork from your show list and headline, and may check its lettering.
Replicate: Enlarges your finished design to print resolution.
Stripe: Takes payment. You enter your card and shipping address on Stripe’s checkout page.
Prodigi: Prints and ships your poster. It receives your name, shipping address and the print file.
Resend: Sends our emails to you.
PostHog: Measures how the site is used, such as which pages are viewed and where people drop out of the design flow.

We may also disclose information if the law requires it, to protect our rights or someone’s safety, or as part of selling or transferring the business, in which case this policy would still apply to it.

We don’t sell your personal information, and we don’t share it for cross-context behavioral advertising. There are no advertising pixels on our site.

Cookies

We use a cookie to keep you signed in, which the site needs in order to work. We also use PostHog analytics, which stores a random identifier in a cookie or your browser’s storage. Where the law requires your consent for analytics, we ask for it first. You can block or delete cookies in your browser settings; the site will still work, but you’ll need to sign in again. Our site does not respond to “Do Not Track” browser signals, because there is no industry standard for them. We don’t track you across other websites either way.

How long we keep it

Your account, shows and poster designs stay while your account is open, so you can come back to them. Ask us to delete your account and we’ll erase them within 30 days.
Full-size print files are deleted 30 days after your poster ships.
Order records (what you bought, what you paid and where it went) are kept for as long as tax and accounting law requires, generally up to seven years.
Deleted data can linger in encrypted backups for a short time before it is overwritten.

Keeping it safe

Everything travels over encrypted connections. Your designs are kept in private storage and only reach you through links that expire. Access to customer data is limited to the people who run the service. No system is perfectly secure, but we’ll tell you promptly if a breach affects your information.

Your choices and rights

Wherever you live, you can ask us to show you the personal information we hold about you, correct it, delete it, or stop sending you marketing emails. Every marketing email has an unsubscribe link, or you can email [support email]. We may need to confirm it’s really you before acting on a request, and we’ll answer within 30 days. We won’t treat you differently for using any of these rights.

US state residents

Depending on your state (including California, Colorado, Connecticut, Virginia and others), you may have the right to know what we collect and how we use it, to get a copy, to correct or delete it, and to opt out of its sale, “sharing” for targeted advertising, or profiling. We don’t sell or share personal information and don’t profile anyone, so there is nothing to opt out of, but you can still use every other right. You can send a request yourself or through an authorized agent, and if we turn a request down you can ask us to reconsider by replying to our answer.

EEA and UK residents

You also have the right to restrict or object to our processing, to receive your data in a portable format, to withdraw consent at any time, and to complain to your local data protection authority.

Where your data is stored

We’re based in the United States and our service providers store and process data in the US and in other countries. When we transfer personal information out of the EEA or the UK, we rely on safeguards the law recognizes, such as the European Commission’s standard contractual clauses or the EU-US Data Privacy Framework.

Children

Concert Keepsake Co. is not meant for children. You must be at least 18 to place an order, and we don’t knowingly collect information from anyone under 13 (or under 16 in the EEA and UK). If you think a child has given us information, tell us and we’ll delete it.

Changes to this policy

If we change this policy we’ll update the date at the top. If the change is significant, we’ll tell you by email or on the site before it takes effect.

Contact us

Questions or requests about your privacy: [support email]. See also our Terms of Service.