Privacy policy

Last updated 21 June 2026. This policy explains how Wandarbear ("we") handles personal data for themysteryshirt.com. It covers the EU/UK (GDPR), the United States (CCPA and other state laws), and Canada (PIPEDA). The data controller is Wandarbear, 3604 BD Maarssen (Utrecht), The Netherlands.

What we collect

Your order: the prompt you type, size, colour, and currency.
Contact & delivery: email and shipping address.
Payment: handled by Stripe — we never see or store your full card details.
Technical: approximate country (from your IP) to show the right currency and tax, and basic security/anti-abuse logs.

How we use it, and our legal basis (GDPR)

To create and deliver your order — performance of our contract with you.
To screen prompts for safety and prevent abuse — our legitimate interest and legal compliance.
To calculate and remit tax, and to keep records — legal obligation.
To send transactional emails (confirmation, refunds) — performance of contract.

We do not use your data for advertising and we do not sell personal data.

Your prompt and the generated image

The text you type is sent to our AI provider (OpenAI) to moderate it and to generate your design. The generated print file is stored privately and is used only to fulfil your order. No human at themysteryshirt.com previews the printed design.

Where your data is stored

Order data and print files are stored in the EU (Stockholm, Sweden — eu-north-1). Some of our processors are based in or transfer data to the United States; those transfers rely on Standard Contractual Clauses and the processors' data processing agreements.

Who we share it with (sub-processors)

Stripe — Payment processing (EU/US (SCCs/DPA)).
OpenAI — AI image generation + prompt moderation (US (SCCs/DPA)).
Printful — Printing & fulfilment (EU/US (SCCs/DPA)).
Supabase — Database & file storage (EU region) (EU).
Resend — Transactional email (US (SCCs/DPA)).
Vercel — Website hosting (global edge) (US/global (SCCs/DPA)).

How long we keep it

We keep order records for as long as needed to fulfil the order and to meet tax and accounting obligations (typically up to 7 years), then delete or anonymise them. Print files are retained only as long as needed for fulfilment and support.

Your rights — EU/UK (GDPR)

You may request access, correction, deletion, restriction, portability, or object to processing, and you may complain to your local data protection authority. Contact privacy@themysteryshirt.com.

Your rights — United States (CCPA & state laws)

You may request to know, access, or delete the personal information we hold, and to correct it. We do not sell or share your personal information for cross-context behavioural advertising. We will not discriminate against you for exercising these rights. Contact privacy@themysteryshirt.com.

Do Not Sell or Share My Personal Information

We do not sell your personal information, and we do not share it for cross-context behavioural advertising — for any consumer, in any US state, including California (CCPA/CPRA), and we have not done so in the preceding 12 months. Because we never sell or share, there is nothing to opt out of; you do not need to take any action. If you would still like written confirmation, email privacy@themysteryshirt.com with the subject "Do Not Sell or Share" and we will confirm.

Your rights — Canada (PIPEDA)

You may access and correct your personal information and withdraw consent (subject to legal/contractual limits). You may complain to the Office of the Privacy Commissioner of Canada. Contact privacy@themysteryshirt.com.

Cookies

We use only strictly-necessary cookies needed to run checkout and keep the site secure. We do not use advertising or third-party tracking cookies, so no cookie consent is legally required; a notice banner explains this on your first visit. If we ever introduce analytics or other non-essential cookies, we will request your consent first and will not set them unless you accept.

Contact

Privacy questions: privacy@themysteryshirt.com.