Privacy notice
Updated October 30, 2026
Who handles your information
Tiny Paw Studio operates from China and uses information to provide this store and fulfil orders. Contact hello@tinypawstudio.com with privacy questions or requests.
Information used for orders
When paying by card, you provide your order email and, for physical items, your delivery address to this website. Billing address and card details are submitted to PayPal through its payment fields. PayPal provides payment status, transaction identifiers and order information, which can include your name, email and delivery address. Our server stores order details and payment records. If you contact us, we receive the information you send, including pet photos and custom-order instructions. Please send only information needed for your order.
How it is used
We use this information to take and verify payment, make and deliver your item, provide support, handle returns or disputes, prevent fraud and meet applicable record-keeping obligations. Order and customer information may be processed in China.
Service providers
Render hosts this website and its order database. PayPal processes payments and applies its own privacy notice; card entry is handled by PayPal, and this website does not collect full card numbers or security codes. Delivery information is shared as needed with shipping providers. If you use WhatsApp or TikTok, their services process information under their own policies.
Browser storage and technical data
The checkout uses session storage in your browser to recover an order and check payment status. Hosting and payment services may process technical data such as IP addresses, device information and service logs to operate and protect their services.
Customer accounts and order notifications
If you create an account, we store your email address, a salted password hash, verification and reset token hashes, sessions, linked order references, and notification read status. An essential HttpOnly cookie keeps you signed in. Guest orders are linked only after verification of the order email. We use Resend to send verification, password reset, order connection and shipping update emails. Resend receives the destination email address and message contents, which may include an order reference, shipment details or a one-time account link. These are service emails, not marketing subscriptions. Account and notification records are retained as needed to provide these functions and respond to support requests.
Guest order access
Guest buyers can request a one-time email link for an eligible order using its reference and order email. We store hashed access tokens, one-hour sessions, request limits and delivery records. An essential HttpOnly cookie grants access only to the verified order and its reference photos. We use Resend for guest payment instructions, verification links and shipping updates. Short-lived verification message contents are kept privately while delivery is pending and cleared when accepted or expired. These messages do not subscribe you to marketing. Linking the order to an account ends guest access.
Reference photos
Reference photos and messages sent to us are used to discuss and fulfil your custom order. Website uploads are linked to your order and stored privately in the order database hosted by Render, including its backups. Access requires the owning customer account, an order-email verification link for guest purchases, or an authenticated store administrator. A necessary HttpOnly cookie provides guest photo access for one hour. Resend sends the private access link to the order email; uploaded image files are not attached to that email. We keep high-quality JPG copies up to 6000 pixels on the longest side, remove embedded metadata such as location, and record upload/removal times. Keep your original files. You can remove uploaded photos before preparation starts; afterward, contact us for changes or deletion requests. Backups may retain previous copies until replaced under our backup process. Using your submitted photos in public marketing requires separate permission.
Retention and requests
Order, payment and support records are kept as needed for fulfilment, customer support, disputes and applicable legal obligations. Email hello@tinypawstudio.com to request access, correction or deletion of information you provided. Some records may need to be retained to meet those obligations. Do not send card numbers or passwords by email.
Updates
This notice was updated on October 30, 2026. Changes will be published on this page. See our order terms for delivery and returns.
Store analytics
Our own analytics automatically records page and product views, selected editions, coarse device categories, approved campaign codes and broad visit sources. When you visit our public pages, we briefly use the connection IP address in memory to estimate country, region and city using a local database. Only the region result is stored in analytics; the IP address is not saved or sent to a geolocation service. Location is approximate and may reflect a VPN or mobile network. IP Geolocation by DB-IP. A random browser identifier lasts up to 30 days. No approval prompt is shown. We keep analysis records for up to 90 days on our private Render storage. We do not collect input values, full URLs, account details, photos or card data for analytics. Server-confirmed order summaries help us understand purchase steps; they are not based on payment-button clicks. Browser identifiers can link visits and are not fully anonymous. Browser restrictions, unavailable storage or failed requests may prevent visits from being recorded. Clearing browser storage removes the identifier on that browser; a subsequent visit may create a new identifier. Previously collected records expire under the retention period. Analytics backups, if made, must also expire within that period. We do not use session recordings or cross-device tracking. Hosting and payment providers retain their own operational logs as described above.