Privacy Policy

1. Introduction and Data Controller

Belula LLC (operating as “Belula Art,” “we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, transfer, and safeguard your personal information when you visit our website belula.artand use our platform (the “Platform”), create custom artwork, purchase art prints, or otherwise interact with us.

For the purposes of the General Data Protection Regulation (GDPR), the UK GDPR, and applicable United States privacy statutes, Belula LLC, located in California, USA, is the data controller responsible for your personal information.

Please read this Privacy Policy carefully. By accessing or using our Platform, you acknowledge that you have read and understood this policy. If you have any questions, you can reach us anytime at support@belula.art.

2. Information We Collect

2.1 Information You Provide to Us

We collect information that you directly provide when using our services:

• Account Information: Name, email address, profile picture (if provided), and authentication-provider identifiers when you register or sign in using Google, Apple, Facebook, or email sign-in links.
• Order and Billing Details: Full name, shipping address, billing address, phone number, and order history. Payment card details are tokenized and processed securely through our payment provider (Stripe); we never store your full payment card number on our servers.
• Artwork and Creative Inputs: Images, reference photos, prompt text, style preferences, customizations, and configurations you submit to create custom watercolor or digital artwork.
• Customer Support and Communications: Feedback, inquiries, support messages, email correspondence, and survey responses you send to us.
• Preferences: Marketing email subscriptions, newsletter preferences, and notification settings.

2.2 Information Collected Automatically

When you browse or interact with our Platform, we automatically collect certain technical and usage information, including:

• Device and Connection Data: Device model, operating system version, browser type and version, language preferences, IP address, and unique device or session identifiers.
• Usage and Interaction Data: Pages viewed, referring/exit pages, search queries, artwork customizer interactions, cart additions, timestamps, clickstream data, and navigation flows.
• Approximate Geolocation: Non-precise location inferred from your IP address, utilized for regional currency display, estimated shipping calculations, and applicable sales tax computation.
• Cookies and Pixel Tags: Identifiers placed on your device to remember user sessions, shopping cart contents, site preferences, and analytics/advertising measurement (see Section 6 for details).

2.3 Information from Third Parties

We may receive information about you from trusted third-party services:

• Federated Authentication Providers (Google, Apple, Meta): When you choose to authenticate using third-party single sign-on, we receive profile identifiers and your email address (including Apple Private Relay addresses if selected).
• Payment Processors (Stripe): Transaction status, billing zip codes, fraud risk signals, and payment receipts.
• Logistics and Fulfillment Partners: Tracking numbers, shipment status, and delivery confirmations.

2.4 Statutory Categories of Personal Information (US Privacy Laws)

Under California (CCPA/CPRA) and other US state privacy laws, we have collected the following categories of personal information in the preceding 12 months:

• Identifiers: Name, alias, email address, shipping address, IP address, unique personal identifiers, and account credentials.
• Customer Records (Cal. Civ. Code § 1798.80(e)): Name, address, phone number, and tokenized payment info.
• Commercial Information: Artwork products viewed, cart activity, purchase history, and custom artwork generation configurations.
• Internet or Network Activity: Browsing history, search queries, page interactions, and device telemetry.
• Geolocation Data: Approximate geographic location derived from IP address.
• Visual Information: Photographs and reference artwork uploaded for custom rendering.

We do not collect or process sensitive personal information for the purpose of inferring characteristics about consumers.

3. How We Use Your Information and Legal Bases for Processing

Under the GDPR, UK GDPR, and international data protection laws, we must establish a valid lawful basis for each purpose for which we process personal data. We process your information under the following legal bases:

4. Artificial Intelligence (AI) and Image Processing

Belula Art utilizes generative artificial intelligence technologies (including the Google Gemini API) to create customized watercolor representations and artwork based on user-supplied reference images and prompts:

• Purpose Limitation: Uploaded images and artistic prompt inputs are transmitted to secure AI model endpoints solely to process, transform, and generate your requested artwork previews and print files.
• No Foundation Model Training: Your uploaded personal images and private prompts are not used to train or refine public or third-party artificial intelligence foundation models.
• Automated Decision-Making: Our AI features are used exclusively as creative design and rendering tools. We do not engage in automated decision-making or profiling that produces legal or similarly significant effects concerning users (GDPR Article 22).

5. How We Share and Disclose Your Information

We do not sell your personal information for monetary consideration. We share information only with authorized service providers (data processors) subject to strict contractual confidentiality and data protection obligations:

• Payment Processing: Stripe processes credit/debit card transactions, handles fraud detection, and securely maintains payment tokenization.
• Cloud Infrastructure & Databases: Google Cloud Platform & Firebase provide secure cloud storage, serverless hosting, encrypted databases, and authentication services.
• AI Services: Google Cloud (Gemini API) processes image and prompt data to generate custom artwork assets.
• Order Fulfillment & Shipping: Printing partners and carriers (such as USPS, UPS, FedEx, or regional postal carriers) receive recipient names, shipping addresses, and order contents to print and deliver physical goods.
• Analytics & Measurement: Google Analytics (GA4) and Pinterest Tag assist us in understanding traffic volume, user navigation, and commerce campaign performance.
• Authentication Services: Google, Apple, and Meta provide identity verification when you choose single sign-on options.

Legal Requirements and Protection: We may disclose personal data if required by law, subpoena, warrant, or regulatory proceeding, or if we believe in good faith that disclosure is necessary to investigate fraud, enforce our Terms of Service, or protect the safety and property of our users, the public, or Belula Art.

Business Transfers: In the event of a merger, acquisition, corporate restructuring, or sale of company assets, customer personal data may be transferred as an acquired business asset. Any successor entity will remain bound by the terms of this Privacy Policy.

6. Cookies, Tracking Technologies, and Opt-Out Signals

We and our service providers use cookies, web beacons, local storage, and similar technologies to ensure site functionality and measure performance.

• Strictly Necessary Cookies: Essential for browsing, secure customer authentication, session management, and shopping cart persistence.
• Functional Cookies: Maintain your site preferences, regional settings, and theme choices.
• Analytics and Advertising Technologies: Help us measure storefront interaction and evaluate advertising campaigns across platforms like Google and Pinterest.

Do Not Track (DNT) and Global Privacy Control (GPC):California and other state laws require disclosure of how we respond to automated browser signals. We recognize and respect browser-based opt-out preference signals such as the Global Privacy Control (GPC) where applicable by law. If our systems detect a recognized GPC signal from your browser, we will treat that signal as a valid request to opt out of the “sharing” of personal data for cross-context behavioral advertising for that specific browser.

You can also configure your browser to block or delete cookies. Note that disabling essential cookies may prevent you from logging in, maintaining an active cart, or placing an order.

7. International Data Transfers

Belula LLC is headquartered in the United States, and our primary servers, databases, and core service providers operate within the United States. If you access our Platform from the European Economic Area (EEA), the United Kingdom, Switzerland, or other regions with laws governing data collection and use, your personal data will be transferred to and processed in the United States and other global infrastructure regions.

When we transfer personal data originating from the EEA, the UK, or Switzerland to countries that have not received an adequacy decision from the European Commission, we ensure appropriate safeguards are implemented in compliance with GDPR Chapter V:

• Data Privacy Framework: Relying on the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF where our cloud processors (such as Google and Stripe) maintain active certifications.
• Standard Contractual Clauses (SCCs): Incorporating the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum into our data processing agreements with third-party service providers.
• Technical Safeguards: Utilizing industry-standard TLS encryption in transit and AES-256 encryption at rest across all storage and transport layers.

8. Data Retention

We retain your personal information only for as long as necessary to fulfill the operational, commercial, and legal purposes outlined in this Privacy Policy, unless a longer retention period is mandated by law:

• Order and Financial Records: Retained for a minimum of 7 years to comply with statutory commercial, tax, accounting, audit, and fraud prevention regulations.
• Account Information: Maintained for the active lifespan of your account and deleted or pseudonymized upon a verified account closure or deletion request.
• Uploaded Artwork and Generated Assets: Stored to enable fulfillment, quality verification, reordering, and customer support. Artwork files may be deleted upon request or after fulfilling commercial production requirements.
• Marketing and Newsletter Subscriptions: Retained until you withdraw consent, unsubscribe, or request deletion.
• Server Logs and Security Telemetry: Retained for security analysis, anomaly detection, and fraud prevention for up to 90 days.

9. Your Privacy Rights

9.1 United States Residents (CCPA/CPRA & State Privacy Laws)

If you are a resident of California (under the California Consumer Privacy Act and California Privacy Rights Act), Colorado, Connecticut, Virginia, Utah, Texas, or other states with comprehensive consumer privacy statutes, you have specific rights regarding your personal information:

• Right to Know / Access: Request disclosure of the categories and specific pieces of personal information we have collected, the categories of sources, and the commercial purposes for collection.
• Right to Delete: Request deletion of personal information collected from you, subject to statutory exemptions (such as completing transactions or legal compliance).
• Right to Correct: Request correction of inaccurate personal information maintained in your account.
• Right to Opt-Out of Sale / Sharing: We do not sell your personal data for money. We may share browsing identifiers with advertising partners for targeted or cross-context behavioral advertising. You have the right to opt out of such sharing by updating cookie preferences or broadcasting a recognized GPC signal.
• Right to Non-Discrimination: We will not deny goods, charge differing prices, or provide a differing quality of service if you choose to exercise any of your statutory privacy rights.
• Right to Appeal: If we decline to take action on your consumer request, you have the right to appeal our decision. You may submit an appeal by emailing support@belula.art with the subject line “Privacy Request Appeal.”

9.2 European Economic Area (EEA) and UK Residents (GDPR & UK GDPR)

If you are located in the European Union, the EEA, or the United Kingdom, you are entitled to the following statutory rights under the GDPR and UK GDPR:

• Right of Access (Art. 15): Obtain confirmation as to whether your personal data is being processed and receive a copy of your personal data.
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete personal data without undue delay.
• Right to Erasure / “Right to be Forgotten” (Art. 17): Request deletion of your personal data where it is no longer necessary for the purposes collected or when you withdraw consent.
• Right to Restriction of Processing (Art. 18): Request that we temporarily restrict the processing of your data under certain circumstances (e.g., while verifying accuracy).
• Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, and machine-readable format or have it transmitted directly to another controller.
• Right to Object (Art. 21): Object at any time to processing based on legitimate interests (Art. 6(1)(f)). You have an absolute, unconditional right to object to processing for direct marketing purposes.
• Right to Withdraw Consent (Art. 7(3)): Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Right to Lodge a Complaint (Art. 77): You have the right to file a complaint with a competent Data Protection Supervisory Authority in your EU/EEA member state or the Information Commissioner’s Office (ICO) in the UK if you believe our data processing violates applicable law.

10. Children’s Privacy

Our Platform is intended for a general audience and is not directed to children. We do not knowingly solicit or collect personal information from individuals under the age of 13 (or under 16 in certain European jurisdictions without parental authorization).

If you are a parent or legal guardian and discover that your child has submitted personal data to us without your consent, please notify us immediately at support@belula.art. If we learn that we have collected personal data from a child without verified parental consent, we will promptly delete that information from our active databases.

11. Data Security

We maintain appropriate organizational, technical, and administrative measures designed to protect your personal information against unauthorized access, accidental loss, disclosure, or destruction. Key safeguards include:

• End-to-end TLS/HTTPS encryption for all data transmitted across the web.
• Encrypted storage at rest for cloud databases and customer artwork assets.
• Tokenized, PCI-DSS Level 1 compliant payment processing handled directly through Stripe.
• Strict least-privilege administrative access controls and multi-factor authentication.

While we continuously implement robust security practices, no electronic transmission over the internet or cloud storage infrastructure can be guaranteed to be 100% secure. You are encouraged to maintain unique passwords and safeguard your account credentials.

12. Changes to This Privacy Policy

We may revise this Privacy Policy periodically to reflect updates to our operational practices, new features, or changing legal and regulatory standards. Any modifications will be posted to this page with an updated “Last Updated” date at the top.

If we make material changes that significantly affect how we collect or process personal data, we will provide prominent notice on our website or notify registered account holders directly via email prior to the changes taking effect.

13. Contact Us

If you have questions, inquiries, or feedback regarding this Privacy Policy, or if you wish to exercise any of your statutory privacy rights, please contact our data protection team: