Your privacy, respected.

1. Who we are

Custom Love Story is operated by Ismail Cetin (sole proprietorship), headquartered in Germany. In this Privacy Policy, "we," "us," or "our" refers to Ismail Cetin trading as Custom Love Story. "You" refers to any person visiting our website or using our services.

We're the data controller for personal information we collect through customlovestory.com and our associated review platform review.customlovestory.com.

2. What we collect

We collect different types of information depending on how you interact with us.

Information you give us directly

• Account & order details: Your name, email address, billing address, shipping address (if ordering a poster), and phone number (optional).
• Photos & story content: The photos you upload and the personal story, names, and memories you share with us to create your film.
• Payment info: Payment card details are collected and processed directly by our payment providers (Shopify Payments, PayPal, Apple Pay, Google Pay). We never see or store your full card numbers.
• Customer support: If you contact us through our contact form or email, we store your message and reply history.
• Email preferences: If you subscribe to our newsletter, we record your subscription status.

Information collected automatically

• Device & browser data: IP address, browser type, operating system, device identifiers.
• Usage data: Pages viewed, time spent on site, referring URL, clicks.
• Delivery-proof events: When you open your film preview, approve your film, or download it, we log a timestamp, your IP address, and your browser identifier (see section 14).
• Cookies & similar technologies: See section 7.

3. How we use your information

We use your personal information for the following purposes:

• To create and deliver your custom film — using your photos, story, and order details.
• To process payments — through our payment partners.
• To communicate with you — order confirmations, preview links, status updates, support replies.
• To send marketing emails — only if you've subscribed (see section 6).
• To improve our services — understanding which features customers use and how to make the experience better.
• To confirm delivery and prevent fraud and abuse — logging when your film is made available, approved, and downloaded (see section 14), detecting unusual activity, and enforcing our Terms of Service.
• To meet legal obligations — tax records, accounting, responding to lawful requests.

4. Who we share your data with

We never sell your personal information. We share data only with trusted service providers who help us operate our business, under strict confidentiality agreements.

Our service providers include:

• Shopify Inc. — hosts our storefront and processes payments.
• Cloudinary — stores and serves your uploaded photos securely.
• Supabase — our database for order and review data.
• Resend — sends transactional emails (order confirmations, preview links).
• Klaviyo — sends marketing emails (only if you're subscribed).
• Microsoft 365 — hosts our business email infrastructure.
• Zendesk — manages customer support tickets.
• OpenAI, ElevenLabs, and similar AI services — assist with story generation and voiceover creation. Content shared with these services is limited to what's needed to produce your film.
• Print-on-demand partners — if you ordered a poster, they receive your shipping address to deliver the product.
• Payment providers — PayPal, Apple Pay, Google Pay, credit card networks.

We may also disclose personal information if required by law, to respond to legal processes, or to protect our rights and the rights of others.

5. Your photos & story

The photos you upload and the story you share are the most personal data we handle. We take this seriously.

How we handle your photos

• Photos are used exclusively to create your film.
• We never share your photos publicly or use them in marketing without your explicit written consent.
• Photos are stored on secure cloud infrastructure (Cloudinary) with access limited to our team.
• You can request deletion of your photos and story content at any time by emailing hello@customlovestory.com.

A note on AI processing

Our production pipeline uses AI services (for image generation, voiceover, and music composition) to help create your film. Only the data required for each step is shared with these services, and we select providers with strong privacy practices.

6. Email marketing

If you subscribe to our newsletter or check the marketing opt-in box during checkout, we may send you emails about new products, promotions, gift ideas, and behind-the-scenes content. These emails are sent through Klaviyo, our email marketing partner.

You can unsubscribe at any time by:

• Clicking the "Unsubscribe" link at the bottom of any marketing email.
• Emailing hello@customlovestory.com with your request.

Transactional emails (order confirmations, preview links, customer support replies) are sent separately through Resend and cannot be unsubscribed from as long as you have an active order — they're required to deliver the service you paid for.

7. Cookies & tracking technologies

We use cookies and similar technologies to make our website work and to understand how it's used. There are three types:

Essential cookies

Required for the website to function — cart contents, secure checkout, session management. These can't be disabled.

Analytics cookies

Help us understand how visitors use the site (Shopify Analytics, Google Analytics). This data is aggregated and anonymized where possible.

Marketing cookies

Used for advertising and retargeting (Meta Pixel, Google Ads). These let us show you relevant content on other sites after visiting ours.

You can manage your cookie preferences through your browser settings or through our cookie banner when you first visit.

8. Your rights

No matter where you live, you have the following rights over your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request that inaccurate data be corrected.
• Deletion: Request that we delete your personal data.
• Portability: Request a copy of your data in a machine-readable format.
• Opt-out: Unsubscribe from marketing emails at any time.
• Objection: Object to certain uses of your data.

To exercise any of these rights, email us at hello@customlovestory.com. We'll respond within 30 days.

9. California residents (CCPA)

If you're a California resident, you have specific rights under the California Consumer Privacy Act (CCPA):

• Right to know — what personal information we collect about you, the sources, the purposes, and who we share it with.
• Right to delete — request deletion of personal information we've collected.
• Right to opt-out — we do not sell personal information, but you can confirm this right.
• Right to non-discrimination — we won't charge you different prices or provide a different level of service for exercising your CCPA rights.

Do Not Sell My Personal Information: Custom Love Story does not sell personal information as defined under the CCPA. If this ever changes, we'll update this policy and provide a clear opt-out mechanism.

To submit a CCPA request, email hello@customlovestory.com with "CCPA Request" in the subject line.

10. EU & UK residents (GDPR)

If you're located in the European Economic Area (EEA), United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) gives you additional rights:

• All rights listed in section 8, plus the right to lodge a complaint with your local data protection authority.
• Right to withdraw consent at any time for processing based on consent.
• Right to restriction of processing in certain circumstances.

Legal basis for processing

We process your personal data on the following legal bases:

• Contract — to fulfill your order and deliver your film.
• Consent — for marketing emails (you can withdraw consent anytime).
• Legitimate interest — to improve our services, confirm delivery of digital products, and prevent unauthorized chargebacks and fraud.
• Legal obligation — to comply with tax, accounting, and other laws.

International transfers

Some of our service providers are based outside the EEA (e.g., in the United States). When we transfer data internationally, we use appropriate safeguards such as Standard Contractual Clauses approved by the European Commission.

11. Children's privacy

Our services are not directed at children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us and we'll delete it promptly.

12. Data security

We take reasonable measures to protect your personal data:

• 256-bit SSL encryption for all data in transit.
• Secure cloud storage with access controls.
• PCI DSS compliant payment processing (handled by Shopify, PayPal, etc.).
• Regular security reviews and updates.
• Limited employee access to personal data (need-to-know basis).

No system is 100% secure. If a breach affects your personal data, we'll notify you as required by applicable law.

13. How long we keep your data

We keep personal data only as long as needed for the purposes described in this policy, or as required by law:

• Order data — retained for 7 years to comply with tax and accounting laws.
• Photos and story content — retained for up to 12 months after your final film delivery, then deleted unless you request earlier deletion.
• Delivery-proof access logs — retained for 18 months, then automatically deleted (see section 14).
• Support tickets — retained for up to 3 years for customer service continuity.
• Marketing subscriptions — retained until you unsubscribe.
• Analytics data — retained for up to 26 months in anonymized form.

14. Delivery confirmation & access logging

Because our films are digital products delivered through a private review link, we keep a record proving when each film was made available, approved, and downloaded. This protects both you and us against fraud and unauthorized chargebacks.

What we log

At three steps — when your preview is opened, when you approve your film, and when you download it — we record a timestamp, the IP address, and the browser identifier (user agent) of the device used.

Why we do this

Our legal basis is our legitimate interest in confirming delivery of the digital product you ordered and in preventing unauthorized chargebacks and fraud (Art. 6(1)(f) GDPR; for California residents, this is a permitted business purpose under the CCPA). We do not use this data for advertising, profiling, or any unrelated purpose.

How long we keep it

These access logs are automatically deleted 18 months after they are created.

15. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The "Last updated" date at the top of this page shows when it was last revised.

For significant changes, we'll notify you by email (if you've given us your address) or with a prominent notice on our website before the changes take effect.

16. Contact us

If you have questions about this Privacy Policy or want to exercise any of your privacy rights, reach out to us:

We aim to respond to all privacy inquiries within 30 days.