Privacy policy
1. Who is responsible
The controller for personal data on this website is Tagus Group LLC, 30 N Gould St, STE R, Sheridan, WY 82801, USA, which runs the store under the brand Togo & Stark. For anything about your data, including exercising your rights, contact João Broeiro Baptista, owner, at support@togoandstark.com. Company details are in our legal notice.
2. In short
We only process personal data where it is needed to run the store, make and deliver your order, or for one of the purposes below, and only on one of the legal bases of the EU General Data Protection Regulation (GDPR): to perform a contract (Art. 6(1)(b)), to meet a legal obligation (Art. 6(1)(c)), for our legitimate interests (Art. 6(1)(f)), or with your consent (Art. 6(1)(a)). We do not sell your personal data.
3. The shop platform and visiting the website
Our store runs on Shopify (Shopify Inc., 151 O’Connor Street, Ground floor, Ottawa, ON K2P 2L8, Canada). Shopify provides the website, runs checkout and processes the data your visit and your order produce on our behalf. Visiting the website involves technically necessary data such as your IP address, date and time, the page visited, and your browser and operating system. The legal basis is our legitimate interest in a secure, working store (Art. 6(1)(f)). Shopify also processes data in Canada, the USA and other countries; Canada has an EU adequacy decision, and other transfers rely on the EU-US Data Privacy Framework or Standard Contractual Clauses. See Shopify’s privacy policy.
4. Your order
When you order, we process your name, delivery and billing address, email address, your phone number if you give one, the products you order with your choices (for example your pet’s name), and payment and order data. The legal basis is the contract (Art. 6(1)(b)); where we keep data because tax and commercial law require it, Art. 6(1)(c). We cannot fulfil your order without this information.
5. Your pet photo
The photo you upload is the one piece of your data we turn into a product, so here is exactly what happens to it.
We use it to create your artwork, show you a proof, and look after your order if something goes wrong. To do that it is processed by the services we use to remove the background (remove.bg, Austria) and to create the artwork (Google Gemini, USA), and by our print partner when your order goes to print. We use it for nothing else. We do not sell your photo and we do not use it to train AI models. The legal basis is the contract (Art. 6(1)(b)).
While we work on your order, your photo and the artwork made from it are stored in our own systems (Supabase database and file storage, USA) at long, randomly generated web addresses. Those addresses are practically impossible to guess and we share them only with you and the services named above, but they are not behind a password. Files you buy as a digital order are kept in private storage, and every download link we issue expires within minutes.
We delete your original photo, and the files made directly from it, 24 months after your order. We keep the finished artwork longer, so you can reorder a piece without sending the photo again.
We like to show finished artwork in our marketing, never your original photo, and never your name or your pet’s name without asking you first. If you would rather we did not, tell us at any time, without giving a reason, and we will remove anything already published. The legal basis is our legitimate interest in showing our work (Art. 6(1)(f)); your objection is enough to stop it.
6. Payment
Payments are processed through Shopify Payments; Shopify passes card details to its payment processor, and we never see them. If you choose PayPal, your payment data goes to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Apple Pay, Google Pay and Shop Pay also apply their own privacy terms. The legal basis is the contract (Art. 6(1)(b)); Shopify and the payment providers also check payments for fraud, based on their and our legitimate interest (Art. 6(1)(f)).
7. Making and delivering your order
So that your product can be made and delivered, we pass your name, delivery address, the products ordered with the artwork, and, where needed for delivery, your email address or phone number to our production partners Gelato (Norway, with printers across Europe) and Printful (USA, with production in the EU). They hand the parcel to a carrier. The legal basis is the contract (Art. 6(1)(b)).
8. Emails about your order
Shopify sends the order confirmation, shipping updates and gift cards for us. We send your proof, the reminders about it, your digital files and confirmations of a withdrawal through the email service Resend (USA). The legal basis is the contract (Art. 6(1)(b)).
9. Customer account
You can create an account to see your orders. We process your email address and order history for it until you ask us to delete the account. The legal basis is the contract (Art. 6(1)(b)).
10. Contacting us
When you email us or use the contact form, we process what you send to answer you. The legal basis is the contract or steps before one (Art. 6(1)(b)), or for general questions our legitimate interest in answering them (Art. 6(1)(f)).
11. Newsletter
If you subscribe to our newsletter, for example for 10% off your first portrait, we use your email address to send you offers and news. Shopify sends it for us. The legal basis is your consent (Art. 6(1)(a)). You can unsubscribe at any time with the link in every email.
12. Reviews
We show customer reviews with Judge.me (Judge.me Ltd, London, United Kingdom). Showing them sends technical data such as your IP address to Judge.me. If you write a review, Judge.me processes your name, email address and review. The legal basis is our legitimate interest in showing other customers’ experiences (Art. 6(1)(f)), or your consent when you submit a review (Art. 6(1)(a)). The United Kingdom has an EU adequacy decision.
13. Cookies and your consent
We use cookies and similar technologies. Those strictly needed, for example for the cart and checkout, we set without consent (§ 25(2) TDDDG and its equivalents, Art. 6(1)(b) and (f)). In the EU and the United Kingdom, we set all others, for statistics and advertising, only if you agree in the cookie banner (Art. 6(1)(a)). You can change or withdraw your consent at any time, with effect for the future, through the “Cookie settings” link at the foot of every page. Elsewhere we show no banner and these tools run; in the United States you can opt out as described in section 18.
14. Statistics and advertising
We use the services below, in the EU and the United Kingdom only with your consent, to understand how the store is used, and to measure our advertising and show it to people likely to be interested. They process usage data such as pages viewed, clicks, items added to the cart and purchases, device and browser data, and your IP address. The legal basis is your consent (Art. 6(1)(a)), which you can withdraw at any time.
- Google Analytics, Google Ads and Google Merchant Center (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): audience measurement, ad measurement and remarketing.
- Meta pixel (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland): measuring and targeting our ads on Facebook and Instagram. We are jointly responsible with Meta for collecting and passing on this data (Art. 26 GDPR); Meta alone is responsible for what happens to it afterwards.
- Pinterest tag (Pinterest Europe Limited, Palmerston House, Fenian Street, Dublin 2, Ireland): measuring our ads on Pinterest.
- Microsoft Clarity (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland): Clarity records how visitors scroll, click and move through our pages and shows us heatmaps and session recordings, so we can improve the store. See the Microsoft Privacy Statement.
- TrackBee (EC Solutions Software B.V., Enschede, Netherlands): passes the measurement events above from our server to Google and Meta, so that measurement does not depend on browser settings.
Google, Meta, Microsoft and Pinterest may transfer data to the USA. They are certified under the EU-US Data Privacy Framework, which has an EU adequacy decision.
15. Transfers outside the EU
We are based in the USA, and some of our service providers process data outside the EU, mainly in the USA and Canada. Where there is no adequacy decision and a provider is not certified under the EU-US Data Privacy Framework, we rely on the European Commission’s Standard Contractual Clauses. You can ask us for a copy.
16. How long we keep data
We keep data only as long as its purpose needs. Order and invoice records are kept as long as tax and commercial law require, usually up to ten years. Your pet photo, the files made from it and your delivery address in our production system are deleted 24 months after your order. Messages to us are deleted once your question is settled and no retention duty applies; a record of a withdrawal is kept for three years. Newsletter addresses are kept until you unsubscribe. Data collected with your consent is deleted when you withdraw it.
17. Your rights
You have the right of access to your data (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20). You can withdraw consent at any time, with effect for the future (Art. 7(3)). Email support@togoandstark.com; we answer within one month.
Right to object: where we process your data on the basis of our legitimate interests (Art. 6(1)(f)), you may object at any time on grounds relating to your particular situation (Art. 21). You may object to the use of your data for direct marketing at any time, without giving a reason.
You also have the right to complain to a data protection authority, in particular in the EU country where you live or work (Art. 77).
18. If you live in the United States
We do not sell personal information for money. Some state laws treat advertising cookies as “selling” or “sharing” personal information. You can opt out on our Your privacy choices page, and we treat a Global Privacy Control signal from your browser as that opt-out; Shopify then limits what our advertising tools receive. TrackBee (section 14), which passes our ad measurements to Google and Meta, keeps running after an opt-out. You may ask us what we hold about you, to correct it or to delete it, as described above, and we will not treat you differently for doing so.
19. No automated decisions
We make no decisions about you based solely on automated processing (Art. 22). Creating your artwork with AI is not such a decision, and a person reviews every artwork.
20. Children
The store is not meant for children, and we do not knowingly collect personal data from anyone under 16. If you are a parent or guardian and believe a child has given us data, contact us and we will delete it.
21. Changes
We update this policy when the store or the law changes. The version published here applies.
Last updated: 21 October 2026