Privacy Policy

Who we are

Weaving Studio operates this website to showcase our handwoven textile collection and to manage access for studio members and contributors. We are committed to protecting the privacy of everyone who visits or uses this site.

For privacy enquiries, please contact us at the address in the Contact section below.

Data we collect and why

We collect only what is necessary to provide the service:

• Google account information — name, email address, and profile photo URL, obtained when you choose to sign in with Google. We use this to create your member account and to identify you within the platform.
• Role and access status — your assigned role (participant, contributor) and approval status, set by the studio administrator.
• Uploaded content — images and descriptive metadata (title, material, size, description, price) uploaded by contributors. This content belongs to the studio and is managed through the admin panel.
• Session data — a short-lived session identifier stored in a browser cookie to keep you logged in. This cookie expires after 24 hours.

We do not collect analytics, behavioural data, advertising identifiers, or any information beyond what is listed above.

Cookies

This site uses a single first-party session cookie (connect.sid) which is strictly necessary for the login and member-access functionality. Without it, authenticated features cannot work.

We do not use tracking cookies, analytics cookies, or advertising cookies of any kind. No third-party cookies are set by this site.

Google's sign-in flow is governed by Google's Privacy Policy. Google may set its own cookies as part of the OAuth process.

Legal basis for processing (GDPR)

If you are in the European Economic Area, we process your personal data on the following legal bases under Article 6 of the GDPR:

• Contract performance (Art. 6(1)(b)) — processing your Google account information to create and manage your member account, which you requested by signing in.
• Legitimate interests (Art. 6(1)(f)) — the session cookie, which is technically necessary to maintain your authenticated session and protect the site from unauthorised access.

Data sharing and transfers

We do not sell, rent, or share your personal information with any third parties for their own purposes.

The only third party involved in data processing is Google, acting as an identity provider through OAuth 2.0. Google processes your sign-in on their infrastructure in accordance with their own privacy policy. We receive only the profile information you have authorised Google to share.

If you are located outside your country of origin, your data may be transferred to and processed in the country where this site is hosted. Such transfers are made with appropriate safeguards in place.

Data retention

We retain your account information for as long as your account is active. If you request deletion of your account, we will remove your name, email address, profile photo, and access records within 30 days.

Session cookies are deleted automatically when they expire (24 hours) or when you close your browser.

Your rights under GDPR (EEA residents)

If you are located in the European Economic Area, you have the following rights regarding your personal data:

You also have the right to lodge a complaint with your national data protection supervisory authority. A list of EEA supervisory authorities is available at edpb.europa.eu.

Your rights under CCPA (California residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the CPRA grants you the following rights:

• Right to know — you may request disclosure of the categories and specific pieces of personal information we have collected about you, the purposes for which it is used, and the categories of third parties with whom it is shared.
• Right to delete — you may request that we delete personal information we have collected from you, subject to certain exceptions.
• Right to correct — you may request that we correct inaccurate personal information.
• Right to opt out of sale or sharing — we do not sell or share your personal information with third parties for cross-context behavioural advertising. No opt-out is necessary.
• Right to non-discrimination — we will not discriminate against you for exercising any of your CCPA rights.

To exercise any of these rights, please contact us using the details below. We will respond within 45 days as required by law.

Contact

Changes to this policy

We may update this policy from time to time to reflect changes in our practices or applicable law. When we do, we will update the "last updated" date at the top of this page. We encourage you to review this policy periodically.