Privacypolicy.

Last reviewed: October 1, 2026

What we ask for, what the site records while you use it, what it is used for, who else touches it, and how you get it back or have it deleted.

Who is responsible for your data

The data controller is Surf Devils S.L., tax ID (NIF) B25473422, registered at C/ Dr. Combelles 27, 25003 Lleida. For anything to do with your data, write to skateboardpersonalizado@gmail.com or call ⁦+34 973 24 06 16⁩.

Seller: Surf Devils S.L.
Tax ID (NIF): B25473422
Address: C/ Dr. Combelles 27, 25003 Lleida
Country: Spain
Email: skateboardpersonalizado@gmail.com
Phone: +34 973 24 06 16

This policy covers both the Skateboard Personalizado website and its app, which opens the same editor: what is explained here works the same way in both, except where it says otherwise.

What we collect

To send you the deck

Name, email address, postal address (with the additional address line if you use it), postcode, town, country and phone number. The phone number is optional within Spain and required outside it, because the courier asks for it; everything else is essential, because it is what goes on the label. With the order we also keep the language you placed it in and where you came to the site from. The order is saved as soon as you submit the shipping details, even if you then do not go on to pay.

Your design

The deck image and the photos you add to the editor. Each photo is uploaded to our storage the moment you add it — not when you save or order — so that we can display and print it and so that you can open the design again. Images are served from addresses that cannot be guessed or listed, but anyone who has one can see the image. If you upload photos with other people in them, make sure they are happy with that.

While you design

The editor sends us up to four thumbnails of how your deck is coming along, with whatever photos are on it, even if you do not save or order it. We use them to see where people get stuck and what goes wrong in the editor.

If you create an account

Your email address, the name you give us if you choose to and, if you sign in with Google, your Google account identifier and the name and profile picture Google returns to us. There is no password: you sign in with a single-use link or code sent to your email, and the session lasts a month on that browser. When you sign in, any orders and decks you made without an account using that same email move to your account, and we link that browser's visit log to it.

What you publish

If you publish a design in the gallery, it is shown with your account name. If you sign up as an artist, your artist name, bio, photo and link are public.

If you save a deck without an account

The deck and the photos on it, with two links: yours, which opens it for editing or deleting and stays saved in your browser, and another for showing it to whoever you like. You need neither an account nor an email address. If you ask us to email you the link, we keep that email address with the deck; if you later sign in with it, the deck moves to your account. When you press “Order” without having saved it, we save it in this same way anyway.

Payment

Your card details do not pass through our servers and we do not store them: Stripe collects them directly in its own form. From each payment we keep the amount, the date, the status, the identifier Stripe gives us and, if it fails, the reason Stripe gives.

How you use the site

We record the steps of each visit — where you came from (only the domain or the campaign), the landing page, the type of screen, the language, opening the editor, which tools you use, reaching the payment step and the errors you run into — with two random identifiers generated by your browser: one for the visit, which is deleted when you close the tab, and one for the browser, which stays stored in it until you delete it. That log does not store your IP address or your browser model, but it is not anonymous: if you place an order, sign in to your account or write to us through the chat, we link it to your name and email, and in our admin panel we see the path of those visits.

If you write to us through the chat

What you write, and the email you leave so we can reply. So we can understand your question without making you repeat anything, the chat also tells us which page you are on and in which language, the random identifiers of the visit and of the browser, the design or order you have open and the last error you saw; and, if you are signed in, your email and your name. From the first time you open it, the chat loads again on your visits and receives this data on every page. With those identifiers we also see the steps of those visits.

If something goes wrong

When the site throws an error, the error log records the page you were on, with its full address, the page you came from and your browser model. To measure speed, it records the same for a small share of visits, even when nothing goes wrong.

If you write to us as a business, artist or partner

What you put in the form: your name, your company's name, your email, your phone number and whatever you tell us. If you apply to be a partner, also a password, which we store encrypted.

In the app

The app asks for access to the camera and your photos only so you can choose the ones you want to put on the deck, and stores your session and the list of your designs on your phone. It contains no analytics or advertising tools, and neither Google Analytics nor the chat loads inside it. Purchases are made on the website, in the browser.

What we use it for, and on what legal basis

Preparing, printing, shipping and invoicing your order, and emailing you about it: confirmation, dispatch, problems. Basis: performance of the purchase contract.
Keeping invoices and sales records. Basis: our accounting and tax obligations.
Running your account, your saved designs, what you publish in the gallery or on your artist profile, and your creator credit. Basis: performance of the contract.
Detecting and preventing fraudulent payments and abuse of the service. Basis: our legitimate interest in being paid for what we sell and not absorbing chargebacks.
Understanding where people drop off before buying and what goes wrong in the editor, using the visit log and the thumbnails described above. Basis: our legitimate interest in improving the shop. This is pseudonymised data that we only link to your name if you buy, sign in to your account or write to us, and you can object by writing to us.
Measuring visits with Google Analytics. Basis: your consent. Google Analytics does not load until you give it, and you can withdraw it whenever you like from the “Cookies” link in the footer.
Replying when you write to us through the chat and, if you tell us something went wrong, finding out what happened so we can fix it. Basis: your own request, when you open the chat, and our legitimate interest in the site working.
Saving a deck for you without an account and, if you ask us to, emailing you the link to open it again. Basis: your own request. We only use that email for this and, if you sign in with it, to move the deck to your account.
Sending you an email reminder, with the design you left, if you fill in the shipping details and do not go on to pay; one a month at most. Basis: our legitimate interest in you not losing a half-finished order. Every reminder includes a link to stop receiving them.
Detecting and fixing errors on the site. Basis: our legitimate interest in it working.
Knowing whether a purchase started from a creator's design, so we can give them their commission. Basis: performance of the creator programme and our legitimate interest.
Replying to the businesses, artists and partners who write to us, and publishing artists' profiles. Basis: your own request and, for partners, the contract.

Who else touches it

We do not sell your data and we do not hand it to anyone to advertise at you. These receive it, and only for what is needed:

Stripe, to take payment and to refund it: it receives your name, email, phone number, shipping address, the amount and the payment details, and also uses them in its own right to prevent fraud. If you pay with another of the methods Stripe offers, the company behind that method receives what it needs to take the payment.
The workshop that prints the deck, in Spain, which sees your name, address, phone number and the design in our admin panel, but not your email or what you paid.
Within Spain, Correos (the Spanish postal service), which receives your name, address and phone number. Outside Spain, the logistics partner we work with, which sees your name, address, phone number and how many decks there are in our admin panel, and hands the parcel to its courier.
Google. The shop's email is a Gmail account, so Google handles the emails we send you and the ones you write to us. If you sign in with Google, Google knows you are signing in to our site. When you open the editor in 3D, and on some screens, your browser downloads a part of the viewer and an icon font from Google servers, and Google receives your IP address when serving them. And, only if you accept it, Google Analytics for visit statistics.
Crisp, in France, which runs the site's chat, and only if you open it: it receives the conversation and the data listed under “If you write to us through the chat”, plus your browser and IP address.
OVHcloud, from whom we rent the server that holds the database, the design images, the visit log and the error log.

Stripe and Google may process data in the United States. They do so with the safeguards required by the General Data Protection Regulation: the EU-U.S. Data Privacy Framework and the European Commission's standard contractual clauses.

How long we keep it

Paid orders and their data, for as long as tax and accounting obligations require, and for as long as any claim is still open.
Your account and your designs, for as long as the account exists. You can delete a design whenever you want, and the whole account from the app or by asking us: that deletes your designs and their photos, your artist profile, your balance and the link to your visits. Orders are kept, unlinked from the account, with the design that was printed, because the law requires it.
The visit-step log and the editor thumbnails, 90 days. Where a visit came from is kept with the order when that visit ends in one.
Chat conversations, in Crisp, for as long as we need them to help you. If you ask us to delete them, we delete them.
The email we send a design's link to when you saved it without an account: for as long as the design exists.
Designs you save without an account, and the one you take to checkout even if you don't finish the purchase: until you delete them. If you sign in to an account from the same browser, they move into it.
Two things are not yet deleted automatically: orders that are never paid, and photos you add to the editor without saving them in any design. If you ask us to delete an unpaid order of yours, we delete it.
The error log, 90 days.
Messages from businesses, artists and partners, for as long as the relationship lasts or until you ask us to delete them. If you unsubscribe from the reminders, your email stays on the unsubscribe list so that we do not write to you again.

Your rights

You can ask for access to your data, ask us to correct it, ask us to delete it, restrict or object to how we use it, and ask for a copy in a format you can take elsewhere. You can also withdraw any consent you have given, at any time, and object to the email reminders and to the visit log.

Write to skateboardpersonalizado@gmail.com from the address you ordered with, or call ⁦+34 973 24 06 16⁩. We always reply, even when the answer is that we cannot delete an invoice the law requires us to keep.

If you think we have got it wrong, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) or to the data protection authority of the country where you live.

Cookies

Google Analytics does not load until you accept it. If you accept, it keeps its cookies for 24 months; if you decline or do not answer, it does not load.

Beyond that, your browser stores the language you picked, your cookie decision, your session key if you are signed in, the two visit identifiers from “How you use the site”, the links to decks you save without an account, a copy of the design you are working on and whether you have used the chat. If you arrive from a creator's design, a cookie remembers it for a month so the creator gets their commission if you buy. On the payment page, Stripe sets its own cookies to prevent fraud.

The chat loads nothing until you open it. Once you do, Crisp stores its own cookie in your browser so the conversation isn't lost, lasting up to six months, and from then on the chat loads again on your visits so our reply can reach you.