Privacy.

Autograf Digital Corp., #800 - 550 6 Ave SW, Calgary AB T2P 0S2, Canada, is responsible for your personal data. Questions and requests: hello@mycity.is.

To make and deliver an order: your name, email, shipping address, phone number if you give one, what you ordered and the designs you saved, including any words you typed.

To run the shop: a random visitor ID in a cookie, which keeps your bag and the designs you saved, and the market you chose. Where your choice allows (see Analytics and cookies), which pages and products were viewed, customised or added to the bag. We don't sell personal data.

Payment details go straight to Stripe; we never receive your card number.

If you ask us to tell you when a product ships to your country, we keep your email, that product and the country for that one email only, until it ships there or you ask us to remove it.

We measure, in aggregate, how the shop is used, with our own event log (kept in our database) and Google Analytics 4, from Google, which processes it for us as our analytics provider. They see the pages viewed; the products looked at, customised, added to the bag and bought; when someone signs up for an email; the order value and currency; the kind of device and browser; and the approximate country and region worked out from your IP address. We never send your name, email, address, gift notes or the words you type into a design. Google signals and ad personalisation are off, and Google Analytics isn't used for advertising.

In the European Economic Area, the United Kingdom, Switzerland and Quebec, and wherever we can't tell where you are, nothing is measured until you choose "Accept" on the banner; elsewhere it runs unless you choose "Decline". Nothing from before your choice is recorded afterwards. You can change or withdraw your choice at any time with "Cookie settings" at the foot of every page; withdrawing stops it from then on. We remember your choice in a cookie for 12 months.

Google Analytics keeps this data for 14 months, then deletes it. Our own event log is deleted with the rest of the visitor data, after 18 months.

We also see, from Google Search Console and Bing Webmaster Tools, how the shop appears in search results: searches, clicks and positions in aggregate, with nothing that identifies you.

We also count visits and the same shop actions with Umami, hosted for us by AutoChat Analytics. It sets no cookies and keeps no profile of you, and it follows the same choice as Google Analytics. It keeps these counts until we delete them: there is no automatic deletion period. Session replays and heatmaps are switched off for My City Is.

We don't use advertising trackers: no Meta Pixel, no Pinterest tag and no ad networks.

Only the service providers that make the shop work, under contract: Stripe (payments and tax), Google (site analytics, where you allow it), our production and shipping partners (making and shipping your order: name, address and the design), our email provider (order emails), and our hosting and database providers. Some are in the United States or the European Union.

AutoChat Analytics also runs Umami for us under contract, for the visit counts and shop actions described above.

Order records are kept as long as tax and accounting law requires, which is several years in most of our markets. Saved designs that were never ordered and visitor data are deleted after 18 months.

If we change this notice in a way that matters, we tell you by email before it applies to data we already hold. Effective 19 October 2026.

Depending on your state, including California, you can ask what personal information we hold, ask us to correct or delete it, and opt out of its sale or sharing for advertising. We don't sell or share personal information for advertising.

Under the UK GDPR and the GDPR you can ask for access to your data, correction, deletion, restriction or a portable copy, and you can object to processing based on our legitimate interests. We process order data to perform our contract with you and to meet legal obligations, and measurement (Google Analytics, our own event log and any advertising tags) only with your consent.

You can complain to your data protection authority: the ICO (UK), the Autoriteit Persoonsgegevens (Netherlands), or the authority for your state in Germany.

Under PIPEDA you can access and correct your personal information and withdraw consent, subject to legal limits. You can complain to the Office of the Privacy Commissioner of Canada.

In Quebec, under Law 25, nothing is measured until you choose "Accept", and you can withdraw that at any time with "Cookie settings". You can also complain to the Commission d'accès à l'information du Québec.

Under the Privacy Act 1988 you can access and correct your personal information. You can complain to the Office of the Australian Information Commissioner.

Under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares you can access, correct, cancel or object to the use of your personal data (ARCO rights) by writing to hello@mycity.is.