Printsakes — Privacy Policy

Last updated: 26 October 2026

Printsakes ("Printsakes", "we", "us", "our") is an online studio where you design custom photo frames and photobooks that we print and deliver, operated by Ledge Solutions Ltd (RC 9577536) of BLK 411, Akinyele Street, Ipaja, Lagos, Nigeria. This Privacy Policy explains what personal data we collect when you use printsakes.com (the "Service"), how we use and share it, and the rights you have under the Nigeria Data Protection Act, 2023 (NDPA). It works together with our Terms of Service.

This Policy is here to inform you about how we handle your data; it is not a contract and does not ask you to waive any right.

1. Who is responsible for your data

We are the data controller for the personal data described here. For any privacy question, or to exercise your rights, contact us at printsakes@ledgeapp.co. Our data-protection contact can be reached at the same address.

2. What we collect

We collect only what we need to let you design a keepsake and to print and deliver it.

a. Content you give us

• Photos and design content you upload (images, captions, layout choices). These are the heart of the Service and can include images of you and other people.
• Contact and delivery details: your name, phone number, email address, and delivery address.
• Messages you send us by email or through support.

b. Order and payment data

• Order details (what you ordered, price, order reference, status).
• Payments are processed by Paystack (card or bank transfer), and by manual bank transfer where offered. For card and bank payments via Paystack, your payment details are entered on Paystack's secure systems — we do not receive or store your full card number; we receive a payment reference and confirmation of success/failure. For a manual bank transfer, we receive the transfer reference/details you send us to match your payment.

c. Account and sign-in data

• You can use the Service without an account — we create an anonymous session so your design is saved on your device. If you choose to save across devices, you can sign in by email one-time code or Google. If you sign in with Google, we receive your name, email address and profile picture from Google (nothing else).

d. Technical and usage data (collected automatically)

• Device and browser information, and your IP address, which we use to run the Service, apply upload limits, and prevent abuse and fraud.
• Local storage / essential cookies used to keep your session and your in-progress design.
• Advertising measurement cookies (Meta). We advertise on Facebook and Instagram. On our public shop pages (the home page, product and guide pages, the design studio, cart and checkout) we use the Meta Pixel, which sets cookies (_fbp, and _fbc when you arrive from one of our ads) so we can tell whether our ads lead to orders. We do not run it on order-tracking pages, shared-design links, sign-in pages or our staff tools. See §4 for what Meta receives.

3. How we use your data and our lawful basis (NDPA)

We do not sell your personal data, and we do not use your photos for advertising, training, or any purpose other than producing your order and running your account, unless you give us separate, explicit permission (for example, if you reply to share a photo of your finished keepsake).

4. Who we share your data with

We share personal data only with service providers ("data processors") who help us run Printsakes, and only as needed:

• Print & finishing partners — to produce your order, our print partner receives the design files and the information needed to make and label your item. They are bound to use it only to fulfil your order.
• Delivery / logistics partners — your name, phone and delivery address, to deliver your order.
• Paystack — to process payments (paystack.com).
• Supabase — database, file storage and authentication (supabase.com).
• Vercel — website hosting (vercel.com).
• Resend — to send transactional emails such as your receipt and order updates (resend.com).
• Google — only if you choose "Continue with Google" to sign in.
• Meta Platforms (Facebook and Instagram) — to measure our ads. From our public shop pages, the Meta Pixel sends Meta the page you are on, your browser details, your IP address and Meta's cookie identifiers, and tells it when you add something to your cart or start checkout (with the value and number of items). When you place an order, and again when it is paid, we also send Meta the order value, the kind of product, your IP address and browser details, and your email address, phone number, name and our customer ID for you in hashed (scrambled, one-way) form, so Meta can match the order to an ad you saw. We never send Meta your photos, your designs, your delivery address, gift messages, or anything about a gift's recipient. Meta processes this under its own terms and privacy policy (facebook.com/privacy/policy). You can limit how Meta uses it in your Facebook or Instagram ad settings, or by blocking third-party cookies in your browser.
• fal.ai (which runs Google's image models) — only if you use the optional "Make it a painting" feature, to turn the photo you chose into an artistic version. Your photo is sent to fal.ai solely to create your painting and is not used to train any AI model.

We may also disclose data if required by law, to protect our rights, or in connection with a business transfer (e.g. merger or sale), in which case we will tell you.

5. Your photos — how we treat them

Your uploaded photos are stored privately and are access-controlled so that only you (through your session) and the systems needed to fulfil your order can reach them. We access them to render your design and to send the print-ready files to our print partner for a paid order. We do not publish them or share them with anyone except as needed to produce and deliver your order, or when you choose to share a design yourself (below).

When you share a design. If you create a share link, anyone who has that link can open it and see that design — no account and no sign-in required. We generate a small preview picture from it so the link shows a preview in WhatsApp and other apps, and that preview is stored at an unlisted web address that does not require a sign-in. We do not index share pages in search engines, and the link itself is a long random code that cannot be guessed. You can stop sharing at any time, which closes the link and deletes that preview picture. Two things to know before you share: anyone you send the link to can forward it on, and a preview picture that has already been delivered into a chat is a copy held by that messaging app — we cannot reach into WhatsApp or any other service to remove it.

Ordering from a link you shared. Anyone who opens your link can also order their own copy of that design, at full price, printed and delivered to their own address. Your photos are never handed to them — we print it for them from your design, and they do not receive your files. Yours is unaffected. If you would rather they could not, open the design and turn off Let people order their own copy in the share panel, or stop sharing the link altogether. Turning it off closes the door to new orders; it does not cancel an order someone has already placed. When someone does order a copy, we email you to tell you — never who they are (see §5a).

5a. People who open a link you shared

If someone opens a share link, they do not need an account, and unless they choose to order something they are not our customer. If they do order a copy, they become a customer in their own right from that point — we collect their name, phone, email and delivery address exactly as we would for any other order (§2), and none of it is shared with the person who shared the link. We still process a little data about that visit, and the NDPA requires us to say so: a one-way, irreversible fingerprint of their IP address (used only to stop automated abuse of share links — we cannot recover the IP address from it), the fact that the link was opened and when, and ordinary product analytics about the page. Unless the link is one that asks for photos (below), we do not ask them for a name, an email address or a phone number, and we do not build a profile of them. The person who shared the link sees a count of opens and a count of copies ordered, and — if a copy is ordered — receives an email telling them so. They are never told who opened the link or who ordered: no name, no email address, no phone number, no delivery address, and no order reference. That email goes to the account email address of the person who shared it.

Links that ask for photos. A photobook's maker can also share a link that asks family and friends to send photos for the book, rather than to look at it. Someone who opens that kind of link is not shown the book — only its cover, its title and a count of how many photos have come in — and sees no one else's photos. If they choose to send photos, this is what we collect and why:

• Their name (required), so the book's maker knows who sent what. The book's maker sees it.
• Their email address (optional). The book's maker sees it. We use it to send one thank-you email for sending photos, and for nothing else — no marketing, no newsletter, and we never add it to a mailing list. Our lawful basis is our legitimate interest in acknowledging what they sent, which they can object to at any time (every thank-you carries an unsubscribe link, and we will not send that address another thank-you).
• The photos they send. These are copied into the book maker's own photos, where they are treated exactly like photos the maker uploaded themselves (§5): the maker can place them in this book or any other, and print them. We keep the sender's original only until the maker has their own copy.
• The fact of each photo arriving and when, tied to a random anonymous identifier held in their browser — not an account.

The sender is not our customer and does not need an account. The book's maker is told the name, email (if given) and photos of each person who sent something; nobody else is. If a sender wants their name, email or photos erased, they can email us (§1). We will delete their name and email and any photo not yet used; a photo already in a book that has been printed and paid for is part of that order's record and cannot be recalled from a book that has already been delivered.

5b. Sending a gift to someone else

When you send an order as a gift, you give us the recipient's name, phone number and delivery address, and the words for the gift card or slip. We use them only to make and deliver that order: the address and phone go to our print and delivery partners so the gift can be packed and the rider can call on the day, and the card's words are printed and packed with it. We do not contact the recipient — no email, text or message from us before it arrives — and we never use their details for marketing. Every email about the order goes to you. Please only give us a recipient's details if you are entitled to share them for this purpose. The recipient's details are kept with the order record for as long as §7 says we keep orders; to have them erased sooner (where the law allows), email us (§1).

6. International transfers

Some of our processors (e.g. Supabase, Vercel, Paystack, Resend, Google, fal.ai) may store or process data outside Nigeria. Where we transfer personal data across borders, we do so in line with the NDPA — relying on adequacy, appropriate safeguards, or your consent — and we use reputable providers with recognised security and privacy commitments.

7. How long we keep your data

• Designs and uploaded photos: kept while your design is active so you can re-order or edit it. When you delete a design, we remove it, along with any share link and the preview pictures made for it — the preview pictures are cleared by a routine clean-up that runs daily, so there can be a short delay. The underlying photos are deleted on request (email us and we will erase them, subject to anything we must keep by law). Abandoned uploads that are never ordered may be periodically cleaned up.
• Share links and viewing records: a share link lasts until you stop sharing or delete the design. We keep a count of how many times a link has been opened so we can show it to you, and those records go when the link does. One exception: if someone ordered a copy from a link, that order record notes which link it came from, and — like every order record — it is kept for around 6 years for tax and accounting purposes. Stopping sharing does not erase it; deleting the design removes the link from it.
• People who send photos to a book (§5a): their name and email are kept for as long as the design they sent photos to exists, so its maker can see who sent what, and are deleted when that design is deleted — or sooner, on request. Closing or stopping the link does not delete them, because the maker may still be placing the photos. The photos themselves become the maker's (§5a) and follow the maker's retention above.
• Orders and payment records: kept for as long as needed to fulfil the order and, for financial and order records, generally for around 6 years to meet our tax, accounting and legal obligations.
• Account data: kept while your account is active; deleted (or anonymised) on account closure, subject to records we must keep by law.

8. Your rights under the NDPA

Subject to the NDPA, you have the right to: access the personal data we hold about you; correct inaccurate data; request deletion; object to or restrict certain processing; withdraw consent at any time (without affecting prior processing); and data portability. To exercise any right, email printsakes@ledgeapp.co. We will respond within the timeframe required by law.

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) (ndpc.gov.ng). We would appreciate the chance to resolve it with you first.

9. Security

We protect your data with encryption in transit, access controls, row-level security on our database and private storage. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your information and to notify you and the NDPC of a breach where the law requires.

10. Children

The Service is intended for adults (18+). We do not knowingly collect personal data directly from children. If you believe a child has provided us data, contact us and we will delete it. Photos that include children, uploaded by an adult who has the right to use them, are treated as the uploading adult's content and responsibility (see our Terms of Service); we use them only to produce and deliver your order, never for marketing or any other purpose.

11. Changes to this Policy

We may update this Policy from time to time. We will post the updated version here with a new "Last updated" date, and for material changes we will take reasonable steps to notify you.

12. Contact

Questions or requests: printsakes@ledgeapp.co · Ledge Solutions Ltd (RC 9577536), BLK 411, Akinyele Street, Ipaja, Lagos, Nigeria.