Privacy Policy

Privacy Policy — v2026.06

Version: 2026.06

Effective Date: May 13, 2026

Supersedes: April 19, 2026 published version

Last Updated: May 13, 2026

This Privacy Policy describes how Charles Francis Studio, LLC, doing business as Charles Francis Studio & Gallery ("Charles Francis Studio," "Studio," "we," "us," or "our"), a Washington State LLC located in Kennewick, WA, collects, uses, and shares information about you when you visit charlesfrancis.gallery (the "Site"), create an account, or purchase products or services from us.

By using the Site, you consent to the practices described in this Policy. If you do not agree, please do not use the Site.

1. INFORMATION WE COLLECT

1.1 Information You Provide

Account Information: name, email address, password (stored in hashed form), and any additional profile information you choose to submit.
Order Information: billing and shipping addresses, phone number, items purchased, order history, and communications with us about your order.
Payment Information: processed through third-party payment processors (currently Stripe, Inc.). We do not store your full credit card number or CVV on our servers.
Customer-Submitted Artwork & Files: if you use our art-scanning, reproduction, restoration, editing, or custom-printing services, you may upload photographs, artwork, or related files. See Section 5 for our license, retention, and deletion practices for these files.
Communications: emails, support tickets, form submissions, and any other correspondence you send us.
Tax Information (applies to artists only): if you participate in the Artist Program, we collect tax-identification documentation (Form W-9 for U.S. persons; Form W-8BEN for non-U.S. persons) as required by IRS reporting rules. This documentation is encrypted at rest using AES-256-GCM with a per-file random initialization vector before being written to a non-public path on our server, and is decryptable only by authorized Studio personnel for tax-reporting purposes.
Legal Acceptance Records: when you accept these Terms, our Customer Terms of Service, or our Artist Terms of Service, we record the version you accepted, the date and time of acceptance, the IP address and user-agent string from which acceptance was submitted, a SHA-256 hash of the document text at the moment of acceptance, and a unique acceptance identifier (UUID). The IP address and user-agent collected at the moment of acceptance are used solely as evidence of contract formation; we do not use them for marketing, profiling, or any purpose unrelated to the acceptance audit. This record is preserved as evidence of contract formation and is available to you under your account at /account/legal.

1.2 Information Collected Automatically

Log Data: IP address, browser type and version, operating system, referring pages, pages visited, and timestamps.
Cookies & Similar Technologies: session cookies used to keep you logged in, remember your cart, and secure the Site against CSRF and similar attacks. See Section 4 below.
Analytics: We do not currently use any third-party analytics, advertising, social-media, or marketing tracking pixel (no Google Analytics, no Meta Pixel, no TikTok Pixel, no Pinterest tag, no Google Tag Manager). If we add any such tool in the future, we will update this Policy and provide the disclosures and choices required by applicable law before activating it.

1.3 Information From Third Parties

We may receive information from payment processors (confirmation of payment, fraud signals), shipping carriers (delivery status), and service providers assisting us with site operations.

2. HOW WE USE YOUR INFORMATION

We use the information we collect to:

Process, fulfill, and deliver your orders, including custom print and reproduction services;
Create and manage your account, and authenticate you when you log in;
Communicate with you about orders, services, support requests, and policy updates;
Provide customer support and respond to inquiries;
Operate, maintain, secure, and improve the Site and our services;
Detect, prevent, and investigate fraud, abuse, and violations of our Terms of Service;
Maintain audit records of legal acceptances (including version, timestamp, IP address, user-agent, document hash, and acceptance UUID) as evidence of contract formation;
Comply with legal obligations, tax reporting (including issuance of IRS Form 1099-NEC to participating artists where required), and enforceable requests from law enforcement;
With your consent, send you marketing communications (you can unsubscribe at any time using the link in any marketing email).

3. HOW WE SHARE YOUR INFORMATION

We do not sell your personal information for money. We use a small set of service providers — listed below — to operate the Site, process payments, and deliver your order. These providers act on our written instructions and are contractually limited to using your information for the purposes for which we engage them. We share information only in the limited circumstances below:

Service Providers: payment processor (Stripe, Inc.), shipping-label integration (EasyPost, Inc.), our web host, and our email service provider, each acting on our behalf and bound by confidentiality obligations. A current list of our principal service providers is maintained at charlesfrancis.gallery/privacy/subprocessors and updated when we add or remove a provider.
Artists: when you purchase an artist's work, we share limited order information with that artist (for example, your name and general location) as needed to fulfill the order and compensate the artist. We do not share your full contact information with artists without your consent.
Tax Authorities: for participating artists, we report payment information to the U.S. Internal Revenue Service and applicable state tax authorities as required by law.
Legal & Safety: when required by law, subpoena, court order, or to protect the rights, property, or safety of the Studio, our users, or others. When we receive a subpoena, search warrant, or other compulsory legal process for your information, we will, to the extent permitted by law, give you advance notice and a reasonable opportunity to challenge the request before we respond. We do not voluntarily provide your information to law enforcement or other government agencies absent compulsory legal process or an emergency involving imminent risk of death or serious bodily injury.
Business Transfers: in connection with a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction, subject to this Policy.
With Your Consent: in any other case, only with your explicit consent.

Based on our current operations, we do not sell personal information for monetary consideration and we do not knowingly share personal information for cross-context behavioral advertising. If we change this in the future — for example, by adding a third-party advertising tag to the Site — we will update this Policy and provide you with the disclosures and opt-out mechanisms required by applicable law.

4. COOKIES & TRACKING TECHNOLOGIES

We use cookies and similar technologies to operate the Site. Categories include:

Strictly Necessary: required for login sessions, cart functionality, and security (for example, CSRF protection). These cannot be disabled.
Functional: remember your preferences and settings.
Analytics: None currently in use (see §1.2). If we add analytics in the future, this Section will be updated.

Most browsers allow you to control cookies through their settings. Disabling strictly necessary cookies will prevent parts of the Site from functioning. If you visit the Site from a browser configured to send a Global Privacy Control ("GPC") signal, we will honor that signal as an opt-out of any sale or sharing of your personal information for the consumer accessing through that browser, as required by applicable state law.

5. CUSTOMER-PROVIDED ARTWORK & FILES

When you upload photographs, artwork, scans, or related files for reproduction, scanning, restoration, editing, or custom printing services ("Customer Files"):

License. You grant Charles Francis Studio a limited, non-exclusive, worldwide, royalty-free license to host, store, copy, transmit, color-correct, retouch, reproduce, and print your Customer Files solely for the purpose of performing the service you requested and delivering your order. This license terminates when we delete your files under the retention schedule below or upon your verified request, whichever is sooner.
Ownership. You retain all underlying intellectual property rights in your Customer Files. We do not claim ownership.
No marketing or AI use. We do not use Customer Files for marketing, promotion, portfolio display, training of any artificial-intelligence or machine-learning model, or any other purpose without your separate signed written consent. We do not currently use any AI-based image-processing tool on Customer Files. If we ever change this practice, we will update this Policy and obtain your separate consent before using your content for training.
Retention. We retain your uploaded Customer Files for 180 days after order delivery to support reorders and quality-control re-prints, after which they are permanently deleted from active systems. Backup copies are overwritten on a 30-day rolling basis after that, so files are fully purged from all systems within 210 days of order delivery, unless a longer retention is required by law (for example, if the file is subject to a litigation hold).
Earlier deletion on request. You may request deletion of your Customer Files at any time by emailing privacy@charlesfrancis.gallery from the email address on your account or providing other reasonable verification of identity. We will delete the files from active systems within 30 days of a verified request and from backups within 60 days. Deletion will not affect physical prints already produced, shipped, or delivered.
Your representations. You represent and warrant that you have the legal right to submit any files you upload, that doing so does not infringe the rights of others, and that the files do not depict identifiable individuals under the age of 13 without their parent's or legal guardian's consent.

5A. NO CONSUMER HEALTH DATA — RCW 19.373

Charles Francis Studio does not knowingly accept or process "consumer health data" as that term is defined in the Washington My Health My Data Act, RCW 19.373.010. You agree that you will not submit any Customer File that depicts you or any identifiable individual in a manner that reveals past, present, or future physical or mental health status — for example, photographs taken in medical, hospice, or hospital settings; injury photographs; photographs of deceased persons taken in a clinical or post-mortem context; or images that reveal a medical condition. If you inadvertently submit such a file, please contact us immediately at privacy@charlesfrancis.gallery so we can confirm deletion. Studio reserves the right to decline any submission at intake if Studio determines, in its discretion, that the submission may constitute consumer health data.

6. DATA SECURITY

We use commercially reasonable administrative, technical, and physical safeguards to protect your information, including encrypted connections (HTTPS), hashed passwords, restricted access controls, and AES-256-GCM cryptographic encryption at rest for artist tax documentation stored on a non-public path. No method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials.

In the event of a security breach affecting your personal information, we will notify you within the timeframe required by applicable law, and in any event no later than thirty (30) days after we discover the breach as required by RCW 19.255.010. Where the breach affects more than 500 Washington residents, we will also notify the Washington State Attorney General as required by that statute.

7. DATA RETENTION

We retain personal information for as long as needed to provide our services, comply with our legal obligations (including tax and accounting requirements; tax records are retained for the minimum period required by IRS recordkeeping rules), resolve disputes, and enforce our agreements.

Specific retention periods:

Customer-uploaded Files (§5): 180 days after order delivery, then 30 additional days in rolling backups (210 days total).
Order and account records: for the duration of the account plus six (6) years from the last sign-in or last order, whichever is later, in line with the limitations period for written contract claims under RCW 4.16.040.
Legal acceptance records (§1.1, "Legal Acceptance Records"): for the duration of the account plus six (6) years from the last acceptance, in line with the limitations period for written contract claims under RCW 4.16.040.
Artist tax documentation: for as long as the IRS requires us to retain tax records.
Account-closure records: when an account is closed (whether by you or by us), the IP address and user-agent recorded at the time of the closure request are retained on our closure ledger for the same six-year account-records window described above. This information is used solely to defend against disputed-closure claims (for example, where a former user alleges the closure was unauthorized). We do not use closure-ledger data for marketing. The email address associated with the closed account is not anonymized — it remains on the account record. Because each email address can only be associated with one account on our system, this also acts as a permanent reservation: the same email address cannot be used to create a new account after closure.

Closed account content: when your account is closed, the content of your account record is retained (your email and any profile content you had created) so that the account can be reactivated by request if needed and so that we retain records of the account for the dispute-resolution period described above. Your closed account is not publicly visible, your stored mailing addresses are deleted at the standard scrub time, and you cannot sign in to a closed account. To request full erasure of the account record (including the email address and any artist-profile content), email info@charlesfrancis.gallery; verified right-to-erasure requests are processed by an administrator.

When information is no longer needed, we delete or anonymize it in a manner consistent with applicable law.

8. YOUR RIGHTS & CHOICES

Subject to applicable law, you may have the right to:

Access the personal information we hold about you, including a copy of the version(s) of our Terms you have accepted, with acceptance timestamp, IP address, and acceptance UUID;
Correct inaccurate or incomplete information;
Delete your account and associated personal information, subject to legal retention obligations (note: deletion will not extinguish records we are legally required to retain, including tax records and contract-formation evidence);
Opt out of marketing communications by using the unsubscribe link in any marketing email or contacting us directly;
Port your information to another service where technically feasible.

You may also view the version of each legal document you have accepted at any time via your account at /account/legal (customers) or /portal/legal (artists).

To exercise any of these rights, contact us at privacy@charlesfrancis.gallery. To protect your information, we will verify your identity before acting on your request. For account holders, we will typically verify by sending a confirmation link to the email address on file and by asking you to confirm two pieces of information about your account (for example, the date of your most recent order and the shipping address on that order). For non-account-holders, we will request additional verification appropriate to the sensitivity of the information requested. We will respond within 45 days as required by applicable law and may extend that period by an additional 45 days where reasonably necessary, in which case we will notify you of the extension within the original 45-day window. You may also designate an authorized agent to make a request on your behalf; the agent must provide written authorization signed by you, and we may still ask you to verify your identity directly.

9. CALIFORNIA PRIVACY RIGHTS

If you are a California resident, the California Consumer Privacy Act ("CCPA"), as amended by the California Privacy Rights Act ("CPRA"), provides additional rights regarding your personal information.

Categories of personal information we collect (matched to CCPA category labels):

Identifiers: name, email, postal address, phone, IP address, account ID, acceptance UUID
Commercial information: order history, products purchased, payment records (processed by Stripe)
Internet/network activity: log data, session cookies (no third-party analytics currently)
Audio/visual: Customer Files you upload (per §5)
Professional/employment information (artists only): tax form data, payout method information

Sources: directly from you (account creation, orders, uploads, communications), automatically (log data, cookies), and from service providers (payment confirmation, shipping status).

Recipients: the service providers listed in §3 above; tax authorities (artists only); artists (limited order information); legal/safety recipients per §3.

Purposes: as described in §2.

Retention: as described in §7.

Your rights as a California resident:

Right to know what categories and specific pieces of personal information we collect, use, and disclose
Right to delete your personal information, subject to exceptions
Right to correct inaccurate personal information
Right to opt out of the sale or sharing of personal information (we do not currently sell or share personal information for cross-context behavioral advertising)
Right to limit the use of sensitive personal information (we do not currently use sensitive personal information for purposes that would require this opt-out)
Right to non-discrimination for exercising your CCPA rights

To exercise your California rights, send a request to privacy@charlesfrancis.gallery or use the link titled "Your Privacy Choices" in the footer of every page of the Site. We will respond within 45 days, with one 45-day extension on notice. We will verify your identity using the procedures described in §8.

10. CHILDREN'S PRIVACY

The Site is not directed to children under 13, and we do not knowingly collect personal information from children under 13. In addition, our Terms of Service require account holders to be at least 18 years of age, and we do not knowingly accept accounts or orders from minors.

If you upload photographs depicting any individual under the age of 13 — for example, children's portraits or baby photos submitted for restoration — you represent that you are the parent or legal guardian of that individual or that you have obtained the parent's or legal guardian's consent to submit the photograph for the service you have requested. We do not knowingly accept submissions of photographs of children under 13 without that consent.

If you believe a child has provided us with personal information, please contact us and we will delete it.

11. THIRD-PARTY LINKS

The Site may contain links to third-party websites or services. We are not responsible for the privacy practices or content of third parties.

12. INTERNATIONAL USERS

The Site is intended for users in the United States only. We do not target our products or services to residents of the European Economic Area, the United Kingdom, or Switzerland. We do not currently ship internationally and we do not knowingly accept orders that ship to addresses outside the United States.

If you are accessing the Site from outside the United States, you consent to the transfer, processing, and storage of your information in the United States, which may have data protection laws different from those in your country. If you are located in a jurisdiction with comprehensive data-protection laws (such as the European Union, United Kingdom, or Switzerland) and we inadvertently process your information, please contact us at privacy@charlesfrancis.gallery and we will, at your election, delete your information.

13. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. Material changes (including changes to the categories of personal information we collect, the categories of third parties with whom we share, the purposes for which we use personal information, our retention periods, or the rights and choices available to you) will be communicated by email to account holders at least thirty (30) days before they take effect, and account holders will be presented with an "I Acknowledge the Updated Privacy Policy" control on next sign-in via a banner displayed on every page of the Site after sign-in. Acknowledgment of a material change occurs only when you affirmatively click the acknowledgment control.

Non-material changes (clarifications, typographical corrections, contact updates) take effect on publication and do not require acknowledgment. The current version is always available at charlesfrancis.gallery/privacy. Prior versions you have accepted remain available to you under your account at /account/legal (customers) or /portal/legal (artists).

14. CONTACT

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, contact us at:

Charles Francis Studio, LLC d/b/a Charles Francis Studio & Gallery 6030 W Clearwater Avenue, Suite B Kennewick, WA 99336 Email: privacy@charlesfrancis.gallery General: info@charlesfrancis.gallery Phone: (509) 582-8861