Privacy Policy
Versão 1.3 · Última atualização: September 28, 2026
1. Who processes your data
Marvy Brands Inc., Business Number 707454898, with its registered office in North Vancouver, British Columbia, Canada, operator of the Pikables platform (pikables.com), is the controller of the personal data described in this policy.
Contact for privacy matters: support@pikables.com
This is the contact channel for the processing of personal data. While the operation is conducted directly by the management of Marvy Brands Inc., this address is attended by them.
2. Which laws apply
Pikables serves users in several countries. This policy was drafted considering:
- LGPD (Law 13.709/2018), for data subjects in Brazil;
- PIPEDA, for Canada, where the company is headquartered;
- GDPR, for data subjects in the European Union and the United Kingdom.
3. Data we collect
3.1 From all users, at sign-up
Name, email, country, preferred language and password (stored encrypted, never in readable text).
If you sign in with your Google account, we receive from Google your name, your email and the link to your profile photo.
3.2 From Buyers
- Order history and products purchased
- Customizations made to the work
- Reviews published
- Photos and text you send to personalize the poster, such as a photo of yourself and the address used in the QR code
We do not collect or store credit card data. Payment is processed entirely by Stripe.
3.3 From Sellers
In addition to the above, in order to make payouts possible:
- Full name and store name
- Tax identification document applicable to the country of residence
- Data necessary to receive payment, which varies by country: account identifier with the international payment service, bank account details or Pix key
- Date of birth
- Full address and telephone number
- Works submitted and their metadata
3.4 Technical data
IP address, browser and device type, pages accessed and access times, collected automatically for operation and security.
4. Why we process each item of data
| Purpose | Data | Legal basis |
|---|---|---|
| Create and maintain your account | Sign-up data | Performance of a contract |
| Process orders and deliver products | Order, customization | Performance of a contract |
| Pay out amounts to Sellers | Tax document, payment details, date of birth | Performance of a contract and legal obligation |
| Send transactional emails | Email, order data | Performance of a contract |
| Prevent fraud and abuse | Technical data, history | Legitimate interest |
| Comply with tax and accounting obligations | Transaction data | Legal obligation |
| Improve the platform | Aggregated usage data | Legitimate interest |
| Marketing communications | Consent, revocable at any time |
5. Data that is public
It is important that this is clear:
- Seller profile: name or store name, avatar, biography and published works are visible to any visitor.
- Reviews: the text of the review appears publicly next to the product, identified by the author's first name and the initial of the surname. We do not display the full legal name.
Never public: tax document, payment details, date of birth, address, telephone number, email and purchase history.
6. Who we share it with
We share only what is necessary, with providers acting as processors:
| Who | What for | Where it is |
|---|---|---|
| Stripe | Process payments and payouts | USA / Ireland |
| Wise | Payouts to Sellers in countries not served by the main processor | United Kingdom and European Union |
| Supabase | Database and file storage | United States (Ohio) |
| Cloudflare | Application hosting and delivery, and storage of the backup copies | Global |
| GitHub | Automated execution of the backup copies and of the restoration tests | Global |
| Resend | Sending transactional emails | USA |
| DeepL | Machine translation of product descriptions | EU |
| ConvertAPI | Conversion of the file to PDF | European Union |
| Railway | Color conversion of the file for printing | United States |
We may also share data when required by law, court order or a competent authority.
We do not sell personal data.
In this version Pikables sells digital products only: we do not collect a delivery address and no third party receives Buyer data for production or shipping purposes.
7. International transfer
The platform is operated from Canada and uses providers in different countries. By using Pikables, your data may be transferred and processed outside your country of residence, always with the safeguards required by applicable law.
8. How long we keep it
| Data | Period |
|---|---|
| Active account | For as long as the account exists |
| Transaction and tax data | 6 years after the transaction, a period that meets Canadian and Brazilian tax requirements |
| Seller payout data | 6 years after the last payment |
| Published works | While published, and after removal for the period necessary to serve purchases already made |
| Technical data and logs | 12 months |
| Photos sent by the Buyer | 24 hours, if not used in the cart; 90 days, if left in the cart without a purchase; for as long as the order exists, if used in an order |
| Backup copies | Kept for 30 days. Data deleted from the platform leaves the copies within 32 days; Buyer photos leave them the following day. |
| Copy of the previous system, with data up to August 17, 2026 | Until December 31, 2026 |
After the account is closed, we delete or anonymize the data, except what the law requires us to keep. The deletion also reaches the backup copies, within the periods above.
9. Your rights
At any time, you may:
- confirm whether we process your data and access it;
- correct incomplete or outdated data;
- request deletion of the data, subject to legal obligations;
- request portability;
- withdraw consent for marketing communications;
- object to processing based on legitimate interest;
- obtain information about who we share your data with.
To exercise any of these rights, write to support@pikables.com. We will respond within the period set by applicable law.
10. Security
We adopt technical measures to protect your data, among them:
- encrypted transmission (HTTPS) across the whole platform;
- passwords stored with a hashing algorithm, never in readable text;
- checking against public databases of leaked passwords at sign-up;
- role-based access control, with rules applied in the database layer itself;
- sensitive Seller data does not travel to the administrative interface by default: it is displayed only upon an explicit action, and each display is logged;
- daily backup copies, kept in a separate location, with restricted access and a monthly restoration test;
- logging of access to sensitive data.
No system is entirely immune. In the event of an incident that may entail material risk, we will notify the data subjects and the competent authorities as required by applicable law.
12. Minors
Pikables is not intended for persons under 18 and we do not intentionally collect data from children and adolescents. If we identify an account belonging to a minor, the account will be closed and the data deleted.
13. Changes to this policy
We may update this policy. Material changes will be communicated by email to all registered users, in addition to a notice on the platform. The version in force and the date of the last update appear at the top. This is Version 1.3.
In the event of succession or transfer of the operation to another company, the successor assumes the same obligations set out in this policy, and the change will be communicated through the same channel.
Prevailing language. This document was drafted in Portuguese. The English and Spanish versions are translations provided for ease of reading. In the event of any discrepancy between the versions, the Portuguese version prevails.
14. Contact
support@pikables.com, Marvy Brands Inc., North Vancouver, BC, Canada.