Privacy Policy
Last updated: 12 October 2026
This policy explains what personal information Carbonography collects when you use our website and order a print, why we need it, who we share it with, and the rights you have.
1. Who we are
This website is run by CitiIT Limited, trading as Carbonography (“we”, “us”, “our”). Registered in England and Wales, company number 15811174. Registered office: C/O Sg Accounting, 1 Cedar Office Park, Cobham Road, Wimborne, BH21 7SB, United Kingdom.
Email: david@dpaul.studio · VAT number: GB 473 5892 49
We are the data controller for the personal information described here. ICO registration number: ZC267323.
2. What we collect
- Contact details — your name, email address, phone number (optional) and delivery address.
- Your vehicle — the photos you upload, the registration number, make, model, year and colour, and the choices you make for your print.
- Order details — what you ordered, proofs we send you, your messages to us, and whether you agreed to our terms and to being shown in our gallery.
- Payment details — handled by Stripe. We receive confirmation of payment and limited details such as the card type and last four digits, never your full card number.
- Technical information — when you visit, our website host and font provider receive your IP address and browser details, as any website does. Our own site stores a small amount of information in your browser (see our Cookie Policy).
Photos can sometimes show people, places or other vehicles in the background. Please avoid sending photos where people can be identified. We only use the vehicle itself.
3. How we use it, and our lawful basis
| What we do | Lawful basis (UK GDPR) |
|---|---|
| Create your proof and artwork, take payment, print and deliver your order, and handle questions, changes and returns | Contract — we need it to provide what you ordered |
| Look up your vehicle’s details from its registration number | Contract, and our legitimate interest in getting your vehicle right |
| Keep financial and order records | Legal obligation (tax and accounting rules) |
| Prevent fraud and keep our website secure | Legitimate interests |
| Show your finished print in our gallery or on social media | Consent — only if you tick the box, and you can withdraw it at any time |
| Send you news or offers | Consent — we will only do this if you have opted in |
We do not sell your personal information, and we do not use it for automated decisions that have legal or similarly significant effects on you.
4. Who we share it with
We only share what each provider needs to do its job, and they may only use it on our instructions:
- Stripe — to take payments and prevent fraud.
- Supabase — stores your sign-in, orders, uploaded photos and, if you join it, our mailing list.
- AI image services (currently Google (Gemini API)) — your vehicle photos and description are sent to create the artwork. We use paid business services under terms that do not allow your images to be used to train their models.
- Vehicle data services (the DVSA MOT History API) — the registration number, to look up the make, model and year.
- Print and frame suppliers and couriers (currently Gelato) — your name, delivery address and the artwork, to produce and deliver your order.
- Email and form providers (our email provider) — to receive your order and correspond with you.
- Website hosting (GitHub Pages) and Google Fonts — which receive technical information when you visit.
We may also share information if the law requires it, or to protect our rights.
5. International transfers
Some of our providers, such as Stripe, Google and GitHub, may process information outside the UK, including in the United States. Where they do, the transfer is protected by UK-approved safeguards such as the UK–US Data Bridge or the International Data Transfer Addendum to standard contractual clauses.
6. How long we keep it
- Your photos — deleted 90 days after your order is delivered, unless you ask us to keep them for a future order.
- Your finished artwork — kept for 2 years so we can reprint it if you ask, unless you ask us to delete it sooner. If you gave gallery permission, kept until you withdraw it.
- Order and payment records — 6 years after the end of the tax year, as required by law.
- Mailing list — your email address and when you signed up, kept until you unsubscribe. After that we keep only a record that you opted out, so we don’t email you again.
- Orders you don’t go ahead with — deleted after 6 months.
7. Security
Our website is served over an encrypted connection, payments are handled by Stripe, and access to your information is limited to people who need it to fulfil your order.
8. Your rights
Under UK data protection law you have the right to:
- ask for a copy of the information we hold about you;
- ask us to correct or delete it;
- ask us to limit how we use it, or object to us using it;
- ask for it to be transferred to another organisation;
- withdraw your consent at any time, where we rely on consent.
To use any of these rights, email david@dpaul.studio. We will reply within one month. If you are unhappy with how we have handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113 — but we would appreciate the chance to put things right first.
9. Children
Our service is for people aged 18 and over. We do not knowingly collect information from children.
10. Changes to this policy
We will update this page if anything changes, and tell you directly if a change significantly affects you.