Privacy policy
Last updated: September 23, 2026
GridNook is a trade name used by NECULA-ȘELARU FLORINA-ALEXANDRA ÎNTREPRINDERE INDIVIDUALĂ ("GridNook", "we", "us", or "our").
This Privacy Policy explains how we collect, use, disclose, store, and otherwise process personal information when you visit gridnookshop.com, use our Services, purchase our products, create a personalized product, upload photos, or otherwise communicate with us.
Our online store is powered by Shopify. We also use service providers to operate parts of our Services, including the infrastructure used to create and deliver personalized products.
Please read this Privacy Policy carefully. By using our Services, you acknowledge that you have read this Privacy Policy.
1. PERSONAL INFORMATION WE COLLECT
The information we collect depends on how you interact with GridNook.
We may collect the following categories of personal information:
Contact information
This may include your name, email address, billing address, phone number, and other contact information you provide.
Order and transaction information
This may include products purchased, selected package, personalization information, order status, payment confirmation, transaction details, and information relating to cancellations, refunds, or customer support.
Payment information
Payments are processed through Shopify and applicable payment providers.
Depending on the payment method you use, payment providers may process payment card, bank, billing, or other financial information.
GridNook does not need to directly receive or store your complete payment card number in order to process your Shopify order.
Personalization information
When you purchase a personalized product, we may collect information necessary to create it, such as names, dates, event information, selected designs, package selections, and other personalization details you provide.
Customer-uploaded photos
Custom Photo Bingo requires you to provide 24 photos.
These photographs may contain personal information about you or other people depicted in them, including children.
We process these photos for the purpose of creating, reviewing, correcting where necessary, and delivering the personalized product you ordered.
Communications
We collect information you provide when you contact us, including customer support messages and information relating to an order or request.
Device and usage information
When you use our website or Services, certain technical information may be collected automatically, such as your IP address, browser, device information, network information, and information about how you interact with the website.
Cookies and similar technologies may also be used as described through our website's privacy and cookie controls.
2. HOW WE COLLECT PERSONAL INFORMATION
We may collect personal information:
- directly from you when you place an order, upload photos, personalize a product, contact us, or otherwise provide information to us;
- automatically when you visit or interact with our website;
- from Shopify and payment providers in connection with your order;
- from service providers that process information on our behalf; and
- from other sources where permitted by applicable law.
3. HOW WE USE PERSONAL INFORMATION
We may use personal information to:
- provide and operate our Services;
- process and manage orders and payments;
- create personalized products;
- process customer-uploaded photos and personalization information;
- generate, review, correct, and deliver Custom Photo Bingo orders;
- provide customer support;
- communicate with you about your order;
- process cancellations, refunds, or other remedies;
- maintain and secure our website and Services;
- prevent fraud, misuse, and security incidents;
- comply with legal, accounting, tax, and regulatory obligations;
- establish, exercise, or defend legal claims; and
- improve our Services where permitted by applicable law.
Where required by applicable law, we rely on an appropriate legal basis for processing personal information, including performance of a contract, compliance with legal obligations, legitimate interests, or consent, depending on the circumstances.
4. CUSTOMER-UPLOADED PHOTOS
Custom Photo Bingo allows customers to upload 24 photos to create a personalized game.
These photos are used to provide the personalized product you requested.
We may process uploaded photos as reasonably necessary to:
- receive and securely store the uploads;
- prepare your personalized Bingo game;
- generate the required game files;
- review the generated product for quality and accuracy;
- correct problems with the order;
- deliver the completed product; and
- provide customer support relating to the order.
Your uploaded photos are not sold by GridNook.
We do not use customer-uploaded photos for advertising or marketing without separate permission.
We do not publish customer-uploaded photos or make them publicly available as part of providing the Custom Photo Bingo service.
Uploaded photos are stored using access-controlled infrastructure and are intended to be accessible only as necessary to provide and support the relevant order.
5. PHOTO RETENTION AND DELETION
Customer-uploaded photos used for Custom Photo Bingo are retained for up to 30 days after delivery of the completed personalized order.
This limited retention period allows us to investigate and correct problems reported shortly after delivery without requiring you to upload all of your photos again.
After this period, the uploaded source photos are scheduled for deletion from our active storage unless we are required to retain particular information for a longer period by law or because it is reasonably necessary to establish, exercise, or defend a legal claim.
Photos uploaded as part of a personalization that is not completed may also be removed after the personalization session expires.
Other information relating to the transaction, such as order records, invoices, payment records, consent records, delivery records, and legally required business records, may need to be retained for longer periods.
If you request deletion of your photos before the normal deletion date, we will consider and process your request in accordance with applicable law. If your personalized order has not yet been completed, deleting the photos may prevent us from completing the product you purchased.
6. PHOTOS OF CHILDREN AND OTHER PEOPLE
Our Services are intended to be purchased and used by adults or by persons legally able to enter into the relevant transaction.
A customer purchasing a personalized product may choose to provide a photograph containing a child or another person.
If you upload a photo containing another person, including a child, you confirm that you have the rights, authority, or permission necessary to provide that photo to us for the purpose of creating your personalized product.
We process such photographs only as described in this Privacy Policy.
Our Services are not directed at children for the purpose of independently creating accounts, making purchases, or submitting their own personal information.
If you believe a child has provided personal information to us without appropriate authorization, please contact us so that we can investigate and take appropriate action.
7. HOW WE DISCLOSE PERSONAL INFORMATION
We may disclose personal information where reasonably necessary to operate the Services, fulfill orders, comply with law, or protect our rights.
This may include disclosure to:
- Shopify, which hosts and supports our ecommerce store;
- payment providers that process transactions;
- cloud hosting and storage providers used to operate the personalized product service;
- security, fraud-prevention, and technical service providers;
- customer support or communications providers where applicable;
- professional advisers where reasonably necessary; and
- government authorities or other parties where disclosure is required by law or valid legal process.
Service providers may process personal information only as necessary to provide their services to us and subject to applicable contractual and legal requirements.
We may also disclose information in connection with a legitimate business transaction, such as a sale or restructuring of the business, subject to applicable law.
8. RELATIONSHIP WITH SHOPIFY
Our online store is hosted by Shopify.
Shopify collects and processes personal information relating to your access to and use of our store in order to provide its services.
Information you submit through the Shopify portion of our Services may be transmitted to Shopify and other service providers used to operate the ecommerce platform.
Shopify may also process certain information for its own purposes as described in Shopify's applicable privacy notices.
You can learn more about Shopify's privacy practices through the Shopify Consumer Privacy Policy and Shopify Privacy Portal.
9. COOKIES, MARKETING, AND ADVERTISING
Our website and Shopify may use cookies and similar technologies for purposes such as operating the website, remembering preferences, measuring performance, maintaining security, and, where permitted, advertising or marketing.
Depending on where you live, you may have choices regarding non-essential cookies, targeted advertising, or certain uses or disclosures of your information.
Where required by law, we will request consent before using non-essential technologies that require consent.
Available privacy choices may be presented through our website's privacy controls.
If you subscribe to marketing communications, you may unsubscribe using the link provided in those communications.
We may still send non-promotional communications that are necessary for an order or customer service request.
10. THIRD-PARTY WEBSITES AND SERVICES
Our Services may contain links to websites or services operated by third parties.
Those third parties have their own privacy practices and policies. We are not responsible for the privacy or security practices of third-party services outside our control.
11. SECURITY
We use reasonable administrative and technical measures designed to protect personal information.
Customer-uploaded photos used for personalized products are stored using access-controlled infrastructure rather than intentionally being made publicly available.
However, no method of electronic transmission or storage can be guaranteed to be completely secure.
If we become aware of a personal data breach, we will take the steps required by applicable law.
12. RETENTION OF OTHER PERSONAL INFORMATION
In addition to the specific 30-day photo retention period described above, we retain other personal information only for as long as reasonably necessary for the purposes for which it was collected and as required by applicable law.
Factors affecting retention may include the need to:
- provide our Services;
- maintain transaction and accounting records;
- comply with tax or other legal requirements;
- resolve disputes;
- prevent fraud; and
- establish, exercise, or defend legal claims.
13. INTERNATIONAL DATA TRANSFERS
Some of our service providers may process personal information in countries other than the country where you live.
Where personal information protected by European data protection law is transferred outside the European Economic Area, we rely on an applicable lawful transfer mechanism where required, such as an adequacy decision, Standard Contractual Clauses, or another legally recognized safeguard.
14. YOUR PRIVACY RIGHTS
Depending on where you live and subject to applicable exceptions, you may have rights regarding your personal information.
These may include the right to:
- request access to personal information we hold about you;
- request correction of inaccurate personal information;
- request deletion of personal information;
- request restriction of certain processing;
- object to certain processing;
- receive certain personal information in a portable format;
- withdraw consent where processing is based on consent; and
- opt out of certain targeted advertising, sale, or sharing practices where applicable.
Withdrawing consent does not affect the lawfulness of processing that occurred before the withdrawal.
We may need to verify your identity before responding to certain requests.
We will respond to valid requests within the time required by applicable law.
15. EUROPEAN ECONOMIC AREA AND UNITED KINGDOM
If you are located in the European Economic Area or United Kingdom, you may have additional rights under applicable data protection law.
You may also have the right to lodge a complaint with the data protection authority responsible for your location.
You may contact us first if you have concerns about how your personal information is handled so that we have an opportunity to address them.
16. UNITED STATES PRIVACY RIGHTS
Residents of certain U.S. states may have additional privacy rights under applicable state law, including rights relating to access, deletion, correction, portability, and certain forms of targeted advertising, sale, or sharing of personal information.
Where such rights apply, available mechanisms for exercising them may be provided through our website or by contacting us.
17. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time to reflect changes to our Services, technology, business practices, or legal obligations.
When we update this Privacy Policy, we will update the "Last updated" date and provide any additional notice required by applicable law.
18. CONTACT US
For questions about this Privacy Policy, our privacy practices, or your personal information, or to exercise an applicable privacy right, please contact:
GridNook
Legal business name:
NECULA-ȘELARU FLORINA-ALEXANDRA ÎNTREPRINDERE INDIVIDUALĂ
Email:
info@gridnookshop.com
Registered address:
Somiului Nr 8, 607690 Zemeș, Bacău, Romania
Trade Register Number:
F4/1000/2015
Unique Registration Code (CUI):
34893821
For the purposes of applicable data protection law, NECULA-ȘELARU FLORINA-ALEXANDRA ÎNTREPRINDERE INDIVIDUALĂ is the controller of personal information processed by GridNook, except where another party, such as Shopify, acts as an independent controller for its own processing activities.