Privacy notice

This notice explains, in general terms, what personal data we handle when you visit this site or place an order, the legal bases on which we do so, and the rights you have over your data. It does not create any contractual obligation beyond what is required by applicable data-protection law.

主Who we are

The data controller is NLM — Nobody Look At Me (“NLM”, “we”). For questions about this notice or to exercise your rights, see the Contact section below. If you have an active order, the most reliable channel is to reply directly to your order confirmation email — that thread already carries the order context.

記Data we collect

You give us at checkout: name, email address, phone number, shipping address and billing address. Checkout is hosted by Stripe, which collects these on our behalf.
You give us otherwise: your email address when you look up an order at Orders, messages you send through the contact form, and replies to our emails.
We create: your order history — items, sizes, prices, order status, and the tracking details our print partner reports.
Automatic: IP address, browser and device characteristics, referring URL, pages viewed, approximate location derived from IP, and cookie or similar identifiers.
From payment and fraud-prevention providers: confirmation that the charge succeeded, the last four digits and brand of the card, and risk-scoring signals. We do not see or store full card numbers.

You are responsible for ensuring that the data you provide is accurate and up to date. We are not responsible for the consequences of inaccurate or out-of-date information you submit.

用Why we use it

To process orders, payments, and shipping
To send transactional emails — order confirmation, dispatch and tracking, and one-time codes for looking up your orders
To handle returns, refunds, and customer support
To prevent and detect fraud, abuse and security incidents
To comply with tax, accounting, consumer-protection and other legal obligations
To operate, secure, maintain and improve the site and our services
With your consent, to measure how the site is used and to show relevant marketing

法Legal bases (GDPR / UK GDPR)

Performance of a contract (Art. 6(1)(b)) — for orders, shipping, returns and customer support.
Legal obligation (Art. 6(1)(c)) — for tax records, fraud prevention and consumer-protection records.
Legitimate interests (Art. 6(1)(f)) — for site security, abuse prevention, IT operations, and aggregated business analytics that do not require cookies. You may object on grounds relating to your particular situation.
Consent (Art. 6(1)(a)) — for analytics cookies, advertising cookies, and optional marketing emails. You can withdraw consent at any time without affecting prior processing.

We share personal data only with categories of recipients needed to operate the store. The list of specific providers may change from time to time without notice; the categories below remain stable.

E-commerce, hosting and infrastructure providers — to host the site, process checkout, and serve content.
Payment service providers and fraud-prevention partners — to authorise and settle payments and to screen for fraud.
Print and fulfilment partners — your name, shipping address, email address and phone number, to produce your order and hand it to the carrier.
Carriers and customs brokers — to deliver the parcel and to clear customs where applicable.
Email and contact-form providers — to send transactional email and to receive messages sent through the contact form.
Analytics, tag-management and (where applicable) advertising partners — only where you have given the relevant cookie consent.
Professional advisers, auditors and authorities — where reasonably required, or to comply with legal obligations or protect our rights.

At the time of writing, the main providers are Stripe (payments and checkout), Printify and its print partners (production and shipping), Vercel (hosting), Neon (database), Resend (email), HubSpot (contact form) and Google (analytics, only as described under Cookies below). We do not sell personal data for monetary consideration. An up-to-date list can be requested via the Contact section.

越International transfers

The studio is in Japan, and most of our providers — including payment, hosting, email and print partners — process data in the United States. Your data may therefore be handled outside your own country, including outside the EEA / UK. Where this is the case, we rely on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum or Addendum, a valid adequacy decision (e.g. the EU–US Data Privacy Framework where the recipient is self-certified), or another lawful transfer mechanism. Copies of the safeguards are available on request.

期Retention

We keep personal data only for as long as is necessary for the purposes set out in this notice and to comply with our legal, accounting and reporting obligations. The criteria we use are:

Order records: for the period required by tax, accounting and consumer-protection law in our jurisdiction (typically up to 10 years).
Analytics: aggregated and pseudonymised data is retained for as long as is reasonably useful for analysis, subject to the limits of the analytics provider.
Support correspondence: for a reasonable period from last contact, to handle related queries and to defend potential claims.
Fraud-prevention records: for a reasonable period to prevent recurrence.

守Security

We use technical and organisational measures intended to protect personal data against unauthorised access, loss, misuse and alteration, including transport encryption (TLS) and access controls. However, no system is perfectly secure. You acknowledge that you transmit data to us at your own risk and you are responsible for keeping any password or access credentials confidential.

追Cookies & tracking

Analytics tags are blocked by default and load only after you choose “Accept all” in the cookie banner. You can change your choice at any time via “Cookie preferences” in the footer.

Strictly necessary — your basket and your cookie choice (kept in your browser’s local storage), a short-lived sign-in cookie when you look up your orders (expires after 30 minutes), and the cookies Stripe sets on its checkout page. These cannot be turned off.
Analytics — Google Tag Manager and Google Analytics, to understand which pages and products work. Loaded only with consent, and we honour Google Consent Mode v2.
Performance — Vercel Speed Insights measures page-load speed without cookies and without identifying you.
Contact form — the form on the Contact page is provided by HubSpot, which may set its own cookies when that page loads.
Advertising — none. If we add advertising tags in future, they will be gated behind the same banner and listed here first.

When an order is paid, our server also records the purchase in Google Analytics — order number, items and value, with no name, email or address — so we can count sales accurately. It is not linked to your browser or device.

権Your rights (GDPR / UK GDPR)

Access — get a copy of your personal data
Rectification — correct inaccurate data
Erasure — request deletion (“right to be forgotten”)
Restriction — limit processing in specific cases
Portability — receive your data in a structured, machine-readable format
Objection — to processing based on legitimate interests, including profiling
Withdraw consent — at any time, without affecting prior processing
Lodge a complaint with your supervisory authority (in the EU, your national DPA; in the UK, the ICO at ico.org.uk)

To exercise any right, see the Contact section. We respond within the period required by applicable law (one month under GDPR, extendable by two further months where requests are complex or numerous). We may need to verify your identity before acting on a request, and we may decline manifestly unfounded or excessive requests as permitted by law.

加California (CCPA / CPRA)

If you are a California resident, you have the right to know what personal information we collect, to request deletion, to correct inaccurate information, and to opt out of the “sale” or “sharing” of personal information for cross-context behavioural advertising. We do not sell personal information for money. To opt out of any sharing for advertising purposes, set your cookie banner to “Necessary only” or send a Global Privacy Control signal — we honour it where supported. We do not discriminate against you for exercising any CCPA right.

幼Children

The site is not directed at children under the age of majority in their country of residence and we do not knowingly collect personal data from them. If you believe a minor has provided us with personal data without parental consent, please contact us and we will delete it.

外Third-party sites

The site may link to or embed content from third-party sites or services. Their data practices are governed by their own privacy notices. We are not responsible for, and make no representations about, the content, privacy practices or security of any third-party site or service.

改Updates to this notice

We may update this notice from time to time to reflect changes in our processing, our service providers, or applicable law. The version in force is the one published on this page. Where a change is material, we will use reasonable efforts to highlight it at the top of the page or notify you by other appropriate means.

問Contact

For privacy-related requests, use the contact form, which reaches the studio inbox. If you have an order with us, replying to your order confirmation email is faster, as it already carries the order context.

Last updated: September 2026.