Privacy policy

This policy explains how we handle personal data sent through this website.

1. Who we are

The data controller is PAINT ME OÜ (registry code 14524356, VAT number EE102378575), an Estonian company trading as Shapes Vision. You can contact us at hello@shapesvision.com or +372 5806 2555.

2. What we collect and why

Enquiries. When you use the contact form or email us, we receive your name, email address, company name if you give it, your message and any files you attach. We use this to reply and to prepare a quote. We do this because you asked us to, before any contract. If you write on behalf of a company, we do it because we have a legitimate interest in answering business enquiries.

Clients. If you order a project, we use your contact and project details to deliver it under our contract with you. We keep invoices because accounting law requires it.

Website visits. Our hosting provider records technical data for each request, such as IP address, browser type, the page requested and the time. We need this to deliver the website and protect it from abuse. This is our legitimate interest in running a secure website.

You do not have to give us your data, but we cannot reply without your name, email address and message. We do not make decisions about you by automated means alone.

3. Cookies, analytics and advertising

With your consent, we use Google Analytics 4 and Google Ads, provided by Google Ireland Limited. Their cookies tell us how visitors find and use the website, measure which ads lead to enquiries, and let us show our ads to people who have visited the site. Google may combine this data with what it already knows about you, under its own privacy policy.

Nothing of this runs until you accept it in the cookie banner. You can refuse, and the website works the same. You can change or withdraw your consent at any time in the cookie settings, linked at the bottom of every page, which also list the cookies and how long they last.

4. How long we keep it

• Enquiries that do not lead to a project: 12 months after our last contact.
• Project correspondence: for the project and up to 3 years after it ends, in case of claims.
• Invoices and accounting records: 7 years, as required by the Estonian Accounting Act.
• Form submissions stored by Netlify: deleted when we no longer need them there.
• Hosting logs: kept by Netlify for a limited period.
• Analytics data: up to 14 months in Google Analytics. Analytics cookies: up to 2 years.
• Advertising cookies: up to 90 days.

5. Who receives it

We do not sell personal data. We share it only with service providers that process it on our behalf: our website host and form provider (Netlify, Inc.), our email provider, our accountant, and, if you consent, Google for analytics and advertising. We may also disclose data when the law requires it.

6. Transfers outside the EU

Netlify is based in the United States, and Google and our email provider may also process data there. Netlify and Google are certified under the EU-US Data Privacy Framework, which the European Commission has found to give adequate protection. Where a provider is not certified, we rely on the European Commission's Standard Contractual Clauses. Email us for a copy of these safeguards.

7. Your rights

You can ask us to give you access to your data, correct it, delete it, restrict its use or send it to you in a portable format. You can also object to any use based on our legitimate interest. To do so, email hello@shapesvision.com.

You can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or to the supervisory authority in the EU country where you live or work.

8. Changes

We update this policy when our practices change. The date at the top shows the current version.