Privacy

The contact form asks for your name, your email address, a subject and a message. It goes straight to my mailbox as an email, with your address as the reply-to, so I can answer.

Most messages are not saved on this site at all: the email in the studio mailbox is the only copy. The exception is a message about a commission, or about a particular work — one sent from a work’s page, or with “commission” in the subject or the message. That one is also filed in the studio’s enquiries inbox, in this site’s database, so it can be answered from there; the next section says what that inbox keeps. If email sending has not been switched on, the form drafts the message in your own mail app instead, and apart from that filing this site never sees it at all.

There is one hidden field on the form that you will never see. It catches automated spam. If it is filled in, the message is discarded.

The form on the commissions page asks for your name, your email address and what you have in mind, and lets you add a size, a budget and a timing if you want to; when you arrive from a work’s page, it notes which work. All of it is stored in this site’s database as a request, with the time it arrived, and emailed to me as well, so there are two copies: one in the studio inbox and one in my mailbox. Nothing is emailed to you automatically.

The request is the start of a thread. When I answer from the studio, the reply goes to your address by email and a copy stays in the thread, along with whether the email service accepted it. If you write back, that reaches my mailbox like any other email, and I may paste it into the thread so the conversation is in one place. Any notes I make for myself about a request are kept with it and are never sent to you or to anyone else.

A message sent through the contact form is filed in the same inbox when it is about a commission or about a particular work, as the previous section says. How long a request is kept is under “How long things are kept”; ask and I will delete it sooner.

Payment goes through Stripe’s own hosted checkout page. Your card details are typed on Stripe’s page, not this one, and never touch this site or its server.

This site sends Stripe: the email address you typed at checkout, the prints you chose with their sizes and prices, the shipping rate for your country, and a short list of the items so that the confirmation emails can name them. Stripe then collects your name, your delivery address, your billing address and your payment details, and tells this site the order completed.

When a payment completes, the order is stored here: the prints and sizes, the totals, the delivery address Stripe collected, your email address, and the time it arrived. As it is made and posted, the same record gains its progress, the parcel’s tracking details, any note I make about it for myself, and whether you were emailed that it had shipped. It is kept so an order cannot be lost if an email fails to send, and so it can be made and posted without opening Stripe. Card details are never stored, and this site never sees them — Stripe handles the payment on its own pages.

Stripe also sends you its own receipt, and may use what it collects to detect fraud. That part is Stripe’s, under Stripe’s privacy policy.

The sign-up form — in the footer, on a work’s page, after a purchase and at /subscribe — asks for an email address and nothing else. It is stored in the database as a pending entry, with where you signed up from, and a confirmation email is sent to it. Nothing is sent to that address again unless you open the link in that email; an address that is never confirmed is never written to.

Every email from the list carries a link that takes you off it in one click, with no login, and the same link is in the message’s headers so your mail app can offer its own Unsubscribe button. Unsubscribing keeps the address on file marked as unsubscribed, so it is never re-added by mistake; to have it deleted altogether, write to the address at the end of this page.

The list records which campaigns each address was sent, and whether the delivery service accepted each one. It does not record whether an email was opened or which links were clicked: there are no tracking pixels and no rewritten links. Resend, which delivers the emails, may also hold a copy of the address if the list is mirrored to it; that copy is removed when the address is removed here.

The cart is kept in your own browser, not on a server. So are the 3D gallery’s quality setting and a note of the last order the cart was emptied for. None of it is sent anywhere, and none of it identifies you. The cookies page lists every key by name.

Original works leave the studio with an NFC tag. Tapping it opens a page that checks the tag is genuine.

That check records one thing: the tag’s own serial number and the highest tap count it has ever shown, with the time it was last seen. That is what stops a copied link being passed off as a tap. It says nothing about who tapped it, where they were, or what phone they used — no address, no account, no location.

Every page outside the studio sends a note of the page you opened to PostHog, an analytics service, by way of this site’s own address. The note carries the page’s path, the address of the page that linked here, your browser and operating system by family and version, your screen size and language, and a random number made up when the page loaded so that the pages of one visit hang together. Nothing is written to your browser to do this — no cookie, no local storage, no fingerprint — so when you come back you are a stranger, and there is no way to follow you to another site.

A few moments are noted by name as well: opening a work’s page, entering the 3D gallery and stepping up to a work in it, adding a print to the cart, starting checkout, an order being paid, a tag verifying, a completed sign-up to the mailing list, a commission request arriving, and a mailing going out to the list. Each carries the work or print it was about and the amounts involved — for a commission request only which page it came from, which work it was about and whether a budget or a timing was mentioned; for a mailing only how many addresses it went to — and never a name, an email address, a postal address or anything you typed. What you type into a form is not captured at all. An order being paid, a commission request and a mailing are noted from this site’s server rather than from your browser, each under a fresh random number, with no location lookup at all.

Your IP address reaches PostHog with each note, as it reaches any server. PostHog uses it to work out roughly where in the world the visit came from — country, region and city — and then discards it; the project is set so that the address itself is not kept.

If your browser sends the Do Not Track or Global Privacy Control signal, none of this runs. The studio pages are never measured. A page’s address is sent without anything after the question mark, so a verification code, a confirmation link or an order reference in the address never leaves your browser.

PostHog, Inc. holds this data on this site’s behalf, on its servers in the United States, under its own terms and privacy policy. It is not shared with anyone else and is not used for advertising.

The site is built to report crashes to Sentry, an error-reporting service, but only once a key for it is set on the server; until then nothing is sent anywhere. When it is on, a report holds the error, the page it happened on, the browser version and the last few things the page itself did — not your IP address, and nothing you typed.

I edit this site through a page only I can reach, and I sign in to it with a passkey. The database holds the public half of that passkey, a name for the device, and when it was last used. The private half never leaves my phone or laptop.

Signing in sets a cookie that names the passkey and expires after fourteen days. It only applies to the studio pages. If you are reading this, you do not have one.

The site runs on Vercel, which keeps the ordinary access logs any web server keeps: the address you requested, roughly when, your browser’s user-agent string and your IP address. Vercel keeps those for a limited period under the hosting plan and then deletes them; they are not copied anywhere else and I do not analyse them.

The site writes a handful of its own lines to those logs — that an order arrived, or that an email failed to send. Where email sending is switched off entirely, an order summary is written to the log instead of emailed, because it is better than losing it. No card details are ever logged, by design.

To stop the contact form, the commission form, the mailing-list sign-up and its confirmation links, and the checkout being flooded, this site counts recent requests from each internet address. That count, and the address, sit in the database for at most a day and are then deleted. It is used for nothing else — not for analytics, not for recognising you on a later visit.

Six companies are involved in running this site, and a seventh, Sentry, only once error reporting is switched on. None of them is paid to advertise to you.

Stripe, Inc. takes the payment and holds its own record of the order, including your delivery address. Resend delivers the emails this site sends — the contact form’s message, the order confirmations and the note that a parcel has shipped, my replies to commission requests, and the mailing list’s confirmations and campaigns. Supabase hosts the database and the image storage: the catalogue, the tag registry, the tap counters, my passkey, the site’s own wording, and everything the sections above say is stored — the orders, the commission requests with their threads, and the mailing list. Vercel hosts and serves the site. Cloudflare answers the DNS lookups for sunurai.com. PostHog, Inc. counts the visits, as described above.

Supabase, Inc. holds that database on this site’s behalf, under its own terms, and nobody but this site’s own server can read the orders, the requests or the list: those tables are closed to anything that is not the site itself. Fonts are served from this site’s own address; nothing is fetched from Google.

Messages stay in the studio mailbox until I delete them. Order emails stay there too. Stripe keeps its own record of a payment for as long as its terms and the law require.

An address on the mailing list stays until it is deleted: unsubscribing marks it rather than removing it, so it is not re-added by mistake, and a pending address that is never confirmed is never written to. Write and it is deleted outright, here and from the delivery service’s copy.

The tap counters are kept indefinitely on purpose: they only stop a replayed link if they are never forgotten. They hold no personal data.

The visit notes stay in PostHog until I delete them there. They hold nothing that identifies you, so there is nothing in them to ask for or to remove.

Not yet written: [TO FILL IN: how long you keep orders and enquiries. This now covers the stored order rows, not only the emails, so say a period you will actually keep to. The usual answer is the tax-record period, because that is what the row is for: “Order records are kept for seven years, which is what the tax rules here require. Enquiries are deleted after two years.”]

Write to the address at the end of this page and say what you want. I will find everything I hold about you and either send it to you or delete it.

Two things I cannot delete on request. Stripe’s record of a payment is Stripe’s and is kept for as long as accounting and anti-fraud rules require; you can ask Stripe directly. And an email you sent me is also a record of a conversation — I will delete my copy, but I cannot unsend it.

There is no account to close, because this site has no accounts.

If this page changes in a way that matters, the date at the top changes with it. The mailing list is for news from the studio, not for notices, so a change here is not emailed out: the date is the record, and this page is the place to check.