Privacy Policy

Cypress Oak Studios, LLC is an art studio based in Washington State offering fine art photography and paintings for viewing and purchase.

Privacy inquiries: hello@cypressoakstudios.com

Information you provide directly:

• Contact form — your name, email address, and message
• Purchase orders — your name, email address, and shipping address. Payment card details are processed entirely by Stripe and are never transmitted to or stored on our servers.
• Optional SMS order updates — if you actively opt in, your US mobile number plus the date, source, and disclosure version of your consent
• Internal staff alerts — an artist or designated staff member's name, mobile number, signature, consent date, and disclosure version

Information collected automatically:

• First-party analytics (where enabled) — on the Steve and Helen Sites, analytics may record page views, artwork views, homepage feature interactions, add-to-cart events, and checkout starts. Event records can include the page path or artwork, interaction timing, referrer host or utm_source, timestamp, and a random per-tab session ID. The server also creates rotating daily and monthly pseudonymous hashes from the IP address and browser user agent. Raw IP addresses and user-agent strings are not stored in the page_events table. When analytics is allowed and a purchase follows, the session ID and referral source may be attached to the checkout and order to measure sales attribution. These records produce aggregate Stats about visits and funnels.
• Google Analytics (where enabled) — when configured and allowed, Google Analytics 4, provided by Google, collects pages visited, visit timing, referring URLs, browser and device characteristics, and approximate location. We disable advertising signals and personalization; this analytics choice does not grant advertising storage or advertising-data use.
• Site search (where enabled) — on the Steve and Helen Sites, the words you type into search are sent to Google's Gemini API so we can suggest related pages and images. We send only your query and a fixed formatting prefix — no name, contact details, order information, or IP address. We keep a one-way hash of recent queries, not the words themselves, for up to 24 hours so repeated searches do not need a second request. A search address contains your words by design, so we keep it out of our analytics and error logs. To limit abuse, a salted hash of your IP address is kept for up to one day. We use Google's paid Gemini API services, under which Google states that it does not use submitted content or responses to improve its products, and that it may log them for a limited period solely to detect and prevent abuse. Separately, we use the Gemini API to describe the display versions of our published artwork images (never the original or print files) so they can be found by what they show.
• Coarse region decision — the Steve and Helen Sites use Vercel's country-level IP geolocation only to decide whether to show the initial analytics choice. Our region endpoint returns only a yes/no decision, and our application does not return or store the detected country for this purpose.

We use the information we collect to:

• Fulfill your orders and communicate about them
• Respond to contact form inquiries
• Send order confirmations and shipping updates
• Send transactional SMS order updates to customers who expressly opt in
• Send internal new-order alerts to artists and staff who separately opt in
• Analyze site traffic and improve the Sites
• Comply with applicable legal obligations

We do not sell, rent, or trade your personal information to third parties.

Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. We do not sell or rent mobile numbers or transfer SMS consent. We disclose mobile information only to service providers that help us operate the transactional messaging program, such as Twilio, or when required by law.

Message frequency varies. Customers typically receive 1–5 messages per order; opted-in artists or staff may receive up to one alert per paid order on the site they support. Message and data rates may apply. Reply STOP to opt out or HELP for help. See our Mobile Terms and SMS Consent page.

We rely on the following third-party providers, each of which may process your personal data as described:

The Steve and Helen Sites use one essential preference cookie, artist_analytics_consent, for up to 180 days to remember whether you accepted or rejected analytics. It contains only the choice, format version, and time of the choice. It remains present after rejection because its purpose is to honor that privacy instruction.

When first-party analytics is allowed, a random session ID and referral source are kept in sessionStorage for that browser tab and are cleared when the tab closes. Rejecting analytics prevents these entries from being created; withdrawing clears them. Separately, the functional shopping cart uses localStorage so selected items survive navigation and later visits. Rejecting analytics does not clear or disable the cart.

Where Google Analytics is configured, its _ga cookies are created only after analytics is allowed. Visitors in the EEA, United Kingdom, and Switzerland are asked before analytics starts; an unknown region also requires a choice. Elsewhere analytics may start without an initial banner, but an explicit rejection is honored everywhere. On the Steve and Helen Sites, use Analytics settingsin the footer at any time to accept, reject, or withdraw. Withdrawal disables analytics, clears accessible analytics cookies and session storage, and leaves the cart intact.

The Google Analytics Opt-out Browser Add-on is an additional browser-level option.

We use reasonable technical and organizational safeguards to protect your data, including HTTPS encryption, access controls, and reputable cloud providers. No method of internet transmission is 100% secure, and we cannot guarantee absolute security.

• Order records — retained for as long as reasonably necessary for business and legal purposes
• Contact form messages — forwarded to our email inbox; not stored in a separate database
• SMS consent records — retained while you participate in the program and afterward as reasonably necessary to document consent and opt-out requests
• First-party analytics — pseudonymous raw event and session records are retained for 45 days to support the current-month and trailing-30-day aggregate Stats described above
• Site-search query records — a one-way hash of the query and its numeric embedding, retained for 24 hours; the words you typed are not stored
• Google Analytics data (where enabled) — retained for two months at the event level, the shortest standard property setting used for the documented measurement purpose

EU and UK residents (GDPR)

You have the right to:

• Access — request a copy of data we hold about you
• Rectification — request correction of inaccurate data
• Erasure — request deletion of your data
• Portability — receive your data in a machine-readable format
• Objection — object to processing based on our legitimate interests

To exercise any of these rights, email hello@cypressoakstudios.com. We will respond within 30 days.

You may withdraw analytics consent or object to optional analytics at any time through Analytics settings in the Steve and Helen Site footers.

Washington State and California residents may have additional rights under applicable state privacy laws. Contact us for more information.

Our Sites are not directed to children under 13. We do not knowingly collect personal information from children. If you believe we have inadvertently done so, please contact us and we will promptly delete it.

We may update this Privacy Policy from time to time. The effective date at the top of this page will reflect any changes.

Cypress Oak Studios, LLC
Washington, USA
hello@cypressoakstudios.com