Privacy Policy

The short version

We collect only what we need to make and ship your order. We do not sell your data. We do not run creepy ad trackers. We are one person with a crochet hook, not a data company.

If you wrote to a business through aarttsii desk or Cookie, the part about that starts at aarttsii desk and Cookie.

What we collect

When you order or commission something, we collect your name, email or Instagram handle, and shipping address. Payment is handled securely through our payment processor. We never see or store your card details.

When you use the commission estimator, the image you upload is analysed to generate a price estimate. If you share an estimate, the image and data are stored temporarily (up to 15 days) and then automatically wiped. Gone. Poof.

How we use it

Your info is used to fulfil your order, talk to you about your commission, and send tracking updates. That is literally it. No surprise newsletters. No "you might also like" emails at 3am. If you leave the "new pieces" box ticked when you order or commission, we will email you now and then when something new is out. Reply "stop" and that ends it.

Cookies & local storage

We use your browser's local storage to remember your cart and wishlist. No third party cookies. No tracking pixels. Nobody is following you around the internet because of us.

Data retention

Order records are kept for accounting and support. Shared estimate images auto delete after 15 days. If you want your data removed entirely, email us and consider it done.

Your rights

You can ask what data we have, request corrections, or ask us to delete everything. Email aarti@aarttsii.com and we will get back to you. Response time depends on commission workload and chai availability.

aarttsii desk and Cookie

aarttsii also runs aarttsii desk. Small businesses use it to answer the people who message them on WhatsApp, Instagram and email, send quotes, take orders and get paid. Cookie is the desk's assistant. It answers those messages for the business.

Two kinds of people meet the desk. Businesses sign up and connect their own WhatsApp number, Instagram professional account or email inbox. Their buyers are the people who write to those accounts. For buyers' messages, the business decides what happens to them, and we process them on its behalf.

What the desk collects

• From a business: the owner's and team's names and phone numbers, the business profile they enter (legal name, address, tax numbers, logo) and the accounts they connect.
• From a connected Instagram account: the account's ID and username, an access token, and the DMs people send it, with their Instagram-scoped ID, the text and any attachments.
• From a connected WhatsApp number: messages sent to it, the sender's phone number and profile name, and delivery and read receipts.
• From Cookie's own number, account and address: the same, for every message people send Cookie for a business that uses the desk.
• What the business creates: quotes, orders, invoices, payments it records, notes and reminders, and the replies its team writes or approves.

Instagram data

The desk reads and answers Instagram DMs only for professional accounts whose owners connected it, with the permissions instagram_business_basic and instagram_business_manage_messages. It reads the account's name and ID and the DMs people send it. Nothing from anyone else's profile.

It never messages anyone who has not written to the account first, except replies the business sends inside the window Meta allows. When the account is disconnected, on the desk or by removing the app in Instagram, its access token is deleted at once and the desk can no longer read or answer its messages.

What the desk uses it for

• To show the business its conversations in one place and send the replies, quotes and documents it approves.
• To draft replies and read enquiries. Drafts may be written with the help of language model providers, who receive only the text needed for that one draft.
• To keep the service working: security, fixing faults, preventing abuse.

We do not sell personal data, do not use it for advertising, and do not message anyone who has not written to the business first, except replies the business sends inside the window Meta allows.

One Cookie, many businesses

Many businesses share one Cookie: one WhatsApp number, one Instagram account and one email address. When you write to Cookie, the conversation belongs to the one business you wrote to, found from the code in the link you followed, the business you name, or by asking you which one.

What you tell one business is never shown to another business: not to its team, not in its drafts, not in what Cookie writes for it. To know where your next message goes, Cookie keeps only which businesses your number or account talks to, never what you said. When no business on the desk knows you any more, Cookie forgets you too.

Who else sees desk data

Only the companies needed to run the desk: Meta (to receive and send WhatsApp and Instagram messages), our hosting provider, the language model provider that writes a draft, and the email provider of a connected inbox. Each sees only what its part needs.

We share data with authorities only when the law requires it.

How long the desk keeps it

For as long as the business uses the desk. When a business disconnects an account, its access token is deleted at once.

When a business leaves or asks for deletion, we delete its buyers, messages, documents and files within 30 days, except records the law requires it to keep (such as invoices), which we hand back to it first.

We keep a record of each step the desk takes for 90 days: which job ran, which page was opened, whether a message went through. Never what anyone wrote. It helps us find faults before they reach anyone.

Deleting desk data

• Disconnect on the desk: Settings, Channels, then Disconnect next to the account. Its access token is deleted at once.
• Or remove it in Instagram: Settings, Apps and websites, then remove aarttsii desk. Instagram tells us and the token is deleted the same way. If you also ask Instagram to delete your data, Meta sends us the request and you get a confirmation code.
• Delete everything else: messages, buyers, documents. On the desk, Settings, Data, Delete everything (a business can export its data there first). Or email aarti@aarttsii.com from the account's address. Gone within 30 days, and we tell you when.
• If you messaged a business that uses the desk: ask that business, or email aarti@aarttsii.com with your Instagram username or phone number and the business's name. We delete what the desk holds about you within 30 days, except records the business must keep by law, and tell you when it's done.

Writing "stop" in a chat stops every message from the desk to you. Questions about the desk get a reply within 7 days.

How the desk keeps it safe

Access tokens and keys are encrypted before they are stored. Each business's data is kept apart from every other business's at the database level.

Our team opens a business's data only to help it, and every such look is logged and shown to that business.

Changes

If this policy changes, the date at the top updates. No sneaky edits, promise.