Privacy Policy

Who we are

The data controller is Filli S.r.l., Viale Gian Galeazzo 7, 20136 Milano, VAT number IT12383960965, which runs the Dear Pieces brand.

For any question about this policy or your personal data, write to tech@filli.it.

What data we collect

Depending on how you use Dear Pieces, we may process:

• Account data: your email address and, if you sign in with Google, the name and profile details Google shares with us. Before you sign in, we give your browser an anonymous account ID so your puzzle is not lost.
• Photos and puzzle content: the photos you upload, the messages and descriptions you write while creating your puzzle, and the pictures we generate from them. A photo may show you, other people or your pets.
• Order data: your name, delivery and billing address, email, phone number, the products you buy, the order amount and the order and shipping status.
• Payment data: payments are handled by Stripe. We receive confirmation of the payment and limited details such as the card brand and last four digits. We never see or store your full card number.
• Marketing data: the email address you give us to receive our welcome offer and newsletters, your language and whether you have used your welcome code.
• Correspondence: what you tell us when you contact customer support.
• Technical and usage data: IP address, browser and device type, approximate country, the page or campaign that brought you to us, and how you use the site, such as pages viewed and the steps of puzzle creation you complete.

Photos of other people

Only upload photos you have the right to use. If a photo shows other people, make sure they agree to it being turned into a puzzle, and if it shows a child, that you are their parent or guardian or have that person's permission.

We use your photos only to create, show you and print your puzzle. We do not publish them, use them in our marketing without your separate permission, or use them to train AI models. Please do not upload photos that reveal sensitive information, such as health conditions or religious beliefs, that is not needed for your puzzle.

Why we use your data and our legal basis

• To create your picture, take your order, have it printed and shipped and keep you updated on its status. Legal basis: performance of a contract with you, or steps you ask us to take before entering into one (Art. 6(1)(b) GDPR).
• To provide your account and keep your puzzles and orders linked to it. Legal basis: performance of a contract.
• To answer your requests and handle complaints, reprints and returns. Legal basis: performance of a contract and our legal obligations under consumer law.
• To issue invoices and keep accounting and tax records. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
• To send you our welcome offer, newsletters and promotions. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
• To send customers who have bought from us occasional emails about similar products, unless they opt out. Legal basis: our legitimate interest, as allowed by Art. 130(4) of the Italian Privacy Code.
• To keep the site secure, prevent fraud and abuse and fix errors. Legal basis: our legitimate interest in running a safe and working service (Art. 6(1)(f) GDPR).
• To understand how the site is used and improve it. Legal basis: our legitimate interest or, where cookies or similar technologies require it, your consent.
• To show you relevant ads on other sites and measure how well our ads work. Legal basis: your consent, given through our cookie banner.

Who we share your data with

We do not sell your personal data. We share it only with providers who help us run Dear Pieces, who act on our instructions under data processing agreements, and only to the extent each one needs:

• Google (Firebase and Google Cloud): hosting, sign-in, database and file storage. Our database and servers are in the European Union (Belgium).
• AI image providers (OpenAI and fal.ai): they process your photos and descriptions to generate your puzzle picture.
• Stripe: payment processing and fraud prevention.
• Cloudprinter and its print partners and couriers: printing your puzzle and delivering it. They receive the print files and your name, delivery address, email and phone number.
• Email delivery providers: sending order updates, sign-in links and, if you agreed, our newsletters.
• Analytics and advertising partners such as PostHog and Meta: only as described in our Cookie Policy and, for advertising, only with your consent.
• Professional advisers, such as our accountant and lawyers, and public authorities when the law requires it.

Transfers outside the European Economic Area

Some of our providers, such as OpenAI, fal.ai, Stripe and Google, are based in or may access data from the United States. When data leaves the European Economic Area, we rely on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for certified companies, or on the Standard Contractual Clauses approved by the Commission, together with additional safeguards where needed. You can ask us for a copy of these safeguards.

How long we keep your data

• Photos, messages and pictures of puzzles you do not order are deleted automatically 30 days after you create them.
• Photos, pictures and print files of puzzles you order are kept for as long as we may need them to handle a complaint or reprint under the legal guarantee, and are deleted earlier if you delete your account.
• Order and invoice records are kept for 10 years, as required by Italian tax and accounting law.
• Account data is kept until you delete your account. Anonymous accounts that never place an order are removed with their puzzles.
• Marketing data is kept until you unsubscribe or withdraw your consent.
• Support correspondence is kept for as long as needed to resolve your request and any related claim.

When we no longer need personal data, we delete it or make it anonymous so it can no longer be linked to you.

How we protect your data

We use technical and organizational measures to protect your data against loss, misuse and unauthorized access. Data is encrypted in transit, files are stored privately and can only be read by you and by the services that need them, and access within our team is limited to people who need it for their work. If a data breach puts your rights at risk, we will notify you and the supervisory authority as the law requires.

Emails and how to opt out

We send emails about your order, your account and sign-in links because they are needed to provide the service. Marketing emails are separate: every one of them has an unsubscribe link, and you can also write to tech@filli.it at any time. Unsubscribing does not affect emails about orders you have placed.

Cookies

We use cookies and similar technologies that are necessary for the site and the puzzle creator to work. We use analytics and advertising cookies only as described in our Cookie Policy and, where required, only after you agree. You can change your choice at any time.

Children

You must be at least 18 years old to place an order. Our website is not directed at children, and we do not knowingly collect personal data from children under 14 without the consent of a parent or guardian. A child may appear in a photo uploaded by a parent or guardian, as described above.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy of it;
• have inaccurate or incomplete data corrected;
• have your data erased when there is no longer a valid reason to keep it;
• restrict our processing of your data in certain cases;
• object to processing based on our legitimate interest, and to direct marketing at any time;
• receive the data you gave us in a structured, machine-readable format and have it sent to another company (data portability);
• withdraw your consent at any time, without affecting processing that took place before you withdrew it.

To exercise these rights, write to tech@filli.it. We may ask you to confirm your identity before acting on your request. We will reply within one month, free of charge, unless a request is clearly unfounded or excessive.

You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the authority of the EU country where you live or work.

We do not take decisions about you based solely on automated processing that have legal or similarly significant effects. The AI tools we use only generate the picture you ask for.

Changes to this policy

We may update this policy when our service or the law changes. We will publish the new version on this page with its date and, if the changes are significant, let you know by email or on the site before they take effect.