Privacy policy

What data I collect, why, who receives it, how long I keep it and how you control it, under Law No. 06/L-082 on Protection of Personal Data.

Updated on 22 October 2026

Draft for review

This text is a draft. The owner and a lawyer review it before sales open. It is not legal advice.

Business details

Trade name: Bisha Print Lab
Official name: pending
NUI: pending
Fiscal number: pending
Address: pending
Email: hello@bishaprintlab.com
Phone: pending

1.Who processes the data

The data controller is Bisha Print Lab, with the details in the card above. For any privacy question, write to me at hello@bishaprintlab.com.

2.What data I collect

Account: your name, email and password (stored only as a hash), or the name, email and profile photo Google provides when you sign in with Google.
Orders: name, email, phone, delivery address, the items and the order's history.
Payment: the status and the transaction number. Card details stay with the bank.
The files, photos and words you send for printing or in the AI Studio.
The messages you write to me.
Technical data: IP address and device signals, for the security check and protection from abuse.

3.Why I use it, and on what basis

To take, print and deliver your order, and for your account: the contract.
For invoices, accounting and complaints: a legal obligation.
For the site's security, protection from bots and cookieless statistics: legitimate interest.
For photos of people in the AI Studio: your consent and your confirmation that the people shown agreed.

Without the data an order needs (name, contact, a delivery address), I can't take the order.

4.The AI Studio and automated checks

Words and photos in the AI Studio are checked automatically with Cloudflare Workers AI for weapons, adult content, hate and other people's characters. A refused request goes no further. If you think it was refused by mistake, write to me and I'll look at it myself.

The picture you choose is sent to the 3D model service to turn it into a model. I never use photos to identify anyone, nor to train models.

5.Who receives it

Only those who help me do the work, each under a data protection contract:

Cloudflare: the site, the database, file storage, the AI checks, the security check (Turnstile) and cookieless statistics.
Brevo: the order emails.
Raiffeisen Bank Kosovo: card payments.
Google: signing in with Google, if you choose it.
The 3D model service (fal.ai or Meshy): only the picture chosen for the model.
The courier: name, phone and address for delivery.
The accountant and the Tax Administration of Kosovo: the data the law requires.

6.Transfers outside Kosovo

Some of these services process data in the European Union (Brevo) or in the United States (Cloudflare, Google). The Information and Privacy Agency recognises these countries as safe (Decision No. 22/2025); the US only for companies certified under the EU-US Data Privacy Framework.

For the 3D model service the status is being checked. Until then, photos of people are not sent to it without the authorisation the law requires.

7.How long I keep it

Files nobody orders: 30 days.
AI designs nobody orders: 90 days, then only one picture stays in your account.
Orders, invoices and accounting: at least 6 years, as tax law requires.
Complaints: at least 2 years.
Your account: until you delete it or ask me to.

8.Cookies

The site uses only necessary cookies, so it doesn't ask you about them:

better-auth.session_token: keeps you signed in (7 days).
better-auth.session_data: keeps your session for a few minutes so the site is faster (5 minutes).
bpl_cart and bpl_cart_n: your cart and the number of items in it (60 days).
NEXT_LOCALE: the language you chose (1 year).

The light or dark theme is kept only in your browser. Cloudflare Web Analytics statistics use no cookies. You can delete cookies in your browser; without them, signing in and the cart don't work.

9.Your rights

You have the right to see the data I keep about you, to correct it, to delete it, to restrict its processing, to receive it in a readable format, to object to its processing and not to be subject to a decision made only by a machine. You can withdraw consent at any time.

Write to me at hello@bishaprintlab.com. I answer within a month, free of charge.

10.Complaints to the Agency

If you think I process your data wrongly, you can complain to the Information and Privacy Agency: Str. “Zejnel Salihu” No. 22, 10000 Prishtina, toll-free 0800 600 10, info.aip@rks-gov.net.

11.Children

The site is for adults. Under 18, order with a parent's consent. Photos of children in the AI Studio need the consent of a parent or guardian.

12.Security

Connections are encrypted (HTTPS), passwords are stored only as hashes, and private files open only through signed links or for the admin. If a data breach happens, I notify the Agency within 72 hours, and you when the risk is high.

13.Changes

When I change this policy, the new date shows above.