Privacy policy

Last updated 30 October 2026

Jhilke Studio sells trek maps and other prints inspired by Nepal, through this store. This policy explains what personal data we collect when you browse, shop, sign up for our list, or write to us, why we process it, who else sees it, and how long we keep it. It also explains our AI assistant plainly, because you should know when you are talking to one.

✦What We Collect, and From Where

In plain words: This list says what we keep about you and why. The chat and email part changed: we now keep your messages instead of deleting them.

We collect only what each of these needs. Every category below states the legal basis we rely on, in the sense Article 6 of the GDPR uses that term.

• Orders and accounts. Your name, address, email, phone number and order history, collected when you buy something or create an account. Shopify processes your payment directly; we do not see or store your full card details. Basis: performance of our contract with you, and legal obligation for the accounting records tied to a sale.
• Wishlist. The products you save to your account. The list is stored on your Shopify customer record through a small service we run on Cloudflare. Our site also uses the Magic Wishlist app to show the wishlist page and heart button, and that app may keep its own record of what you save. Basis: performance of our contract with you and our legitimate interest in making the site useful to return to.
• Contact form. Your name, email and message, and the reason you pick from the form, when you write to us. Basis: our legitimate interest in answering you, and performance of a contract where your message concerns an existing order.
• Jhilke Circle applications. The Jhilke Circle is our creator programme. Anyone can apply through our form; we choose who joins, and we also invite creators ourselves. The form is at circle.jhilkestudio.com/apply. It asks for your name, email, handle, platform, profile link, any other platform links, followers, country, main content language, a note about your audience, and links to your content. It also asks which of your accounts you want to verify, whether you accept the Circle terms, and whether you want news and offers by email. Country, language, followers and the note are optional. We store what you send in encrypted form. A person makes every approval decision. The scoring and the verdict Jhilke AI suggests (accept, maybe or decline, with reasons) only help that person. If you are invited and accept, your payout and tracking details are handled by Shopify Collabs. Basis: our legitimate interest in reviewing creator applications, and performance of a contract once you join the programme.
• Jhilke Circle account check. We check that an applicant controls the social account they named. The applicant sends a short code to our Instagram or Facebook account by direct message. Our Circle service reads that message in our helpdesk to find the code and flags the application, and a person then confirms it. For each check we store the message number, the conversation number, the sender's username or name and the time of the message. We do not store the message text. Basis: our legitimate interest in preventing fraud and fake applications. You can object to this check (see "Exercising Your Rights").
• Glint List newsletter. Your email address, when you sign up for our newsletter. Basis: your consent, confirmed by a double opt-in email before anything is sent to you.
• Chat, direct messages and email. The messages you send us through the storefront chat, in direct messages to our Instagram and Facebook Messenger accounts, or to one of our email addresses, and if you are signed in, your verified name and email. We keep these conversations and use them in three ways: to answer you; to review internally how well we answered; and to improve the answers and knowledge of Jhilke AI, our AI assistant. We do not use customer messages to train an AI model. Basis: performance of our contract with you where we answer you, and our legitimate interest in reviewing our service quality and improving Jhilke AI. You can object to the review and improvement uses at any time (see "Exercising Your Rights").
• Site analytics and pixels. How you browse and interact with the site, collected only after you accept analytics or marketing cookies in our cookie banner. Basis: your consent.

You do not have to message us. We need your message to answer you. For the Jhilke Circle, we need the account check to approve an account.

✦Cookies and Consent

Our cookie banner, built into Shopify, appears the first time you visit and lets you accept or decline non-essential cookies. You can change your choice at any time. We use three kinds of cookies:

• Essential cookies: needed for the site and checkout to work, and cannot be turned off.
• Analytics cookies: help us see how visitors use the site, only once you consent. We use Microsoft Clarity for this. It records how our pages are used (clicks, scrolls and taps), so we can see where a page is hard to use. Clarity starts as soon as a page opens, before you choose. Until you accept, it sets no cookies and gives each page you view a new ID, so it cannot link your pages or visits together. Microsoft still sees your IP address and browser, as with any web request.
• Marketing cookies: used by pixels from Google (including Google Ads), Meta, TikTok and Pinterest to measure and show advertising, only once you consent. Google Ads tells us whether a visit that came from one of our ads ended in an order. These sit behind Shopify's own consent gate and never fire before you choose.

✦Marketing and the Glint List

We only send marketing email to people who join the Glint List, and only after they confirm the double opt-in email. You can unsubscribe at any time using the link in any marketing email, at no cost, and withdrawing consent does not affect anything sent before.

Writing to us through the storefront chat, the contact form, or as part of a Jhilke Circle request does not add you to the Glint List. We only add someone to marketing if they separately opt in for it.

✦Our AI Assistant

In plain words: Jhilke AI is a computer helper. It says so in its first reply, and it passes your question to a person when it needs to. We do not teach any AI model with what you write to us.

The chat on our storefront, and the first reply to an email you send us, are written by an AI assistant, not a person. Once we switch it on, the assistant will also answer direct messages to our Instagram and Facebook Messenger accounts. It says that it is an AI in its first reply. We are telling you this plainly, as EU law now requires for an AI system that talks with people.

Before your message reaches the AI model, your name, email, address and order number are masked. The model answers using placeholder text and never sees the real values, which are restored only afterward for our own records. The model itself runs through Cloudflare's AI infrastructure. If that model is not available, a second model from Mistral AI in Paris answers instead. It gets the same masked text.

If the assistant cannot help, or if you ask to speak to a person, your conversation goes to a human at Jhilke Studio. Nothing the assistant does results in an automated decision that has a legal effect on you or similarly significantly affects you, in the sense of Article 22 of the GDPR. It answers questions; it does not decide your orders, refunds or account status on its own.

We read conversations ourselves to check the assistant's answers and to write better reviewed answers and product knowledge for it. No customer message is used to train an AI model.

✦Who We Share Your Information With

In plain words: These are the other companies that help us. We do not sell what you tell us. Meta is new on this list because it carries your Instagram and Messenger messages to us.

We do not sell personal information. We share it only with the following, each for the purpose stated:

• Shopify, which hosts the store, takes payment and holds the order record. See the Shopify Consumer Privacy Policy and the Shopify Privacy Portal.
• Gelato, our print-on-demand partner, which receives your name, shipping address and order items so it can print and ship your order.
• Klaviyo, which sends the Glint List newsletter, for the email addresses of people who opted in. We chose Klaviyo's EU data hosting region for this reason.
• Judge.me, which collects and shows product reviews. If you leave a review, it holds your name, email address and what you wrote.
• Chatwoot, the Jhilke AI service and the Jhilke Circle service, software we run ourselves on a server we rent from Hetzner Online GmbH in Germany, inside the EEA. Chatwoot is our helpdesk. It carries your chat, direct message and support messages, the Jhilke AI service drafts the AI assistant's replies, and the Circle service handles creator applications and account checks.
• Meta (Instagram and Facebook Messenger). Meta, the company behind Facebook and Instagram, is responsible for how its own apps handle messages, under its own privacy policy: see the Meta Privacy Policy and the Instagram privacy policy. When you message our Instagram or Facebook account, Meta passes the message on to our helpdesk through our own Meta app so we can answer you. Our basis is answering you, the same as for other chats.
• Cloudflare, which delivers and secures the site and runs the AI model gateway behind our chat assistant.
• Mistral AI, a company in Paris, France, whose AI model answers in our chat assistant when the first model is not available. It receives only masked chat text, processed in the EU and EFTA countries.
• Lark Suite, which hosts our business email.
• Resend, which delivers messages sent through our contact form, and our own service alerts, to our inboxes. It handles the name, email address and message content of those submissions in transit.
• Analytics and advertising services (Google, including Google Ads; Microsoft Clarity; Meta, TikTok, Pinterest), only for visitors who accept marketing or analytics cookies in the banner.

✦International Transfers

In plain words: Some helpers are in other countries. Our own helpdesk sits on a server in Germany.

Some of the services above are based outside the European Economic Area, or run infrastructure that spans several countries. Where personal information leaves the EEA or the UK, we rely on recognised safeguards such as the European Commission's Standard Contractual Clauses, or a transfer to a country the Commission recognises as adequate.

Shopify is a global platform and covers its own international transfers under the Shopify Consumer Privacy Policy linked above.

Cloudflare delivers and secures our site, runs the small service behind our account features and hosts the AI models behind our assistant. It may process data outside the EEA. Cloudflare's data processing terms cover these transfers with the European Commission's Standard Contractual Clauses, and Cloudflare is also certified under the EU-US Data Privacy Framework. Cloudflare states that it does not use customer content to train the AI models it hosts.

Mistral AI (Mistral AI SA, 15 rue des Halles, 75001 Paris, France) runs the back-up AI model behind our assistant. It receives only the masked chat text described above. We send it to Mistral's EU endpoint, so it is processed in the European Union and EFTA countries. We have turned off the use of our data to improve Mistral's models. Mistral's data processing agreement covers any transfer outside the EEA with adequacy decisions or the European Commission's Standard Contractual Clauses.

Chatwoot, the Jhilke AI service and the Jhilke Circle service run on a server we rent from Hetzner Online GmbH in Germany, inside the EEA. Stopped copies of these services stay with our former host Zeabur until we delete them after 2 December 2026. Zeabur is based outside the EEA, so its staff may be able to reach those copies from abroad. Meta handles the Instagram and Facebook Messenger messages it delivers to us under its own terms, which govern where it processes them. Our business email is hosted by Lark Suite (Lark Technologies Pte. Ltd., Singapore), which relies on the Standard Contractual Clauses for transfers out of the EEA.

Resend, which delivers our contact form messages and service emails, stores them in the United States. Resend's data processing agreement uses the Standard Contractual Clauses, and Resend is certified under the EU-US Data Privacy Framework. Gelato prints each order at a production partner near you, which can be outside the EEA. Gelato requires those partners to accept its data processing terms with the Standard Contractual Clauses, or to be certified under the Data Privacy Framework in the United States.

✦How Long We Keep Your Information

In plain words: We keep your chats and emails for up to 3 years after your last message, so we can help you again and get better. We delete them sooner if you ask. Creator applications are kept for 24 months.

• Orders and accounts: for as long as you hold an account with us, and afterward for ten years from the end of the year of the sale for invoices and accounting records, as Portuguese tax law requires.
• Chat conversations, direct messages and support emails: kept for at most 3 years after your last message to us. Summaries made from a conversation follow the same limit. After that we delete the conversation or remove the names from it. A conversation is not deleted when it is marked resolved. We delete it sooner if you ask to be forgotten.
• Site analytics events: kept for 24 months and then deleted.
• Glint List newsletter: for as long as you stay subscribed, and removed once you unsubscribe.
• Contact form messages: these arrive in our mailboxes by email, so they are support emails, and they are kept for up to 3 years after your last message to us, and deleted sooner if you ask to be forgotten, as stated for chats and support emails above.
• Jhilke Circle applications: applications that are declined or never verified are kept for 24 months. If you join, the records about your participation are kept for 24 months after you leave, and payment and tax records are kept as long as the law requires. The record that you accepted the Circle terms is kept for as long as the Circle agreement lasts, plus the period in which legal claims can be made.
• Jhilke Circle account check: the message number, conversation number, sender name and time of the message are cleared after 90 days. The record of the check itself is kept for as long as the Circle agreement lasts, plus the period in which legal claims can be made.

If you ask us to erase your data, we delete it from each service listed above. Your chat and support records are encrypted with a key unique to you. To erase them we destroy that key, delete the conversation from our helpdesk, and delete any copy left in a backup when that backup expires. Order records we must keep by law are kept until that period ends.

✦Exercising Your Rights

In plain words: You can ask to see, fix or delete what we have about you. You can also tell us to stop using your chats to review and improve our service, and we will.

Under the GDPR you have the right to access your personal data, to have it corrected, to have it erased, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on your consent, you can withdraw that consent at any time without affecting anything we did before you withdrew it.

You have the right to object, under Article 21 of the GDPR, to any use of your data that rests on our legitimate interest. This covers reviewing our conversations for quality, improving Jhilke AI, and the Jhilke Circle account check. If you object to us using your messages to improve Jhilke AI, we will stop using them for that. For the other uses we also stop, unless we can show compelling reasons that outweigh your interests. We will not use your data for direct marketing without your consent.

To exercise any of these, email support@jhilkestudio.com. For requests about your Jhilke Circle application or membership, you can also email collab@jhilkestudio.com. We usually reply within two working days and will always respond within one month, as Article 12(3) requires. If a request is complex we may extend that by two further months and will tell you why within the first month.

We may ask you to confirm your identity before we act, so that we do not disclose your data to someone else. We will not charge you for a request unless it is manifestly unfounded or excessive.

✦Children

This store is not directed at children under 16. If you are the parent or guardian of a child who has given us their personal information, contact us at support@jhilkestudio.com and we will delete it.

✦Complaints

If you think we have handled your personal data badly, please tell us first so we can put it right. You also have the right to complain to the Portuguese supervisory authority, the Comissao Nacional de Protecao de Dados (CNPD), at cnpd.pt, or to the supervisory authority where you live or work.

✦Changes to This Policy

We may update this policy from time to time, including to reflect changes in how we process data or to meet a new legal requirement. We will post the revised policy on this page and update the "Last updated" date at the top.