Privacy policy
1. Introduction and Scope
Effective Date: September 16, 2026
PicsArt, Inc., a Delaware corporation with its principal office at Optima Onyx Tower, Suite 1103, 1010 South Federal Highway, Hallandale Beach, FL 33009 (“PicsArt,” “we,” “us,” or “our”), operates an online store at https://store.picsart.com (the “Shop”) that sells physical Picsart-branded merchandise to customers worldwide. PicsArt is the data controller (or, where applicable law uses a different term, the “business” or “merchant”) responsible for the personal information collected through the Shop.
This Privacy Policy explains what personal information we collect when you visit or make a purchase through the Shop, how we use and share that information, and the choices and rights available to you. It applies only to the Shop and to personal information collected in connection with the Shop.
The Shop is hosted on the Shopify platform. For merchant services, Shopify processes personal information on PicsArt’s behalf as a processor or service provider under Shopify’s Data Processing Addendum. Shopify and its affiliates provide storefront, checkout, payment, security, and related platform functions. Shopify’s own processing of personal information is described in Shopify’s Consumer Privacy Policy, available at https://www.shopify.com/legal/privacy/consumers.
The Shop is technically separate from Picsart’s creative platform, mobile applications, and other digital services. The Shop does not share customer accounts, databases, or personal information with those services, and consents collected through Picsart’s digital services do not apply to the Shop. Those services are governed by a separate privacy policy located at https://picsart.com/privacy-policy/. If you use both the Shop and Picsart’s digital services, each policy applies independently to the respective service.
If you have questions about this Privacy Policy or our data practices, please contact us at store@picsart.com.
2. Personal Information We Collect
We collect the following categories of personal information when you visit, create an account on, or place an order through the Shop. The specific information collected depends on how you interact with the Shop and what you choose to provide.
| Category | Examples | Primary Sources |
|---|---|---|
| 1. Identity and Contact Information | First name, last name, email address, phone number. | Provided by you at checkout or account creation. |
| 2. Address Information | Street address, city, province or state, postal code, country, and any additional saved addresses. | Provided by you. |
| 3. Account Information | Account existence and creation date, login and account identifiers, email or SMS marketing consent status. | Provided by you; generated by Shopify. |
| 4. Order and Transaction Information | Products, quantities, prices, order dates, payment status, fulfillment status, refunds, returns, transaction identifiers, and related customer-service communications. Payment providers process payment-card information, and PicsArt receives payment and transaction status information needed to manage orders. | Provided by you; generated through order processing; received from payment processors. |
| 5. Customer Relationship Information | Number of orders, total spend, customer tags, internal notes, support requests, complaints, fraud or security indicators, and communications. | Generated internally; provided by you through support interactions. |
| 6. Necessary Technical Information | IP address, device and browser information, security logs, checkout and session data, and other data needed to operate, secure, and troubleshoot the Shop. | Generated automatically by Shopify during your use of the Shop. |
| 7. Marketing Choices and Communications | Subscription status, opt-in records, preferences, delivery status, and engagement with communications (if applicable). | Provided by you; generated by communications providers. |
| 8. Information from Third Parties | Data received from Shopify, payment processors, fraud-prevention providers, carriers, logistics providers, customs authorities, and customer-authorized sources. | Third-party service providers and platforms. |
We do not knowingly collect more personal information than is necessary for the purposes described in Section 3.
3. How We Use Your Information
We use the personal information described in Section 2 for the purposes set out below. For individuals in the European Economic Area (EEA), United Kingdom (UK), and Switzerland, the table also identifies the legal basis that applies to each purpose.
| Purpose | Description | Legal Basis (EEA/UK/Switzerland) |
|---|---|---|
| Operating the Shop | Displaying products, maintaining the storefront, and enabling browsing and checkout. | Performance of contract; legitimate interests (maintaining a functional store). |
| Account Management | Creating and managing customer accounts, storing preferences, and maintaining login credentials. | Performance of contract. |
| Order Processing and Fulfillment | Processing orders and payments, coordinating with our fulfillment provider, carriers, customs brokers, and delivery partners, and shipping merchandise. | Performance of contract. |
| Customer Support | Responding to inquiries, complaints, and support requests, and communicating about orders. | Performance of contract; legitimate interests (resolving customer issues). |
| Fraud Prevention and Security | Detecting, investigating, and preventing fraudulent or unauthorized activity, and securing the Shop. | Legitimate interests (protecting PicsArt, customers, and third parties); legal obligation. |
| Legal and Tax Compliance | Meeting tax, customs, accounting, product-safety, and other legal or regulatory obligations. | Legal obligation. |
| Dispute Resolution and Enforcement | Enforcing our Terms, resolving disputes, managing chargebacks, and establishing or defending legal claims. | Legitimate interests (protecting legal rights); legal obligation. |
| Aggregate Operational Improvement | Analyzing aggregate order and customer-service metrics to improve Shop operations. This does not involve profiling for advertising. | Legitimate interests (improving service quality). |
| Opted-In Marketing | Sending promotional emails or SMS where you have opted in or another lawful basis exists. Every marketing message includes an unsubscribe method. | Consent; legitimate interests (direct marketing), where permitted by applicable law. |
4. How We Share Your Information
We do not sell your personal information or share it for targeted or cross-context behavioral advertising. We disclose personal information only to the categories of recipients described below, and only for the purposes set out in Section 3.
| Recipient Category | Description |
|---|---|
| PicsArt personnel | Employees and authorized contractors with a need to know for order management, customer support, fraud review, and operations. |
| Shopify and its affiliates | Shopify provides storefront hosting, checkout, payment facilitation, security, and related platform services. Shopify operates in Canada, Ireland, Singapore, the United States, and other locations and engages subprocessors under its Data Processing Addendum. |
| Payment processors and fraud-prevention providers | Third parties that process payment-card information, verify transactions, detect fraud, and provide PicsArt with payment and transaction status information needed to manage orders. |
| Fulfillment provider (China-based), carriers, customs brokers, and delivery partners | E-Commerce Express Fulfillment, our China-based third-party logistics provider, stores merchandise, packs orders, and arranges shipping. Order details, contact information, shipping addresses, and product information are shared as needed to fulfill and deliver your order. |
| Communications providers | Email or SMS service providers used only to send opted-in or otherwise permitted marketing and transactional messages. |
| Professional advisers, auditors, and insurers | Legal counsel, accountants, auditors, and insurers where necessary for professional services. |
| Regulators, courts, and law enforcement | Government authorities, courts, or law-enforcement agencies where disclosure is required or permitted by law. |
| Corporate transaction parties | Parties to a merger, acquisition, financing, restructuring, or asset transfer, subject to appropriate confidentiality and data-protection safeguards. |
Shopify’s dual role: For merchant services (hosting, checkout, payment processing), Shopify acts as our processor or service provider. For its own consumer-facing services, such as Shop and Shop Pay, Shopify may independently collect and process your data as a separate controller. Shopify’s handling of data in that capacity is governed by its consumer privacy policy, available at https://www.shopify.com/legal/privacy/consumers. A privacy request submitted to PicsArt does not automatically apply to data Shopify controls independently, and vice versa.
Installed Shop applications. The Shop currently uses Shopify Messaging for customer communications, MS Barcode Labels for internal order operations, E-Commerce Express Fulfillment for storage and fulfillment, and Kiwi Size Chart for product sizing. These providers receive only the information reasonably necessary for their functions. Kiwi Size Chart does not receive purchase data. These applications act as processors or service providers where applicable.
5. International Data Transfers
PicsArt, Inc. is based in the United States. When you use the Shop, your Personal Information may be transferred to, stored in, and processed in countries outside your country of residence, including the United States, Canada, Ireland, Singapore, China, and other locations where Shopify, our fulfillment provider, payment processors, carriers, and other service providers maintain operations.
Some of these countries may not provide the same level of data protection as the laws of your home jurisdiction. Where applicable law requires, we rely on appropriate safeguards to protect your Personal Information during international transfers, including:
- Contractual protections with our service providers, including data processing agreements that impose confidentiality, security, and data-handling obligations.
- Shopify’s Data Processing Addendum (available at https://www.shopify.com/legal/dpa), which governs Shopify’s processing of Personal Information on our behalf and incorporates applicable transfer mechanisms.
- European Commission-approved Standard Contractual Clauses (SCCs) for transfers of Personal Information from the EEA or Switzerland to countries that lack an adequacy decision.
- The UK International Data Transfer Addendum to the SCCs for transfers from the United Kingdom.
- Other legally recognized transfer mechanisms or derogations as applicable under local law.
Where E-Commerce Express Fulfillment receives order details, shipping addresses, and related information in China to pack and ship your merchandise, contractual safeguards govern its use, security, and retention of your data.
For questions about international transfers or the safeguards we apply, please contact us at store@picsart.com.
6. Cookies and Similar Technologies
6.1 PicsArt does not currently deploy non-essential advertising, analytics, personalization, or marketing cookies or similar tracking technologies on the Shop.
6.2 Shopify and checkout or payment providers may place strictly necessary cookies or similar technologies on your device to support the following functions:
- Storefront operation and page navigation.
- Session management and shopping-cart persistence.
- Checkout and payment processing.
- Fraud detection and prevention.
- Security and authentication.
- Recording your privacy and cookie choices.
6.3 Because these technologies are required for the Shop to function properly, they cannot always be disabled without affecting your ability to browse, place orders, or complete checkout.
6.4 If PicsArt introduces non-essential cookies or similar tracking technologies in the future (for example, analytics or advertising tools), PicsArt will update this Policy and provide consent mechanisms or opt-out controls where required by applicable law before activating those technologies.
6.5 For information about how Shopify uses cookies and similar technologies in connection with its consumer services, please refer to Shopify’s Consumer Privacy Policy at https://www.shopify.com/legal/privacy/consumers.
7. Data Retention
7.1 PicsArt retains your Personal Information for as long as reasonably necessary to fulfill the purposes described in this Policy, including to: (a) maintain your account and process your orders; (b) meet tax, accounting, customs, warranty, product-safety, fraud-prevention, chargeback, and dispute-resolution obligations; (c) comply with applicable legal, regulatory, and record-keeping requirements; and (d) establish, exercise, or defend legal claims.
7.2 Shopify does not automatically delete or expire customer records while PicsArt’s store remains active on the Shopify platform. Shopify does not currently provide a native setting for scheduled deletion based on inactivity. PicsArt can process individual erasure requests, which redact identifying data from the relevant customer record. Certain transaction records (for example, order history, tax records, and fraud-prevention logs) may be retained in a form required for legal and operational purposes even after identifying data has been redacted.
7.3 If PicsArt deactivates the Shopify store, Shopify may retain store information for up to two years to permit reactivation, unless PicsArt requests earlier deletion and such deletion is legally permitted.
7.4 PicsArt intends to adopt and maintain a documented internal retention schedule that specifies retention periods by data category and purpose. When that schedule is finalized, PicsArt will apply it consistently and update this Policy as appropriate.
7.5 When Personal Information is no longer required under the applicable retention standard, PicsArt will delete, anonymize, or de-identify it in accordance with applicable law and Shopify platform capabilities.
8. Your Privacy Rights
Depending on your jurisdiction, you may exercise one or more of the following rights with respect to the personal information PicsArt holds about you:
- Access and Confirmation: request confirmation of whether we process your personal information and obtain a copy of it.
- Correction: request correction of inaccurate or incomplete personal information.
- Deletion: request deletion of your personal information, subject to legal exceptions.
- Portability: receive your personal information in a structured, commonly used, machine-readable format, or request its transfer to another controller where technically feasible.
- Restriction: request that we restrict processing in certain circumstances.
- Objection: object to processing based on legitimate interests or for direct-marketing purposes.
- Withdrawal of Consent: withdraw consent at any time where processing relies on consent, without affecting the lawfulness of prior processing.
- Marketing Opt-Out: unsubscribe from marketing emails or SMS using the mechanism provided in each communication or by contacting us.
- Complaint: lodge a complaint with a competent supervisory or data-protection authority.
- Appeal: where applicable law provides, appeal our decision regarding your request.
- Non-Discrimination: exercise your rights without receiving discriminatory treatment.
The availability of each right depends on your location and applicable law. All requests are subject to identity verification and lawful exceptions.
To submit a request, contact us at store@picsart.com. We will respond within the timeframe required by applicable law.
Shopify may assist PicsArt in processing access and deletion requests. If you also use Shopify’s Shop or Shop Pay consumer services, you may submit a separate request to Shopify at https://privacy.shopify.com/ for data Shopify controls independently. A request submitted to Shopify does not automatically erase PicsArt’s merchant records, and a request submitted to PicsArt does not automatically erase data Shopify controls independently. You may need to contact both parties to address all of your data.
9. U.S. State Privacy Disclosures
This Section 9 applies to residents of California and other U.S. states that grant comparable consumer privacy rights under applicable state privacy laws (collectively, “U.S. Privacy Laws”). Whether a particular U.S. Privacy Law applies to PicsArt depends on statutory thresholds for that law. This section supplements, and does not replace, the rest of this Policy.
9.1 Categories Collected, Sources, Purposes, and Recipients. The table below summarizes the categories of personal information PicsArt has collected in the preceding twelve months, the sources, business or commercial purposes, and categories of recipients to whom information is disclosed. For additional detail, see Sections 2, 3, and 4 of this Policy.
| Category | Sources | Purposes | Recipient Categories |
|---|---|---|---|
| Identifiers (name, email, phone, account ID) | Customer, Shopify, payment processors | Order processing, account management, customer support, marketing (with consent) | Shopify, fulfillment provider, carriers, payment processors, communications providers |
| Commercial information (order history, transaction details) | Customer, Shopify | Order fulfillment, returns, accounting, dispute resolution | Shopify, fulfillment provider, carriers, customs brokers, payment processors, professional advisers |
| Internet or network activity (IP address, device/browser data, session data) | Shopify (automatically collected) | Security, fraud prevention, storefront operation, troubleshooting | Shopify |
| Geolocation (inferred from IP address or shipping address) | Customer, Shopify | Shipping, tax compliance, fraud prevention | Shopify, fulfillment provider, carriers, customs brokers |
9.2 No Sale, Sharing, or Targeted Advertising. PicsArt does not sell personal information, share personal information for cross-context behavioral advertising, or use personal information for targeted advertising as those terms are defined under U.S. Privacy Laws.
9.3 Consumer Rights. Subject to verification and applicable legal exceptions, eligible consumers may request: access to and confirmation of personal information; correction of inaccurate information; deletion of personal information; portability in a readily usable format; and the right to opt out of sale, sharing, or targeted advertising (not currently applicable). Consumers also have the right to non-discrimination for exercising these rights and, where required by applicable law, the right to appeal a denial.
9.4 Global Privacy Control. Where required by applicable U.S. Privacy Law, PicsArt will treat a recognized Global Privacy Control (GPC) signal from a consumer’s browser as a valid opt-out request for that browser or device.
9.5 Authorized Agents. A consumer may designate an authorized agent to submit a request on the consumer’s behalf. PicsArt may require the agent to provide signed written authorization from the consumer and may verify the consumer’s identity directly.
9.6 How to Submit a Request. Direct all requests to store@picsart.com. PicsArt will respond within the timeframe required by applicable law.
10. EEA, UK, and Switzerland Disclosures
If you are located in the European Economic Area (EEA), the United Kingdom (UK), or Switzerland, the following supplemental disclosures apply to you.
Controller: PicsArt, Inc., Optima Onyx Tower, Suite 1103, 1010 South Federal Highway, Hallandale Beach, FL 33009, United States. Contact: store@picsart.com.
Data Protection Officer: dpo@picsart.com.
Legal Bases. Section 3 maps each processing purpose to its applicable legal basis: performance of a contract with you, compliance with a legal obligation, our legitimate interests (for example, fraud prevention, security, and operational improvement, balanced against your rights), or your consent. We do not rely on consent for core order processing.
Your Rights. Subject to applicable law and verification, you may exercise the rights described in Section 8, including the right to lodge a complaint with your local supervisory authority. For EEA residents, a list of supervisory authorities is available at https://edpb.europa.eu/. UK residents may contact the Information Commissioner’s Office (ico.org.uk). Swiss residents may contact the Federal Data Protection and Information Commissioner (edoeb.admin.ch).
International Transfers. Your personal information is transferred to the United States and other countries described in Section 5. Where required, transfers are protected by Standard Contractual Clauses approved by the European Commission, the UK International Data Transfer Addendum, Shopify’s Data Processing Addendum, and equivalent contractual safeguards. Some recipient countries may not provide a level of data protection equivalent to that of the EEA, UK, or Switzerland.
11. Other Regional and Global Rights
11.1 PicsArt respects the privacy rights granted to individuals under the laws of their country or region of residence. If you are located in Brazil, Canada, Australia, New Zealand, South Korea, Japan, India, or any other jurisdiction that provides statutory privacy rights, you may exercise those rights as described in Section 8 (Your Privacy Rights) of this Policy, to the extent required by applicable law.
11.2 Where local law grants rights beyond those listed in Section 8, including rights related to automated decision-making, data breach notification, or additional consent requirements, PicsArt will honor those rights in accordance with the applicable legal framework. Nothing in this Policy is intended to limit or waive any mandatory right that cannot be restricted by contract under your local law.
11.3 PicsArt does not make country-specific representations regarding the applicability of any particular national privacy statute unless expressly stated in Sections 9 or 10 of this Policy. Applicability depends on the requirements and thresholds established by each jurisdiction’s law.
11.4 To exercise any right available under your local privacy law, or to ask questions about how your jurisdiction’s requirements apply to the Shop, please contact us at store@picsart.com. PicsArt will respond within the timeframe required by the law of your jurisdiction and will not discriminate against you for exercising your rights.
12. Children’s Privacy
The Shop is not directed to children under the age of sixteen (16), or under any higher minimum age established by applicable law. PicsArt does not knowingly collect personal information from children through the Shop.
Minors may not independently create accounts or place orders on the Shop. A parent or legal guardian may place an order on behalf of a minor. When a parent or guardian does so, the personal information collected (such as name, shipping address, and contact details) is the information of the ordering adult, and PicsArt processes it in accordance with this Policy.
If PicsArt becomes aware that it has collected personal information from a child without appropriate parental or guardian consent, PicsArt will take reasonable steps to delete that information promptly. If you believe that a child has provided personal information to PicsArt through the Shop, please contact us at store@picsart.com so that we can investigate and take appropriate action.
13. Security
13.1 PicsArt, Inc. maintains reasonable administrative, technical, and organizational safeguards designed to protect the personal information collected and processed through the Shop against unauthorized access, disclosure, alteration, loss, and destruction.
13.2 These measures include, as appropriate to the nature and sensitivity of the information:
- Access controls that limit personal information to authorized PicsArt personnel and service providers with a legitimate need to access such data.
- Use of encryption in transit (e.g., TLS/SSL) for data transmitted between your browser and the Shop.
- Vendor management practices, including contractual requirements for service providers to maintain appropriate security measures.
- Periodic review of security practices and controls in light of current risks.
- Incident-response procedures to identify, contain, investigate, and remediate suspected or confirmed security incidents, including notification to affected individuals and authorities where required by applicable law.
13.3 The Shop is hosted on Shopify, which applies its own security program to the storefront, checkout, and payment infrastructure. Information about Shopify’s security practices is available through Shopify’s published documentation.
13.4 No method of transmission over the Internet or method of electronic storage is completely secure. While PicsArt strives to protect your personal information, PicsArt cannot guarantee absolute security. You are responsible for maintaining the confidentiality of any account credentials you use to access the Shop.
14. Changes to This Policy and Contact Information
14.1 PicsArt may update or modify this Policy from time to time to reflect changes in our practices, the Shop’s configuration, applicable law, or regulatory guidance. When we make changes, we will post the revised Policy on the Shop with an updated effective date at the top of the document.
14.2 Where a change is material, we will provide notice through reasonable means before the change takes effect, such as a prominent notice on the Shop, an email to the address associated with your account, or other communication permitted or required by applicable law.
14.3 Changes to this Policy apply on a prospective basis from the revised effective date, unless applicable law requires otherwise. Your continued use of the Shop after the revised effective date constitutes acknowledgment of the updated Policy. We encourage you to review this Policy periodically.
14.4 If you have questions, concerns, or requests regarding this Policy or our privacy practices, please contact us at:
PicsArt, Inc.
Optima Onyx Tower, Suite 1103
1010 South Federal Highway
Hallandale Beach, FL 33009
Email: store@picsart.com
We will respond to inquiries within the timeframe required by applicable law.
