Privacy notice

Who is responsible

Melanie Grace Fleitas, with address at Lourdes 103, Col. Valle de San Ángel, 66290 San Pedro Garza García, Nuevo León, Mexico, is responsible for your personal data under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties. For anything about your data, write to hello@melaniefleitas.com.

What we collect

• Account: your email address, and a name for the account. Until a name is set, the account uses the part of your email before the @; it only appears in emails to you and in our admin pages.
• Orders: what you bought, amounts, dates, and the shipping name, phone number and address you enter at checkout.
• Payments: references to your payments and, if you save a card for auctions, a reference to that card. Your card number goes straight to Stripe and never reaches us.
• Auctions: your bids (amount and time). Other visitors only ever see you as "Bidder 1", "Bidder 2" and so on.
• Commissions: what you tell us about the painting you want (description, size, budget, date, where it will hang, and the places, music and books you share as inspiration) and the reference images you upload. Photos have their location and camera details removed when they are uploaded.
• Waitlist (/waitlist, /lista): your first name, email, and, if you give them, your city and what you are interested in (originals, prints, a custom painting), the language you want the emails in, the page you signed up on, and a record of your consent: when you gave it, the network address it came from and the version of this notice you agreed to. If you unsubscribe we keep that record, and when you withdrew, as proof of both.
• Sign-in: for each session, the IP address and browser it came from, to keep your account safe.
• 3D room: while you walk the 3D gallery, other visitors see a figure where you are standing. It is labelled "Visitor" unless a first name was chosen for your account; it is never your email or anything taken from it. Positions are not stored.
• Technical logs: error messages from the site, kept by our hosting provider for up to 7 days, with emails and web addresses' query strings removed.

We don't ask for sensitive personal data (health, religion, political views and similar). Please don't include it in commission requests or reference images.

Why we use it

Primary purposes, which are needed for the service you ask for:

• creating and securing your account and signing you in with a one-time code;
• selling you artworks and prints, charging for them and shipping them;
• running auctions: taking bids, charging the winning bid and shipping the piece;
• quoting, invoicing, painting and delivering commissions, and sending you progress updates;
• emailing you about your account, orders, bids and commissions;
• keeping the records Mexican tax law requires, and preventing fraud and abuse of the site.

Only if you join the waitlist, and only with the consent you give there (it is not needed for anything else on the site): emailing you news of the collection you signed up for, its price list, your early access (a personal link that opens the prices and buying for you before the public), an invitation to the opening, a short studio letter every two weeks and first notice of auctions.

You can withdraw that consent at any time: every one of those emails has a one-click unsubscribe link, or write to hello@melaniefleitas.com. Withdrawing doesn't affect anything else, such as your account or your orders.

Beyond that we don't send marketing, build profiles or use your data for anything else. If that ever changes we will ask first, and you can say no at any time by writing to hello@melaniefleitas.com.

Who else handles it, and where

We don't sell, rent or trade your data. These providers process it only on our behalf and under our instructions. They are outside Mexico, so your data is stored and processed abroad:

• Cloudflare, Inc. (United States, with servers worldwide): hosts the site, its database and files, routes our email, and keeps the technical logs.
• Stripe (Stripe, Inc., United States, and Stripe Payments Europe, Ireland): processes payments and saved cards, and receives your name, email and billing details for that.
• Resend (Resend, Inc., United States): delivers our emails, so it receives your email address and the message. For the waitlist it also keeps your first name, email and whether you are subscribed, so the studio letters can be sent from there.

Your shipping details also go to the courier that delivers your order. We only share data with authorities when the law requires it.

How long we keep it

Order records are kept for as long as tax law requires, usually five years. Everything else is kept while you have an account. When you delete your account (see below), your name, email, saved card, commission requests and their images are removed at once, and your past orders are kept only with amounts, dates, items and the state and country they shipped to.

Waitlist details are kept while you are on the list. If you unsubscribe, only the record of your consent and its withdrawal stays. To have it all deleted, write to hello@melaniefleitas.com; deleting your account also deletes a waitlist sign-up with the same email.

Your rights (ARCO) and how to use them

You can ask to access your data, rectify it, cancel it (have it deleted) or oppose a use of it. You can also revoke your consent, or ask us to limit how we use or share your data.

• The quickest way to delete everything we don't have to keep is the Delete my account page in your account.
• For anything else, email hello@melaniefleitas.com from the address on your account, or include a copy of an official ID (and, if someone writes for you, proof that they can). Say which right you want to use and which data it is about.
• We answer by email within 20 business days. If your request is granted, we carry it out within 15 business days after that answer. It is free, except for the cost of copies if you ask for them on paper.
• Some data can't be deleted while we still need it for an order in progress, or while the law makes us keep it (tax records). We will tell you if that is the case and for how long.

If you think we haven't respected your rights, you can complain to the Mexican data protection authority (since 2025, the Secretaría Anticorrupción y Buen Gobierno).

Cookies and browser storage

The site sets a cookie, __Secure-better-auth.session_token, only when you sign in, to keep you signed in for up to 30 days. It is needed for the site to work and is deleted when you sign out. If you open your personal early-access link from a waitlist email, the site sets fa_early in that browser, so it can show you the collection's prices and let you buy; it expires when early access ends. The 3D room remembers your touch-control settings and your viewing choice in your own browser; they never leave your device. There are no advertising, analytics or tracking cookies.

Changes to this notice

When this notice changes, we update it on this page with a new date at the top. If a change affects how we use the data you already gave us, we will also email account holders before it applies.