Privacy policy
Vermillion Aurora Productions is operated by TJ Murphy. This policy explains how I handle information when you visit this website, place an order, or contact me about a commission. Effective October 2, 2026.
For privacy questions, access, corrections, or deletion requests, email tj@tjm.art. Please use the email associated with your inquiry or order and include its reference when available. Do not send payment card details or identity documents. I may ask for limited information to verify a request.
Information collected and why
- Inquiries and commissions: your name, email, message, requested size, and any reference or palette images you choose to upload, used to reply, quote, and make the work.
- Testimonials: the optional name, email, words, optional city, state and country, photos and video you send through the testimonials form. There is no consent checkbox: by sending the form, under the notice just above its button, you agree that your name (if you give one; otherwise it shows as “A collector”), words, photos and city/region (as an approximate city-level map pin — never a street address) may be published after I review them; your email is optional, never published, and used only to thank you and send your print code (without one, no code is sent). Location and other camera metadata are removed from photos on upload. If you send a video, you choose separately whether I may show it on tjm.art and whether I may share it on my social media; with neither, it is only for me. The recording location is removed from videos on upload. Videos on testimonials I haven’t approved are deleted after 90 days, and unfinished uploads after 24 hours. Ask me at any time to edit or remove a testimonial, and I will delete it, its photos and any video.
- Orders: contact and delivery details, selected products, totals, payment references and status, and fulfillment records, used to calculate shipping and tax, process purchases, deliver artwork, and handle support, refunds, and accounting. Order details (items, amounts, and the buyer’s name and email) are recorded in the owner’s QuickBooks Online accounting.
- Website operation: hosting and security services may process IP addresses, browser details, request times, and technical logs to serve and protect the site. Essential browser storage keeps your cart and checkout recovery information.
Payment credentials are entered with the payment provider. This website does not store full payment card numbers or card security codes. Bitcoin transactions may be visible on public networks; those records cannot be erased by this website.
Service providers
Information needed to operate the service is shared with Cloudflare (hosting and private storage), Google/Gmail (correspondence and order email), Square, PayPal, or BTCPay Server and its hosting provider (payments), Buttondown (the email newsletter, only if you subscribe), the Washington State Department of Revenue’s sales tax rate lookup (for orders shipping to Washington, only the shipping street address, city, and ZIP code are sent, to find the tax rate), Intuit QuickBooks Online (the owner’s accounting), Shippo, the selected carrier, and shipping insurance partners when used (shipping and claims), and FinerWorks (print production and delivery). A provider receives the information needed for its role and may also have its own legal obligations and privacy terms. Services may process information in the United States or other countries where they operate.
Google Fonts requests send technical connection information to Google. Embedded YouTube videos may send connection information to Google when loaded; the embeds use YouTube’s privacy-enhanced domain. External links, including Amazon and social platforms, are governed by those services once you follow them.
Your photos and marketing choices
Submitting an inquiry or making a purchase does not subscribe you to marketing. I do not sell your personal information or share it for targeted advertising. I will ask separately before using your private reference photos, name, or customer story in public promotion. You can withdraw that permission by emailing me; withdrawal does not reverse a use already made with your permission.
Upload only images you are entitled to share and avoid unnecessary sensitive information. New website uploads are stored privately and are not attached to notification emails. Only authorized management access can retrieve them.
How long information is kept
Commission reference and palette uploads are scheduled for deletion 90 days after a commission is marked complete or cancelled, unless a different retention period has been agreed with you. Unaccepted inquiries expire after 90 days. Active projects have a dated retention review so their references are not kept indefinitely. Automated cleanup runs daily; deletion may take up to 24 hours after the scheduled date.
Reference copies already in older emails or downloaded working files are removed separately as part of closing the commission. A necessary copy may be retained longer for a specific legal obligation or unresolved dispute; it will not be used for promotion without permission.
Correspondence and necessary transaction, tax, payment, and shipping records are kept for support, accounting, and legal obligations, and reviewed for deletion when no longer needed. These records are separate from commission image retention. Providers may retain records under their own obligations. If a deletion request cannot be fulfilled in full, I will explain what must be retained and why.
Browser storage and your choices
The site uses local and session storage for your cart, reservation credentials, and payment recovery. You can clear this site’s data through your browser settings. That clears local recovery information; it does not cancel an order, delete accounting records, or reverse a payment. Save your order reference first and contact me if you need help recovering an order.
You can browse without submitting an inquiry. Required delivery and contact details are needed to complete an online purchase. You may request access to or correction or deletion of personal information, and raise a concern with the relevant privacy authority where applicable. I aim to acknowledge requests within two business days and respond within 30 days, subject to any shorter applicable deadline.
Security and policy updates
I use encrypted connections, restricted access to private storage, and service providers appropriate to the task. No online service can guarantee absolute security. If this policy changes, the effective date here will change; material changes affecting an existing order or permission will be communicated as appropriate.