Hey Lucky Label Co. · last updated November 1, 2026
Hey Lucky Label Co. ("Hey Lucky", "we") turns your photos into printed
stickers at stickers.heyluckylabel.com. This policy explains what we
collect, why, and what we do with it. The short version: we keep what we
need to make and ship your stickers, we don't sell it, and you can ask us
to delete it.
What we collect
Photos you upload. The artwork for your sticker. Photos often show people, pets and places — see "Your photos" below.
Order details. Email address, ship-to name and address, the sticker options you chose, and what you paid.
Payment. Handled by Stripe. Your card number never touches our servers; we keep only Stripe's payment reference.
Account details if you create one: email and a hashed password. Accounts are optional — guest checkout works with just an email.
Basic technical data the site needs to work: IP address, browser type, and the cookies below.
Your email, if you say yes to "Can we email you your designs?" on the preview screen or at checkout. We save it with your design, along with the exact wording you agreed to, so we can send the design emails described below.
Usage and advertising data (see "Analytics and advertising" below): which steps of the sticker flow you reach, the device and browser you use, and, for ad measurement, the fact that you placed an order and its value.
In-progress designs. We save your design as you go (photo, chosen look, size, cart) so a dropped connection or reload never loses it. Unfinished designs are deleted within 30 days.
Your photos
Your photo is used for one thing: making your sticker. To do that we
store it (encrypted at rest, on DigitalOcean servers in the United
States), generate the print file from it, and — if you pick an AI
effect — send it to Ideogram, the image-generation service that
renders the style (or fal.ai, if we've switched rendering engines). These services process the image to produce the render and
is bound by its own privacy terms;
we do not permit it to use your photo to train models where that choice is
offered to us. We never use your photos for advertising, publish them, or
share them with anyone else.
You must have the right to use any photo you upload, including the
permission of people who appear in it. Please don't upload photos of other
people's children without their parent's consent.
How we use your information
To make, print, pack and ship your order, and to answer questions about it.
To send order emails: confirmation, shipped, delivered.
If you said yes to "Can we email you your designs?": your previews right away, up to three reminders (1 hour, 1 day and 3 days later) if you don't finish your order, and "Your designs" emails after an order ships — the designs you printed, with one-tap reorder, and the ones you didn't print yet. That one yes covers all of them and nothing else: we don't send any other marketing email. Every one has an unsubscribe link (one tap, or your email app's unsubscribe button), and one unsubscribe stops them all; emails about an order you placed still arrive.
To understand where people get stuck in the sticker flow and fix it (analytics), and to measure which of our ads lead to orders (advertising).
To keep your designs available for reorder on your order page and, if you have one, your account.
To prevent fraud and abuse, and to keep the service running.
Who we share it with
Only the services that do the work, and only what each one needs:
Stripe — payment processing.
fal.ai and Ideogram — AI effect rendering (photo only, no name or address).
OpenAI — an automated safety check of each uploaded photo before we render it (photo only, no name or address). If the check flags a photo or can't run, a person at Hey Lucky reviews it before anything is made.
Mailgun — delivering order emails and the design emails you said yes to.
DigitalOcean — hosting and file storage.
USPS and UPS — shipping; they receive the ship-to name and address, and the package weight.
Shippo — buys postage and prints package labels; it receives the ship-to name and address and package details.
Analytics providers (PostHog and/or Google Analytics 4) — see below.
Advertising platforms (TikTok and Meta) — see below.
Our production partner who prints and cuts the stickers receives the print file and shipping label.
We do not sell your photos or your personal information for money. Sharing
order events with TikTok and Meta for ad measurement (below) may count as
"sharing" or "targeted advertising" under some US state privacy laws; you
can opt out as described below.
Analytics and advertising
We may use the following on this site. Each is switched on only when we
configure it, and this section lists every one we use:
PostHog (product analytics, and session replay with all typed text masked) and/or Google Analytics 4: page views and the steps of the sticker flow (upload, previews shown, look picked, added to cart, checkout started, paid). We use a pseudonymous ID, not your name, email or photo.
TikTok Pixel and Meta Pixel (Facebook/Instagram), plus their server-side Conversions API: when you view a design, add to cart, start checkout or place an order, the event and order value is sent to TikTok/Meta so they can tell which ads work. With the Conversions API we may send a hashed (scrambled) email address so the platform can match the order to an ad you saw; they receive the hash, not your plain email, and never your photo or address.
Opting out: if your browser sends a Global Privacy Control signal we
don't load the TikTok or Meta pixels. You can also email us to opt out of
ad measurement, use your browser's tracking protection, or adjust ad
settings with TikTok and Meta directly.
Cookies
hl_identity — an anonymous ID so your designs and orders stay with you between visits without an account. Lasts two years.
.AspNetCore.Identity.Application — keeps you signed in if you have an account.
Stripe sets its own cookies on the checkout step for fraud prevention (and Link, if you use it to save your details).
Browser storage (hl_design_token) — remembers your in-progress design on this device so a reload picks it back up.
When enabled: PostHog (ph_*), Google Analytics (_ga*), TikTok (_ttp) and Meta (_fbp, _fbc) cookies, as described under "Analytics and advertising".
How long we keep it
Orders — what you ordered, where it shipped, what you paid and the
print file we made — are kept so you can reorder and so we can handle
reprints and disputes. Every order is deleted seven years after it
was placed.
Photos and designs stay available for reorder while you have an
account. Uploads that never become an order are deleted within 30 days.
If you delete your account, within 30 days we delete your photos,
previews, designs and print files, and cut each of your orders down to the
minimum record we keep for tax: the order number, the date, the amounts
paid, the state it shipped to and Stripe's payment reference. Your name,
email, address, gift note and tracking details are erased. An order that
hasn't shipped yet is finished first. That minimum record is deleted seven
years after the order was placed.
Email us and we'll delete your photos and personal details on request; we
keep only that minimum order record.
Your choices
You can ask to see, correct, or delete what we hold about you at any time by
emailing [email protected]
from the address on the order. Residents of California and other states with
privacy laws have those rights under this policy too.
Children
The service is for adults. We don't knowingly collect information from anyone under 13.
Security
Connections are encrypted (HTTPS), files are stored encrypted at rest, and
payment data is handled entirely by Stripe. No system is perfectly secure;
if we learn of a breach affecting your data we'll tell you.
Changes
If this policy changes in a way that matters, we'll update the date above and note it on this page.