Their shop is linked to in the bio. They don't seem to have a privacy policy up on the site. When in the checkout form it links to the generic Shopify privacy policy. No hints to the fact that uploaded images are processed by third parties, as far as I can tell. That should be corrected for sure.

Yes this is extremely unresponsible if so. Fingerprints are legally protected biometric data in most juristictions.