Privacy policy

The controller under the GDPR is the operator named in the imprint. For anything about your data, write to the email address given there.

Orders: name, delivery and billing address, email, phone number, the design you ordered and payment status. We need it to make, ship and invoice your order. Legal basis: contract (Article 6(1)(b) GDPR) and legal obligation (Article 6(1)(c)).

Account: email address, display name, optional profile text, your saved designs and addresses. Legal basis: contract.

Order emails: confirmation, shipping and tracking messages. Legal basis: contract. We send marketing email only if you opt in, and you can withdraw at any time.

Security and operation: server logs and rate limits that keep the site working and protect it from abuse. Legal basis: legitimate interest (Article 6(1)(f)).

Google (Firebase and Google Cloud): hosting, sign-in, the database and file storage. Google Ireland Limited and Google LLC.

Stripe: payment processing. Card details go to Stripe directly. We never see or store your card number. Stripe Payments Europe, Ltd. and Stripe, Inc.

Resend: sending transactional emails such as order confirmations.

Carriers: your name, delivery address and, where needed, phone number are passed to the carrier that delivers your parcel.

Google Analytics 4: only if you switch analytics on in the cookie card. It is not loaded otherwise.

We count visits with a small first-party counter of our own. It stores totals per day and per hour, for example how many times a page was opened. It stores no user ID, no IP address, no session ID and nothing per visitor, and it sets no cookie.

Because it holds only totals, we do not ask for consent for it. Google Analytics is separate and needs your consent.

The cookies we set and what each does are listed on the cookies page. You can change your choice at any time from the footer.

Google and Stripe are US companies and may process data in the United States. Such transfers rely on the EU–US Data Privacy Framework or on standard contractual clauses.

Order and invoice data is kept for the statutory accounting period, which is seven years in Austria and eight years in Hungary. Account data is kept until you delete the account. Carts expire after 60 days without changes. Server logs are kept for a short period and then deleted.

You can ask for access to your data, correction, erasure, restriction of processing, and a copy in a portable format. You can object to processing based on legitimate interest, and withdraw consent at any time.

Signed-in customers can export or delete their data from the account page. Otherwise write to us.

You can complain to a data protection authority. In Austria this is the Datenschutzbehörde. In Hungary it is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH). You can also complain to the authority in your own country.

The shop is meant for adults. We do not knowingly collect data from children.

If we change what we process, we update this page and the date below.