Privacy policy

1. Controller

The controller for data processing on this website under Art. 4(7) GDPR is:

2. The key points

• We use no analytics tools and no tracking cookies.
• Fonts are stored on our own server. Loading a page sends no requests to Google.
• We collect data only as far as we need it to run the website, or for your order, your account, your review or the newsletter you confirmed.

3. Hosting and server logs

The website is hosted by Vercel. Each visit necessarily involves processing access data: IP address, date and time, requested address, status code, browser and operating system, and the page visited before (referrer).

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is delivering the website securely and reliably and detecting attacks. Logs are kept only as long as necessary for this and are then deleted automatically under the hosting provider's retention settings.

4. Cookies and browser storage

We set only cookies that are strictly necessary for the service you ask for:

• Login cookies (names starting with “sb-”): keep you signed in after login. They are set only when you sign in and end when you sign out or the session expires.
• Language cookie (“lang”): remembers the language you chose.

Your browser also keeps your bag and your entries in the checkout form in its local storage (localStorage). This data stays on your device until you delete it in the browser; it reaches us only when you place an order.

The legal basis for storing and reading on your device is § 25(2) no. 2 TDDDG (German telecommunications and digital services data protection act), and for further processing Art. 6(1)(b) and (f) GDPR. Because all of this is strictly necessary, we need no consent and show no cookie banner.

When you pay, your browser loads the payment buttons directly from PayPal. PayPal receives your IP address and technical browser data and may set its own cookies. See section 6 and PayPal's privacy statement for details.

5. Customer account and authentication logs

For a customer account we process your email address and your login details. Accounts and login run through Supabase. This creates authentication logs with the time, type of event (for example login or failed attempt), IP address and browser identifier.

The legal basis for the account is Art. 6(1)(b) GDPR, and for authentication logs Art. 6(1)(f) GDPR (protecting accounts against unauthorised access). The account exists until you delete it. Authentication logs are deleted automatically when the service's retention period ends.

After you delete your account

If you delete your account, we delete it and remove your email address from the order records in our database. Two things remain:

• A hash of your device's IP address is kept for 14 days and then deleted. It is a keyed hash from which the IP address cannot be recovered, but it still counts as personal data. It serves to prevent fraud, for example repeatedly creating and deleting accounts. The legal basis is Art. 6(1)(f) GDPR.
• Order and invoice data we are required to keep (section 7).

6. Orders, payment and shipping

For an order we process your name, delivery address, email address, ordered items, amounts, order number and the PayPal and Printful reference numbers. The legal basis is Art. 6(1)(b) GDPR (performance of a contract). We cannot carry out the order without this information.

For payment by bank transfer we receive your name, IBAN, the amount and the reference from your bank. Your bank processes the payment as a controller in its own right. We store your delivery address until it is passed to Printful. If an order is not paid and is canceled, we delete it.

• Supabase stores orders in our database.
• PayPal processes the payment and is a controller in its own right for this (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg). PayPal receives payment and order data and may carry out credit and fraud checks under its own rules. PayPal's privacy statement applies.
• Printful prints and ships the goods from fulfilment centres in the EU (Latvia, Spain). For this, Printful receives your name, delivery address and email address as well as the ordered items.
• Resend sends the order confirmation and other emails about your order.

We store a discount code with the associated email address, the PayPal reference number and the time of redemption, so it can be redeemed only once (Art. 6(1)(b) and (f) GDPR).

A voluntary tip runs as a separate payment through PayPal and is linked to your order number.

7. Retention of order data

We keep order and invoice data as far as § 147 AO (German Fiscal Code) and § 257 HGB (German Commercial Code) require: depending on the type of record, 6 years (commercial and business letters), 8 years (accounting vouchers) or 10 years (books and financial statements). The period starts at the end of the calendar year in which the record was created.

The legal basis is Art. 6(1)(c) GDPR. Neither an erasure request nor deleting your account ends this obligation (Art. 17(3)(b) GDPR): invoices and vouchers stay with PayPal and in our bookkeeping even after account deletion until the period has expired. During that time we use them only to meet these obligations.

8. Withdrawal

If you withdraw from a contract, we process your name, the order number, your email address, any message you add, and the date and time of receipt. We need this to handle the withdrawal and confirm receipt to you (Art. 6(1)(b) and (c) GDPR, § 356a BGB). We keep this data as long as the related order data (section 7).

9. Newsletter

You receive the newsletter only with your consent (Art. 6(1)(a) GDPR) and through double opt-in: after signing up we send an email with a confirmation link, and you are subscribed only after clicking it. The subscription is stored in Supabase and sending runs through Resend.

To be able to prove consent (Art. 5(2) and Art. 7(1) GDPR), we log the email address, language, the wording of the consent, a hash of your IP address, and the times of sign-up, confirmation and unsubscribing. The legal basis for this is Art. 6(1)(f) GDPR.

You can withdraw consent at any time with effect for the future, using the unsubscribe link in every email or by writing to Purrlightshop@gmail.com. We then send no more newsletters. We keep the consent log as long as the proof may legally be needed, usually until the regular limitation period ends (§§ 195, 199 BGB).

10. Reviews and photos

If you submit a review, we process the order number, email address, display name, star rating, text and up to two photos, and the time of your consent. Order number and email address are used to check that the review belongs to a real order and are not published. Display name, rating, text and photos are publicly visible on this website.

The legal basis is your consent (Art. 6(1)(a) GDPR). We store the photos as WebP files in publicly accessible storage at Supabase. Please do not upload photos showing other recognisable people without their agreement.

You withdraw consent by deleting the review through the deletion link in our email or by writing to Purrlightshop@gmail.com. The review and photos are then deleted. Individual photos cannot be removed separately, only the whole review. Otherwise reviews stay stored until they are deleted.

11. Protection against abuse

To protect forms and interfaces against mass requests and abuse, we count requests per IP address and store markers at Upstash Redis. The counters contain the IP address and expire after about one minute. Abuse-prevention markers stored for longer contain the IP address only as a keyed hash. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the security of the shop.

12. Print artwork

Our print artwork is hosted at ImgBB. Only graphics are stored there, and no personal data about you.

13. Recipients

The following service providers process personal data on our behalf and on our instructions (Art. 28 GDPR):

• Vercel (USA): hosting and server logs
• Supabase (USA): accounts, orders, reviews, photos, newsletter consents
• Upstash (USA): Redis for rate limiting and abuse prevention
• Resend (USA): sending email
• Printful (USA, fulfilment in Latvia and Spain): production and shipping; receives name, address and email address

PayPal processes payment data as a controller in its own right. We pass data to authorities only if the law requires it. Data is not sold.

14. Transfers to third countries

With providers based in the USA, data may be transferred to the USA. Such transfers rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the provider is certified under it, and otherwise on the Commission's standard contractual clauses (Art. 46(2)(c) GDPR). You can request a copy of the safeguards at Purrlightshop@gmail.com.

15. Your rights

You have the following rights. To use them, write to Purrlightshop@gmail.com.

• Access to your data (Art. 15 GDPR)
• Rectification of incorrect data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR), unless a statutory retention duty applies
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR); processing up to then remains lawful

Right to object (Art. 21 GDPR)

Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims.

16. Complaint to a supervisory authority

You can complain to any data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, your place of work or the alleged infringement. The authority responsible for us is the data protection authority of the German federal state where we are based. A list of German authorities is available from the Datenschutzkonferenz.

17. Obligation to provide data and automated decisions

You can use the website without an account. We need the details requested in the order, account and review forms for the purpose in question; without them that purpose cannot be met. There is no further statutory obligation to provide them. We do not use automated decision-making under Art. 22 GDPR or profiling.