Privacy policy

1. Controller

The controller is the owner of this website named in the Legal notice, with her contact email. The artist lives and works in Japan, where she prepares and ships orders.

2. What data we process

• When you visit: technical connection data (such as your IP address), processed by the hosting provider. The website does not use analytics or advertising cookies.
• If you buy: name, email address, shipping address, the work purchased, the amount and the payment status, passed on by PayPal. We never receive your card or bank details.
• If you leave a review: the rating, the comment and the name or alias you choose.
• If you write to the artist: whatever you include in your message.

3. Why and on what legal basis

We do not use your data for advertising and we do not sell it.

• Preparing, shipping and handling your order, including exchanges and returns: necessary to perform the purchase contract.
• Keeping sales records: legal obligation (for example, tax).
• Publishing your review: your consent, which you can withdraw at any time.
• Keeping the website secure and preventing abuse and fraud: legitimate interest.

4. Who it is shared with

• PayPal: processes the payment and handles your data as an independent controller, under its own privacy policy.
• Cloudflare: hosts the website and the private database for orders and reviews.
• GitHub: stores the public content of the website (works and texts) and gives the artist access to her panel. Orders and buyer data are not stored there.
• The carrier delivering your order: name and delivery address, and any data required by customs in the destination country.
• Authorities, where required by law.

5. International transfers

Orders are handled from Japan, a country the European Union recognises as providing an adequate level of data protection. The providers above may process data in other countries with the safeguards described in their own policies.

6. How it is protected

Order and review data is kept in a private database that only the artist can access, with her account and two-step verification. Connections are encrypted and your data is never published: from a review, only what you authorise is shown.

7. How long it is kept

Order data, for as long as needed to handle the order (including returns and claims) and to meet legal obligations. Reviews, while they are published or until you ask for them to be removed.

8. Your rights

You can ask to access, correct, delete or port your data, object to its use or ask for it to be restricted, and withdraw your consent, by writing to the email address in the Legal notice. You can also complain to the data protection authority in your country.

9. Changes to this policy

If this policy changes, the new version will be published here with its date.