Privacy Policy.

The short version.

We collect what an order needs and nothing else. There are no advertising pixels and no third-party trackers anywhere on this site — nothing here reports to Google, Meta or an ad network. We count visits ourselves, on our own server, with no cookie and nothing stored on your device. The only cookies we set are the one that keeps you signed in and the one that remembers your language. We do not sell or rent your data to anyone.

Who is responsible.

Peptheon, shipping from within the European Union, is the controller for the data described here. Write to [email protected] about anything on this page.

What we collect, and why.

• To fulfil an order — name, email, phone, delivery address and any note you add, plus the items, prices and payment method. Without these we cannot ship or confirm anything. Legal basis: performance of the contract.
• If you make an account — your email, your name and a hashed password (we never see the password itself), so you can sign in and see your order history.
• Payment — for a bank transfer we see what your bank shows on the payment; for crypto we store the invoice, the address, the amount and the transaction hash. We never see or store card details, because we do not take cards.
• Server logs — the usual request records our server and Cloudflare keep, including IP addresses, used to keep the site up and to block abuse. Legal basis: legitimate interest in a working, non-abused shop.

Cookies.

One functional cookie, set when you sign in, so the site knows it is still you on the next page, and one that remembers the language you picked. It disappears when you sign out or the session expires. There is nothing to consent to because there is nothing else — no advertising or profiling cookies, and the visitor statistics described below need no cookie at all.

How we count visits.

We keep our own basic statistics — which pages get read and for how long, which link brought someone here, roughly which country, and whether it was a phone or a laptop. A shop that cannot see what its visitors are looking for cannot get better at answering them. All of it runs on the same server as the shop: nothing is sent to Google Analytics or to any other company, and none of it leaves the European Union.

It sets no cookie and writes nothing to your device, so there is nothing to consent to and nothing to clear. To tell one visit apart from another we store a one-way hash of your IP address and browser, mixed with a secret that changes at every midnight — it cannot be turned back into your address, and the same visitor produces a different value tomorrow, so these records cannot follow anyone from one day to the next. They are deleted automatically after 180 days. Legal basis: legitimate interest in a working shop, using the least identifying method we could build.

Who else touches it.

• Contabo GmbH — the server the shop and its database run on, located in France, inside the EU.
• Cloudflare — sits in front of the site for security and speed, so requests pass through it.
• Resend — sends the order and account emails, and therefore processes your email address and the contents of those emails.
• The carrier — gets the name and address printed on the parcel, and nothing about what is inside beyond what the label legally requires.

Cloudflare and Resend are US companies, so some data reaches the United States under the standard contractual clauses in their data-processing terms. We use no other processors, and we never pass your data to advertisers or data brokers.

How long we keep it.

Orders and their invoices stay as long as accounting law requires. Account data stays until you ask us to delete the account. Server logs rotate away within weeks.

Your rights.

Under the GDPR you can ask for a copy of your data, have it corrected, have it deleted, restrict or object to how we use it, and receive it in a portable form. Write to [email protected] and we answer within one month. If you think we have handled your data badly you can complain to the data protection authority in your country.

One limit worth stating plainly: deleting an account does not erase an order we are legally required to keep a record of.