Privacy policy

What we collect

• To make and ship your order: your name, delivery and billing address, email address, and your design. Payments run through Mollie. We receive the payment status and the amount, not your card details.
• If you create an account: your name, email address, an encrypted password, and whatever you save. That means your addresses, your designs, and your favourites.
• If you write a review: the name you put on it, plus the order number and the email address we use to check that the purchase is real.
• For our administration: the invoice for every order, with the name and address it was issued to.

How long we keep your data

We keep nothing for longer than it is meant for, with one exception the law imposes on us.

• Invoices and credit notes: seven years. Dutch tax law requires us to keep our administration for seven years, counted from the end of the financial year.
• Your account, your saved addresses, your favourites, your designs and their files, and your reviews: until you ask us to erase them. We keep them so you can reorder a piece you designed earlier, and for nothing else.
• A request for erasure: it takes effect at once, and after 30 days the data is destroyed.

Designs as personal data

A design is often more personal than an address. It carries a name, a date, sometimes a photograph. So we treat your designs and the files we make from them as personal data: they are in a copy when you ask for one, and they go when you ask for them to be erased.

Your rights (GDPR)

You have the right to receive a copy of your data, to have it corrected, and to have it erased. A copy and an erasure you request yourself, below, without emailing us and without needing an account. For a correction, contact us, because for that we need to know what is wrong.

If you disagree with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). We would rather hear it from you first, so we can put it right.

How a request works

You enter the email address you ordered with and choose a copy or an erasure. We send a link to that address. Following it proves the request is yours, because doing so needs access to the mailbox. The link expires after 24 hours. We never ask for a copy of your ID: that would create a bigger privacy problem than it solves.

The answer on the form is always the same, whether or not we know that address. If it differed, the form could be used to find out who has ordered here.

A copy is a ZIP file. Inside is my-data.json holding your account, your saved addresses, your orders with their invoices and any refunds, your designs including the full design itself, your reviews, and your favourites. Alongside it are the design files themselves, and a README.txt that explains in plain language what you have been given.

What an erasure does

The moment you confirm the request, your account closes and we stop using anything of yours. The data itself is destroyed 30 days later. That month is there so a request made in anger, or from a mailbox that is no longer only yours, can still be withdrawn. When you confirm, you get the link that does it.

Destroyed: your account, your saved addresses, your favourites, your designs and their files, your reviews (the product's rating is recalculated afterwards), your coupon redemptions, and your password reset tokens and sessions.

What stays are the invoices and credit notes, exactly as they were issued, including the name and address on them. Tax law requires us to keep our administration for seven years, and the right to erasure does not override a legal retention duty. Of the order itself almost nothing is left: the email address is replaced by one nothing can be sent to, the address is emptied except for the country (VAT depends on where something was sent), and the link to any account is removed.

Cookies and analytics

We do not measure your visit and use no analytics cookies. Marketing cookies are only set with your consent.