Privacy

Who is responsible

Catcrafts, Netherlands. Contact details are on the imprint page. Catcrafts is the controller for everything described here; no other party is involved.

Orders

Placing an order stores what fulfilling it requires: your email address, the recipient name and shipping address, the country, and the order itself (product, amounts, timestamps, payment reference and status). Nothing else is asked for and nothing else is kept. The legal basis is the contract: this data is what shipping you an order and issuing an invoice consist of.

Neither payment method involves a payment processor, so there is no third party that Catcrafts hands your data to in order to get paid. Bank payment is an ordinary transfer from your bank to the account named on the order page: your own bank and Catcrafts' bank handle it, as they would any transfer you make, and Catcrafts has engaged nobody in between. Cryptocurrency payment involves no provider either: the order page shows a receiving address that belongs to Catcrafts, and paying it is a transaction on a public blockchain. Only the order record described above connects a payment to you, and that record stays with Catcrafts.

What Catcrafts records about a bank transfer is deliberately narrow: the payment reference you quoted, the amount, the date and the method. Your name and IBAN are visible to Catcrafts on its own bank statement, as they are to anyone who receives a transfer, but they are not copied into the shop's records and are not needed to confirm an order. The reference is what matches your payment to your order.

The order status page lives at an unguessable link. Anyone holding the link can read that order's status and totals, so treat it like a receipt on your desk and don't post it anywhere public.

How long it is kept

Order records that belong to an invoice are kept for seven years. That is the Dutch fiscal retention obligation, and it is the one case where a deletion request cannot be honoured early. Everything in an order that the tax records do not need is deleted on request.

An order that is never paid lapses; its record is kept briefly for abuse spotting and then has no reason to exist.

The order file is stored on machine hosted by hetzner, a GDPR compliant german cloud hosting service.

What this site does not do

No analytics in your browser. No cookies, none at all, which is why there is no cookie banner. No third-party scripts, no fonts loaded from anyone else's server, no embedded video, no social buttons, no advertising, no profiling, no automated decision-making.

Everything the browser loads comes from catcrafts.net. Paying does not send you anywhere else either: both payment methods are completed from the order page itself, so there is no payment provider's site in the middle. Following a link out, to a fediverse thread or to Forgejo, puts you on that site under its terms, and Catcrafts has no visibility into what happens there.

Server logs

The web server keeps ordinary request logs. Those exist to debug faults and spot abuse, and are not connected to order records or used to build any kind of profile.

Those logs are also this site's only analytics: a page of aggregate statistics, computed on the server, with visitor addresses anonymized before anything is stored. A tally like that is nothing to keep secret, so you are free to take a look yourself at https://catcrafts.net/analytics.

Your rights

Under the GDPR you can ask for a copy of what Catcrafts holds about you, have it corrected or deleted, restrict how it is used, object to its use, or ask for it in a portable form. Please contact privacy@catcrafts.net for this purpose.

Changes

This page has a date at the top. Anything that changes what is collected or why gets a new date, and you do not have to take the date's word for it: every previous version of this page, with the exact diff, is public at https://catcrafts.net/legal/privacy/history.