What data we process

Website analytics (cookieless): approximate technical data such as visited pages, timestamps, referrer, device/browser information, and IP address (which may be processed for security and analytics purposes).

Messages you send us: any personal data you include when contacting us via WhatsApp, Telegram, or other channels.

Why we process data

To understand how the website is used and improve it (analytics).

To respond to your inquiries and manage orders (communication).

To protect the website from abuse and ensure security (security).

Legal bases

Legitimate interests (Art. 6(1)(f) GDPR) for website analytics, security, and service improvements.

Contract / steps prior to contract (Art. 6(1)(b) GDPR) when you contact us to buy or commission a piece.

Legal obligations (Art. 6(1)(c) GDPR) when applicable (e.g., accounting).

Analytics (Umami)

We use Umami Analytics in a cookieless configuration and do not intentionally use cookies for analytics.

Umami may process technical and usage data (for example: IP address, browser/device characteristics, operating system, language preferences, referring URLs, timestamps, and pages viewed) for security, operation, analytics, and reporting purposes, as described in Umami’s privacy policy: https://umami.is/privacy.

Umami may derive approximate location from IP address (depending on configuration and device/network).

Hosting/location: [where Umami is hosted, e.g., EU region / your server].

Retention

Umami Cloud retains analytics data for a limited time depending on the plan (for example, 6 months on the Hobby plan): https://umami.is/pricing.

If we self-host Umami, retention depends on our configuration and deletion practices.

Contact and order communications are kept as long as needed to respond, fulfil orders, and comply with legal obligations.

Sharing and international transfers

We do not sell personal data.

We may share limited data with service providers necessary to operate the website and communication channels (e.g., hosting, messaging platforms).

If any data is transferred outside the EEA, we rely on appropriate safeguards (e.g., SCCs) where applicable.

Your rights

Depending on your situation, you may have rights to access, rectify, erase, restrict, object, and data portability.

To exercise your rights, contact us via WhatsApp or Telegram (see our Contact page).

You also have the right to lodge a complaint with your local supervisory authority (in Portugal: CNPD).