Privacy Policy

What we collect

"The Visitor Book" (email sign-up): your email address, an optional name, the language you browsed in, where you signed up, and the IP address of the request (kept only to prevent abuse of the sign-up form). Every email we send includes a one-click unsubscribe link tied to a private token — unsubscribing is immediate and does not require an account.

Booking, commission, reservation, waitlist requests, and a request to be told when a work still in the making is ready: your name, email, phone number, and whatever project details you write (size, mood, budget, deadline, occasion). These forms work anonymously — no account is required. Each request gets a private "cancel token" that is saved in your own browser (not sent anywhere else) so you can look up or cancel your own request later; if you later create an account, you can link past requests to it using the same token and email.

Contact messages: your email address and message text. We deliberately do not ask for your name on this form.

"Book of Impressions": an optional name, your message, and an optional mood — posted anonymously, not tied to your email or any request.

If you create an account: your email, a securely hashed password (we never store the plain password), and, for security, the IP address, browser, and approximate country/city of your login attempts and sessions — this is how we detect abuse and protect your account, not how we track your browsing.

Site analytics

We run our own first-party analytics — nothing is sent to Google, Meta, or any outside analytics company. We do not store your raw IP address for analytics at all: instead we compute a one-way, salted hash of a truncated IP range and your browser type that changes every day, so the same visit cannot be linked across days or matched back to an individual. We also record your approximate country (resolved from an offline database on our own server — your IP address is never sent to a third party to look this up), the page you viewed, your device/browser category, and, if you arrived via a link with tracking parameters, those parameters. Raw analytics events are kept for 30 days and then deleted; after that, only anonymous daily totals (like "how many visits from a given country") remain, with nothing that identifies an individual visit.

Cookies

This site does not use cookies. Sign-in and preferences (your wishlist, which pieces you have viewed, and the cancel tokens described above) are kept in your browser's local storage, which stays on your own device and is never automatically sent to us — it is only used when you submit a form or view a page that needs it.

Third parties

We do not share your data with advertisers, ad networks, or third-party analytics providers, because we do not use any. This website does not process payments directly — any deposit or payment for a commission is arranged with the artist personally, outside this website, so we never handle your card details.

How long we keep data

Raw analytics events: 30 days. Failed login attempts: 90 days. Login sessions: until they expire (30 days) or you sign out. Newsletter sign-ups, booking/commission/contact messages: kept until you ask us to remove them or, for the newsletter, until you unsubscribe — after which the record is marked inactive rather than immediately erased, so we do not accidentally re-contact you.

Your rights

You can ask us at any time to see, correct, or delete the personal data we hold about you, or to explain how it is used. For the newsletter, the unsubscribe link in any email does this instantly. For anything else — a booking, a commission, a contact message — write to the email address below and we will act on it promptly.

Children

This site is not directed at children. Every form that collects contact details — the newsletter sign-up, bookings, commissions, orders, waitlist requests, a request to be told when a work is ready, and account registration — requires you to tick a box confirming you are 16 or older before it will submit, and our server rejects the request if that box was not checked. This is a self-certification, not an identity check (we do not verify age documents), but it is an actual technical requirement enforced on both sides, not just a line in this policy.

Changes to this policy

If this policy changes, the "last updated" date at the top of this page will change too. We recommend checking back occasionally if you have an ongoing request with us.

Contact

Questions about your data, or a request to access/correct/delete it, can be sent to: