The short version

Before the detail

To send you a mug with a cat on it, we need your name, address, email and payment. That's the bulk of it. Everything beyond that is analytics and advertising, and you can opt out.

We don't sell your personal information for money. We do use advertising tools that share data with Meta and Google, which under some US state laws counts as "sharing" or "selling" — the section on your rights explains how to stop it.

We are established in Belgium, which means the EU General Data Protection Regulation applies to how we handle your data — whether you're in Ohio or Antwerp. Where US state privacy laws also give you rights, those are set out further down.

What we collect

And where it comes from

Information you give us

• Order details — name, delivery address, billing address, email address, phone number if you provide one, and what you ordered.
• Payment information — handled by our payment processor. We receive confirmation that payment succeeded plus the last four digits and card type. We never see or store your full card number.
• Account details — if you create one, your login credentials and saved addresses.
• Email sign-up — your email address, and your consent to hear from us.
• Correspondence — anything you write to us, including photos you send when reporting a problem with an order.

Information collected automatically

• Device and connection — IP address, browser type, operating system, and approximate location derived from IP.
• Browsing behaviour — pages viewed, time on page, what you clicked, what you added to your cart, and where you arrived from.
• Session recordings — we use Microsoft Clarity to record mouse movement, scrolling and clicks as anonymised session replays. Text you type into forms is masked. See the Cookie Policy for the full explanation.

Information from others

Our advertising and analytics providers may tell us that a visit came from a particular ad. Our fulfilment partners and carriers give us shipping and tracking updates. Our payment processor gives us fraud-risk signals on an order.

Why we use it

Purposes and legal bases

We do not use automated decision-making that produces legal or similarly significant effects on you. Fraud screening may flag an order for a human to look at; a person makes the call.

Who else sees your data

Our processors, and what they get

We're a small operation, which means we rely on other companies to run parts of the shop. Each of these receives only what it needs.

We may also disclose data where the law requires it, to enforce our terms, or if the business is ever sold or restructured. We will never trade your personal information for money.

Where your data goes

International transfers

Most of our providers are based in the United States, so your data is transferred outside the European Economic Area. Those transfers rely on the safeguards each provider maintains — Standard Contractual Clauses approved by the European Commission, and certification under the EU–US Data Privacy Framework where applicable.

You're entitled to a copy of the safeguards that apply. Ask us and we'll point you to them.

How long we keep it

Not indefinitely

• Order and transaction records — kept for as long as accounting and tax law requires, which in Belgium is generally seven years.
• Customer account data — kept while your account is open, and deleted on request.
• Marketing contacts — kept until you unsubscribe, then suppressed so we don't accidentally email you again.
• Support correspondence — typically two years, so we have context if you write again.
• Analytics and session data — retained according to each provider's own schedule, generally between one day and two years. Details are in the Cookie Policy.

Your rights

If you're in the EU, EEA or UK

Email us and we'll respond within one month. There's no charge, and no form. If you think we've handled your data badly, you can complain to the Belgian Data Protection Authority (gegevensbeschermingsautoriteit.be) or to the supervisory authority where you live.

If you're in the United States

Residents of California, Colorado, Connecticut, Virginia, Utah, Texas and a growing list of other states have rights over their personal information. Depending on your state, these include:

To exercise any of these, email us. We may need to verify your identity, usually by confirming details from a previous order. An authorised agent can act for you with written permission.

Security

What we do, honestly stated

The site runs over encrypted connections, checkout is handled on PCI DSS Level 1 certified infrastructure, and access to customer data is limited to the people who need it. Our providers maintain their own security programmes, which are considerably larger than ours.

Children

Not our audience

This shop is intended for adults. We don't knowingly collect personal data from anyone under 16. If you believe a child has given us their information, write to us and we'll delete it.

Changes to this policy

We'll date them

When we change how we handle data, this page changes with it and the date at the bottom updates. For anything significant we'll say so directly rather than quietly editing a paragraph and hoping nobody reads it.