Privacy Policy

Last updated: 09.07.2026

1. Who we are

Karebu Art ("we", "us") is the controller responsible for your personal data under the General Data Protection Regulation (GDPR / DSGVO).

Contact for any privacy question or request: karebuart@3methxan.net.

2. What data we collect

Placing an order: name, shipping address, billing address, and email address, to fulfil and ship your order.

Commission requests: name, email address, a description of what you'd like commissioned, any reference image URLs you provide, and optionally a budget range and deadline.

Payment: card and payment details are entered directly into forms provided by Stripe, our payment processor - they pass through Stripe's own systems, and we never see or store your full card number.

Local browser storage: we store a cart identifier and a couple of UI preference flags (e.g. whether you've dismissed the cookie notice) in your browser's local storage. This is strictly necessary for the site to function and isn't used for tracking - see the cookie notice for details.

We do not currently run any analytics, advertising, or tracking cookies/scripts.

3. Why we process your data

To fulfil a contract with you (processing and shipping orders and commissions) - GDPR Art. 6(1)(b).
To respond to your commission inquiry before any contract is formed - GDPR Art. 6(1)(b)/(f).
To comply with legal obligations, such as tax and accounting record-keeping - GDPR Art. 6(1)(c).

4. Who we share data with

Stripe (payment processing). Stripe may process your data outside the EU/EEA under its own applicable safeguards - see Stripe's privacy policy.

Cloudflare (image storage and content delivery for product photos).

Email (order confirmations, shipping updates, commission correspondence) is sent via our own self-hosted mail server, not a third-party email marketing platform.

We do not sell your data to anyone. Enough other places do. All men (gender neutral here) are born free and with a full set of dignities and rights, those cover your own data.

5. How long we keep it

Order records are kept for 7 years to comply with Austrian tax and accounting obligations (§132 BAO). Commission requests that don't result in an order are kept only as long as needed to respond to them, and can be deleted on request (see Section 6).

6. Your rights

Under the GDPR, you have the right to access, correct, delete, restrict, or export your personal data, and to object to certain processing. To exercise any of these, email us at karebuart@3methxan.net.

You also have the right to lodge a complaint with the Austrian data protection supervisory authority, the Datenschutzbehörde (DSB).

7. Children

This site is not directed at children, and we do not knowingly collect data from anyone under 16.

8. Changes to this policy

We may update this policy from time to time; the "last updated" date above will reflect the most recent revision.