Privacy policy

What this site collects, which is very little, and what happens to it.

1. Controller

2. Server log files

Our hosting provider automatically records data your browser sends when you open a page:

• IP address
• Date and time of the request
• The page requested and the amount of data transferred
• Browser type, version and operating system
• Referring page, where your browser sends one

Purpose and legal basis: operating the site securely and diagnosing faults. Art. 6(1)(f) GDPR, our legitimate interest in a site that works and is not being attacked.

Retention: logs are deleted after 7 days unless a specific security incident requires keeping them longer.

3. Hosting

This site is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Vercel processes the log data above on our behalf as a processor under Art. 28 GDPR, on the basis of a data processing agreement. Because Vercel is based outside the EU, transfers are covered by the EU Standard Contractual Clauses and Vercel's participation in the EU-US Data Privacy Framework.

Our domain and email are with ALL-INKL.COM, Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. Messages you send us are stored in that mailbox, on servers in Germany.

4. Visitor statistics

We use Vercel Web Analytics to see roughly how many people visit and which pages they read. It is cookieless: no cookie or similar identifier is stored on your device, no profile is built, and individual visitors are not recognised across visits or across sites.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in knowing whether the site is being read at all. Because nothing is stored on or read from your device, § 25 TDDDG does not apply and no consent banner is required.

We also use Google Search Console to see which search terms bring people here. Search Console works from Google's own search data and sets no cookies on this site. Verification is a token in the page source, nothing more.

5. Contact form and email

If you use the contact form we receive the name, email address and message you enter, so that we can answer you. The same applies if you write to us directly by email or phone.

Legal basis: Art. 6(1)(a) GDPR, your consent, which you give by ticking the box on the form and can withdraw at any time. Where the enquiry concerns an existing or prospective order, Art. 6(1)(b) GDPR also applies.

Retention: enquiries are kept for up to 24 months so we can pick up an earlier conversation, then deleted. Where statutory retention periods apply, for example to commercial correspondence, those take precedence.

Processor: the form is handled by Formspree Inc., 1007 N Orange St, 4th Floor, Wilmington, DE 19801, USA, which receives your entries and forwards them to us by email. Formspree acts as our processor under a data processing agreement, and the transfer to the USA is covered by the EU Standard Contractual Clauses. If you would rather not use a US processor, email or phone us directly using the details in section 1 instead.

6. No cookies, no advertising

This site sets no cookies. There is no advertising, no retargeting, no social media pixel and no cross-site tracking of any kind. The only measurement is the anonymous, cookieless statistic described in section 4.

Fonts are self-hosted on our own server. No request goes to Google Fonts, a CDN, or any other external host while you browse.

7. Links to Etsy

Prints are sold through our shop on Etsy. Following a link from this site takes you to etsy.com, where Etsy Ireland UC becomes the controller for your data and Etsy's own privacy policy applies. We receive no personal data about you from Etsy, only aggregate sales figures for our own shop.

Etsy sets its own cookies once you arrive there. That happens on Etsy's site, not this one, and only after you choose to follow the link.

8. Your rights

Under the GDPR you have the right to:

• Access (Art. 15): ask what data we hold about you
• Rectification (Art. 16): have inaccurate data corrected
• Erasure (Art. 17): have your data deleted
• Restriction (Art. 18): limit how we use your data
• Data portability (Art. 20): receive your data in a machine-readable form
• Object (Art. 21): object to processing based on legitimate interest
• Withdraw consent (Art. 7(3)): at any time, without affecting processing already carried out
• Complain (Art. 77): to a supervisory authority

To exercise any of these, email hello@puppn.com. The supervisory authority for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin.

9. Changes

If the site changes in a way that affects data processing, for example if a cookie-based analytics tool is ever added, this policy is updated first, the change is described here, and a consent banner is added before anything of that kind loads.

Last updated 28 August 2026.