Privacy

Your data, in short

We use what you give us to make and deliver your order and to help you. We don't sell it, we don't track you, and nothing about you is used for ads. Most of it is deleted 90 days after your order.

Who we are

Galeri.nl B.V., trading as Onlyonery, Osloweg 45, 9723 BH Groningen, the Netherlands, is responsible for your data in our shop and in every stall in it. Questions: hello@onlyonery.com.

What we use, why, and for how long

Your order: what you make in a stall, and your name, address and email, to make, deliver and put right your order. Ground: our contract (we can't deliver without them). Deleted 90 days after your order, or at once with "Delete my details". A cancelled order's details stay those 90 days too, so you can change your mind (legitimate interest). Order records and VAT invoices: 7 years (10 for Belgium or Germany), as the law requires.
Birth weight and length (Budling): health data, used only to print your poster. Ground: your explicit consent, given on the proof.
A Scribblemates deck: the group's drawings and names. Ground: the organiser's order, and for each drawer, legitimate interest. Kept 90 days after its last card or order.
A design you keep to order again: only if you choose to. Ground: consent (explicit for a Budling poster's weight and length). Kept until you stop, or 3 years after you last ordered it.
Talking to us: what you write or say in the chat, on the phone or by email, and photos you send. From calls, including ours with business partners, we keep a written transcript, never a recording. Ground: our contract or legitimate interest (a bug report: consent, a health detail: explicit consent). Kept 12 months (30 days if not linked to your email), files 180 days or 6 months after a claim, bug reports 90 days at most.
Our letter, and news when an idea opens: your email address. Ground: consent. Kept until you leave the list.
A review request, and a thank-you code: Trustpilot asks you once how your order went, and if someone new orders with the code from your parcel, we email you a code. Ground: legitimate interest. Trustpilot keeps your address 2 years at most, we keep it until that code runs out.
Keeping the shop safe: server logs, and scrambled codes made from your email or internet address, to stop misuse, to find your orders without an account and to see whether an email has ordered before. Ground: legitimate interest. Logs 14 days, codes 2 days to 12 months (the one that finds your orders as long as the order record, the one that remembers a no to reviews as long as we ask for them). Encrypted backups: a year at most.
Decisions Poppy makes: Poppy, our AI helper, can give a replacement, a code or a refund by itself under fixed rules. It never says no by itself: outside the rules a person decides, and you can always ask a person to look at a decision again. We make no profiles of you.

Who helps us

Each gets only what its part needs:

Print API (Groningen), our own print service: prints and ships your order, with the delivery company
Stripe: payments (we never see your card or bank details)
Lettermint (Zwolle): our emails
Trustpilot (Copenhagen): the review request
Anthropic (Dublin): AI models
Twilio: our phone line
Kadaster (Apeldoorn): Dutch addresses from a postcode and house number
Hetzner (Germany): our servers
Cloudflare: our domain, email forwarding and encrypted backups

Some of them handle data in the United States, the United Kingdom or Australia, under the EU's adequacy decisions (the United Kingdom, the EU–US Data Privacy Framework) or its standard contractual clauses.

Cookies

Only the ones the shop needs to work: for your basket (30 days), for the chat (30 days) and for an hour after you type your code on "Your orders". No analytics or tracking cookies. The checkout can remember your address in your browser until you tap "Forget this address on this device". Stripe's payment page sets its own cookies against fraud.

Your rights

You can ask to see, correct or delete your data, to limit or object to how we use it, and for a copy to take elsewhere. You can withdraw a consent at any time. And you can always object to what we do on our legitimate interest. Write to hello@onlyonery.com. You can also complain to a data protection authority, such as the Dutch Autoriteit Persoonsgegevens.