HEADPATshop
Sign in

Privacy policy

This policy explains what personal data Headpat Shop (headpat.shop and api.headpat.shop) processes, why, and what rights you have. It applies to Headpat Shop only; headpat.place and headpat.space have their own privacy policies.

1. Who is responsible

The controller is Dominic Stilma, trading as Headpat, Friedhofsweg 10, 49843 Uelsen, Germany. Email: help@headpat.shop. More details are in the imprint.

2. What we process and why

Your account. Email address, display name, password (stored only as a hash), two-factor settings, and, if you sign in with Google or Discord, the account ID, profile picture and sign-in tokens they give us. We need this to provide your account (Art. 6(1)(b) GDPR). Sessions are stored with the IP address and browser they were started from, to keep your account secure (Art. 6(1)(f)).

Orders. Email address, billing country and address, VAT ID if you give one, what you bought, amounts and tax, the license terms you accepted, and your consent at checkout together with the time and IP address. We need this to fulfil the contract (Art. 6(1)(b)), and tax law requires us to keep orders and invoices (Art. 6(1)(c)).

Downloads. For each download we log the time, IP address and browser. We keep this as evidence for refund requests and chargebacks (Art. 6(1)(f), our legitimate interest in preventing fraud).

Payments. Stripe processes your payment details. We never see your full card number. Stripe may check payments for fraud.

Sellers. Stripe handles identity verification and bank details for sellers. We store the Stripe account ID and its verification status, your shop details, and your sales and transfer records (Art. 6(1)(b) and (c)).

Commissions. When you request or take on a commission, we store the brief, the price, the conversation and every file either side uploads to it. Both sides see the conversation and files; the creator doesn't get the buyer's email address. Staff read them only to settle a dispute or a chargeback. We need this to provide the commission (Art. 6(1)(b)) and keep it as evidence while the payment can still be disputed (Art. 6(1)(f)).

Memberships. When you join a membership, we store the tier, the price, its status and dates, your consent when joining with the time and IP address, and the identifiers Stripe uses for your subscription and customer record. Stripe stores your payment method for the monthly charges. Creators see the display name of their members, never their email address. We log downloads of included products like other downloads. We need this to provide the membership (Art. 6(1)(b)) and keep the records as for orders (Art. 6(1)(c) and (f)).

Affiliates. If you join the affiliate program, we store your code, the country and Stripe account for your payouts, and which purchases you referred with your share of each. We need this to pay you (Art. 6(1)(b)) and keep the records as for orders (Art. 6(1)(c)). For a referred purchase, the creator sees that an affiliate earned a share and how much, and our staff see your code; you never see who bought.

Reviews, follows and notifications. Reviews are public with your display name. We store which shops you follow and the notifications we send you (Art. 6(1)(b)).

Reports and copyright notices. The details you give us, and for copyright notices the IP address they were sent from, to handle them and prevent abuse of the form (Art. 6(1)(c) and (f)).

Product views. To count views without tracking you, we combine the date, your IP address and browser with a secret key and keep only the resulting hash, for at most two days. Only daily totals per product remain (Art. 6(1)(f)).

Emails. We send account, order and shop emails through Microsoft Exchange Online. If you contact support, we keep the conversation to answer it.

Analytics. Only if you allow it (see section 3) we use Google Analytics to understand how the shop is used (Art. 6(1)(a)). We do not use advertising features. Addresses of order pages are shortened before they are sent, so Google does not see order links.

3. Cookies and similar storage

Necessary (§ 25(2) TDDDG, always on):

  • the session cookies that keep you signed in, and short-lived cookies used during sign-in, two-factor checks and staff impersonation,
  • hp_consent, which stores your cookie choice,
  • hp-locale and hps_country, your language and the country used for prices,
  • hp_hint, which tells the page whether you are signed in so it can render correctly,
  • sidebar_state, and the browser storage keys hps.sidebar.collapsed and hps.view.*, which remember the dashboard layout and saved table views,
  • on the checkout page, Stripe's __stripe_mid and __stripe_sid, which Stripe needs to prevent payment fraud.

Analytics (only with your consent): Google Analytics sets _ga and _ga_<id> cookies. If you withdraw consent, we stop Google Analytics and delete these cookies.

Marketing (only with your consent): hp_ref remembers the affiliate link that brought you here, for 30 days, so the affiliate can be credited if you buy. Withdrawing consent deletes it.

You can change your choice at any time with Cookie settings in the footer.

YouTube videos. Some products show a YouTube video. The video is only loaded, from youtube-nocookie.com, after you click it. Until then, nothing is sent to Google.

4. Who receives data

  • Stripe (Stripe Payments Europe Ltd., Ireland) for payments, tax calculation, invoices and seller payouts.
  • Microsoft (Microsoft Ireland Operations Ltd.) for sending email through Exchange Online.
  • Google (Google Ireland Ltd., and Google LLC in the USA) for Google Analytics, only with your consent, and for Google sign-in if you use it.
  • Discord (Discord Inc., USA) for Discord sign-in if you use it.
  • Sellers receive your email address only when you get a free product that is offered in exchange for it, which checkout asks you to agree to. Otherwise they see the order without your contact details.
  • Our tax advisor and authorities, where the law requires it.

Our servers and file storage are run by Headpat itself.

5. Transfers outside the EU

Google LLC, Stripe, Inc. and Discord Inc. are based in the USA. Transfers to them rely on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the EU standard contractual clauses.

6. How long we keep data

  • Account data: until you delete your account.
  • Orders and invoices: 10 years, as German tax law requires. After you delete your account, they are no longer linked to it.
  • Download logs and checkout consent records: as long as the order they belong to.
  • Commission conversations and files: as long as the commission's order exists, so they remain evidence for disputes.
  • Product view hashes: at most two days.
  • Analytics data in Google Analytics: 14 months.

7. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, and to object to processing based on our legitimate interests. Where we rely on your consent, you can withdraw it at any time with effect for the future.

Write to help@headpat.shop to use these rights. You can also complain to a data protection authority, for example the one for our location: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover.

8. Changes

We update this policy when what we do with data changes. The date at the top shows the last change.