Privacy

Last updated 20 July 2026

The short version

We set no cookies and record no sessions. There is no account and no newsletter. Your bag is kept on your own device. We only hold personal data if you actively give it to us, which happens when you buy something, and that is described under “Bag and checkout” below.

Controller

Marcellus Bartsch
c/o Online-Impressum.de #4905
Europaring 90
53757 Sankt Augustin
Germany
Email: hello@moonleaf.art

Hosting and delivery

The pages are delivered by Cloudflare, on servers close to you. When a page is requested, the connection data needed to deliver it, including the IP address, is processed for the duration of that delivery and to defend against attacks. The legal basis is Article 6 (1) (f) GDPR, our legitimate interest in operating the site securely. Cloudflare acts as our processor under Article 28 GDPR.

Anonymous usage measurement

So that we can tell which pieces people find interesting, we measure usage with analytics we host ourselves on our own server. Nothing is passed to third parties. In detail:

• no cookies and no comparable storage on your device,
• no recognition beyond the current visit,
• your IP address is not stored,
• no session recording and no screen capture,
• we record anonymous events only: that a page was opened, which group of pieces was viewed, that a piece was put in the bag, that the bag was opened and that checkout was started.

None of this can be traced back to an individual. The legal basis is Article 6 (1) (f) GDPR, our legitimate interest in anonymous, cookie free measurement.

Bag and checkout

When you put a piece in your bag, that bag is stored on your own device, in your browser's local storage. It holds only what you put there: the piece, the quantity and the price. It is never sent to us, and it is not an identifier. This storage is technically necessary for a bag to work at all, so it needs no consent under section 25 (2) no. 2 TDDDG. You can clear it by emptying the bag.

Payment is handled by Paddle (Paddle.com Market Ltd, London, United Kingdom), which acts as the seller of record. When you go to checkout, Paddle's payment window opens and Paddle processes the data you enter there, including your email address, payment details and the country needed for value added tax. Paddle is the controller for that payment data and issues the invoice; see paddle.com/legal/privacy. We receive from Paddle the transaction, the items bought and your email address, and we store them on our own systems to deliver the files, to send the download link and to keep the records that tax law requires. The legal basis is Article 6 (1) (b) GDPR, performance of the contract, and for the records Article 6 (1) (c) GDPR.

The download link we send is signed and expires after 72 hours. We log that a link was used, with the order it belongs to and the country of the request, so that we can see misuse.

Your rights

You have the right to access, rectification, erasure, restriction of processing, objection and data portability, and the right to complain to a data protection authority. Write to hello@moonleaf.art. Please note that if you have not given us your address, we hold no data that could identify you.

Changes

If what we do with data changes, we update this page and the date at the top.