Privacy Policy

This is a courtesy translation. The German Datenschutzerklärung is the legally binding version under the GDPR (DSGVO).

1. Controller

Michelle Yasmine Laskowski, Michis Illustrations
Carlssonweg 9c, 22147 Hamburg, Germany
Email: hello@michisillustrations.com

2. Hosting

This static site is served via Cloudflare Pages (see section 7 for the processing agreement and international transfer basis). Cloudflare automatically collects server log data (IP address, timestamp, browser type, referrer) on every visit, used solely to keep the site running securely (Art. 6(1)(f) GDPR). STRATO separately hosts our email mailbox and handles domain forwarding, but is no longer involved in hosting the static site.

3. Cookies and fonts

We use no analytics or marketing cookies. All fonts are self-hosted — no request is ever made to a third-party font service. Links to Instagram lead to their own site, governed by their own privacy policy.

4. Contact

Data you submit via email or the contact form is processed to handle your enquiry (Art. 6(1)(b) or (f) GDPR) and deleted once no longer needed.

5. Orders and payment (Stripe)

Payments are processed by Stripe Payments Europe, Ltd. (Ireland) on their own hosted checkout page — card details never touch our servers. Order and shipping data is shared for contract fulfilment (Art. 6(1)(b) GDPR); transfers outside the EU are covered by EU Standard Contractual Clauses, and a data processing agreement is in place.

6. Newsletter and transactional email (Mailjet)

We use Mailjet SAS (France, part of Sinch, Sweden) purely to send emails; the actual signup, list management, double opt-in, and unsubscribe logic runs in our own Cloudflare Worker. Mailjet's data centres are in the EU (Frankfurt and Saint-Ghislain, Belgium), hosted on Google Cloud as a sub-processor — a data processing agreement and EU Standard Contractual Clauses are in place for that, too. Newsletter signup uses double opt-in based on your consent (Art. 6(1)(a) GDPR) — revocable any time via the unsubscribe link. Once confirmed, your address is also added to a contact list at Mailjet so the newsletter itself can be composed and sent there; unsubscribes are synced in both directions. Order and shipping confirmations are sent independently under Art. 6(1)(b) GDPR. For sold-out pieces, you can request a one-time restock notification (Art. 6(1)(a) GDPR) — this is not a newsletter subscription, and the entry is deleted after the notification is sent, or after 180 days at the latest.

7. Infrastructure (Cloudflare)

Both the delivery of the static site (Cloudflare Pages, see section 2) and the dynamic parts of this site — cart checkout, contact, newsletter, and restock-notification submissions — run through Cloudflare, Inc. (US). For the dynamic parts, a Cloudflare Worker processes technically necessary data to relay your request to Stripe or Mailjet (Art. 6(1)(b)/(f) GDPR). Unlike before, the Worker now also stores newsletter/notification signups and order data itself (Cloudflare KV) — Cloudflare is therefore a processor for this storage as well, not only for relaying requests. Forms on this site are additionally protected against automated abuse by Cloudflare Turnstile, which sets no cookies and builds no usage profile (Art. 6(1)(f) GDPR). A data processing agreement is in place with Cloudflare.

Because Cloudflare, Inc. is based in the US, it may process data outside the EU for this purpose; the transfer relies on the EU Standard Contractual Clauses and on Cloudflare's certification under the EU-US Data Privacy Framework (DPF). There is no guarantee that processing occurs exclusively within the EU.

8. Your rights

You have the right to access, rectify, erase, restrict processing of, and port your data, and to object to processing. Consent can be withdrawn at any time. You may lodge a complaint with a data protection supervisory authority.

9. Changes

We may update this policy to reflect legal or operational changes.