Privacy policy
Last updated:
This policy explains what personal data RebelVisions collects, why, and what your rights are. I keep it short and only collect what the shop needs to work.
Who is responsible
What I collect and why
| Data | Why | Legal basis |
|---|---|---|
| Email address | Sign-in code, your library, order confirmations, delivering your packs and custom work, one reminder if an unused discount code is about to go to waste | Contract; legitimate interest (reminder) |
| Name and Instagram handle | Replying to a custom request and delivering it | Contract |
| Your brief and reference photo | Making the custom piece you asked for | Contract |
| Orders and payments | Delivering what you bought, your library, the free-pack reward, and my bookkeeping | Contract; legal obligation |
| Quest progress, coins, discount and referral codes | Giving you the cards and rewards you earned | Contract |
| Who referred you (their link) | Giving your friend their one-time discount | Legitimate interest |
| Technical logs (IP address, browser) | Keeping the site running and secure. Collected by my hosting provider. | Legitimate interest |
Payments are handled by PayPal. I never see or store your card or bank details. I don't sell your data and I don't use it for advertising.
Who processes data for me
- Netlify: hosting, the database behind your account, and the request form.
- Resend: sending emails such as sign-in codes and order updates.
- PayPal: payments. PayPal is responsible for its own processing.
- Google Fonts: the fonts on this site load from Google, which receives your IP address.
Some of these companies are based in the United States. Transfers are covered by the EU–US Data Privacy Framework or standard contractual clauses.
How long I keep it
- Your account, library and codes: as long as you have an account. Ask me and I'll delete it.
- Custom requests and reference photos: up to 2 years after delivery, so you can ask for tweaks or a re-download.
- Order and payment records: 7 years, because Dutch tax law requires it.
- Sign-in codes: 15 minutes. Sessions: 60 days.
Cookies and local storage
This site uses no tracking or advertising cookies. It stores a small sign-in token and your quest progress in your browser's local storage, only so the site works. If I add visitor statistics, I'll use a privacy-friendly tool that doesn't track you across sites, and I'll update this page.
Your rights
You can ask to see, correct, delete or receive a copy of your data, and object to or limit how I use it. Email and I'll reply within one month. If you think I handle your data wrongly, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).
Age
The shop is meant for people aged 16 and over. If you're younger, ask a parent or guardian before you buy or send a request.
Changes
If this policy changes, the new version appears on this page with a new date.