Privacy policy

This policy covers visits to shop.hacking.art and enquiries about the shop. Purchase through Paddle. Download starts after confirmed payment; the download link is valid for 1 hour. Prices include applicable taxes. No shipping costs.

1. Controller

Yannick Westphal · Hacking Art®
Kätnerwiese 5c, 22393 Hamburg, Germany
Email: mail[ät]hacking.art

To send an email, replace “[ät]” with the usual at sign.

2. Website and hosting

Page requests involve processing an IP address, timestamp, requested file, browser and operating system information, and potentially the referring page. We use this information to deliver the site and identify technical problems or abusive access. Our legitimate interest in secure, reliable operation is the basis under Art. 6(1)(f) GDPR.

Hosting is provided by netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. The provider processes the data required for hosting. See netcup’s privacy policy.

Following the main website’s policy, server logs are deleted or anonymised within 30 days. Entries needed to investigate a specific security incident may be retained until it is resolved.

3. Email enquiries

We use your sender address, message and voluntary details to answer your enquiry. Product and contract enquiries are processed under Art. 6(1)(b) GDPR; other enquiries are processed under Art. 6(1)(f) GDPR for our interest in responding. We delete this data once the matter is resolved, unless retention or evidence obligations apply. Legally required retention is based on Art. 6(1)(c) GDPR.

4. Cookies, external content and administration

The shop sets no cookies of its own and uses no advertising trackers. The language choice is carried in page URLs. Artwork previews and shop assets are served by this website. External links connect to their providers when opened. Paddle checkout is described below. Product administration runs locally at the operator and does not record visitor or buyer data.

Website analytics with GoatCounter

We use GoatCounter at stats.hacking.art to understand which shop pages are visited and improve the shop. Your browser loads the analytics script from that address and sends pageview requests there. Technical data such as your IP address is processed to handle these requests. GoatCounter provides statistics about pageviews and, depending on its server settings, browsers, devices and approximate locations. Its standard visitor counter does not use cookies or browser storage and does not store raw IP addresses in its analytics database. See the GoatCounter data processing documentation.

Our integration sends only the page path without query parameters or fragments, and suppresses the referring-page value. We do not send buyer email addresses, transaction IDs, purchase proofs or download links, and do not track purchases or button clicks as analytics events. Processing is based on our legitimate interest in understanding use of and improving this art shop under Art. 6(1)(f) GDPR. You may object using the contact details above.

5. Paddle checkout

When you select BUY, we load Paddle.js from cdn.paddle.com to open the checkout. Your browser connects to Paddle and transmits technical data such as your IP address. Paddle processes checkout and payment details as an independent controller. Necessary checkout storage is used to provide the payment service you request.

The download service verifies signed payment confirmations and stores transaction IDs, purchased product references, file versions, expiry times and hashed purchase proofs. It does not fetch your email address to deliver files. Download links are valid for 1 hour. Processed events, purchase proofs and expired orders are removed after 30 days; unprocessed events remain pending for clarification. Processing serves contract performance (Art. 6(1)(b) GDPR). Your browser tab stores the purchase proof in sessionStorage so a reload can restore your download. This storage is used only for the requested purchase and not for marketing.

For purchases through Paddle, Paddle acts as reseller and processes checkout and payment data as an independent controller. Its privacy notice describes recipients, retention, international transfers and safeguards.

Optional newsletter

After download confirmation, we offer a link to the existing newsletter signup form on hacking.art. Signing up is voluntary and independent of your purchase. No buyer email address or purchase reference is passed to that form. Only when you open the link does your browser connect to the main website. Entering your address and subscribing happens there; see the main website privacy policy. You can unsubscribe at any time.

6. Your rights

Within the scope of applicable law, you may request access, correction, deletion, restriction and data portability. You may object to processing based on legitimate interests for reasons relating to your particular situation. Any consent you give may be withdrawn for the future.

You may complain to a supervisory authority, including the Hamburg Commissioner for Data Protection and Freedom of Information. Please direct privacy enquiries to the contact above.

Technical request data is needed to deliver the site; additional information in enquiries is voluntary. The shop itself does not make solely automated decisions with legal or similarly significant effects.

Updated: 13 September 2026. Hosting and log information is based on the main website’s privacy policy.