Skip to content
Maeker

Privacy & Cookie Policy

Last updated: 26 October 2026

This policy explains which personal data we process when you use Maeker (www.maeker.eu), why we process it, and what rights you have. It applies to buyers, guests, Maekers (sellers) and anyone applying to sell.

Who is responsible

Pelikano Online, owner Daniel Pelikan
Oberfeldstrasse 62b/1, 4600 Wels, Austria
Email: privacy@maeker.eu

We are the controller for operating the platform. Each Maeker is a separate controller for the order data they receive to fulfil and ship your purchase. We have not appointed a data protection officer, as the law does not require one for us; please send any privacy question to the address above.

What we process and why

Your account

  • Data: email address, password (stored only as a secure hash by our authentication provider), first and last name, country, preferred language and currency, and the shipping and billing addresses you choose to save.
  • Purpose: to create and run your account, sign you in, and pre-fill checkout.
  • Legal basis: performance of a contract, Art. 6(1)(b) GDPR. Without an email address and a password (or a Google or Facebook sign-in, see below) we cannot open an account for you.

Signing in with Google or Facebook

If you choose "Continue with Google" or "Continue with Facebook", that provider confirms your identity to us and shares your name, email address, profile picture link and an account ID. We request only these basic permissions (Google: openid, email, profile; Facebook: public_profile, email).

We use this data only to create your Maeker account, sign you in and contact you about your account and orders. We never receive your Google or Facebook password, never post on your behalf, and never access your contacts, friends or other data. We do not sell this data or share it with anyone except the service providers listed under "Service providers", who run the site for us. We keep it while your account exists; deleting your account deletes it, apart from records we must keep by law (see "How long we keep data").

You can remove Maeker's access at any time in your Google Account (Security → Your connections to third-party apps & services) or on Facebook (Settings & privacy → Settings → Apps and websites). Google (Google Ireland Limited) and Facebook (Meta Platforms Ireland Limited) process your sign-in under their own privacy policies.

Maeker's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Legal basis: Art. 6(1)(b) GDPR (you ask us to sign you in this way).

Orders and guest checkout

  • Data: items, prices, the name and shipping address you enter, an optional billing address (if you ask for an invoice), an optional note to the Maeker, your email address, and the language you ordered in.
  • Guest checkout: if you buy without an account, we create a temporary guest session; the email address you enter at checkout is stored with your order. You can turn a guest session into a full account afterwards.
  • Shared with the Maeker: the Maeker who sells to you receives your name, shipping address, note and billing address (if given), and your email address as the reply address on order emails, so they can fulfil, ship and answer you.
  • Purpose and legal basis: processing your purchase, Art. 6(1)(b) GDPR; keeping invoices and accounting records, Art. 6(1)(c) GDPR (Austrian tax law).

Images for personalised orders

If you attach images to a personalised order (for example a photo to engrave), we store them privately and show them only to you and the Maeker of that order. Without an account, uploading the first image starts the same temporary guest session as guest checkout. Guest and account images are kept alike: images you upload but don't order with are deleted after 7 days, or up to 30 days after a checkout you started with them; images on an order are deleted 180 days after the order. If you delete your account, we delete your images at once, unless they are attached to an order or a recent checkout: those stay until their deletion date above, because the Maeker needs them to make your item. Legal basis: Art. 6(1)(b) GDPR.

Payments

Payments are handled by Stripe (Stripe Payments Europe, Ltd., Ireland). Stripe receives your email address, shipping address and payment details and processes them as an independent controller under its own privacy policy. We never see or store your card number. Maekers are paid out through Stripe Connect; Stripe verifies their identity and bank details itself.

Each Maeker you buy from is paid with their own payment, so your statement shows one payment per Maeker, and each Maeker receives the order details for their items as described under "Orders". When you pay several Maekers at once by card or a wallet such as Apple Pay or Google Pay, Stripe keeps your card on our own Stripe account for that checkout only, under a customer record without your name or email address, and passes a single-use copy to each Maeker's payment. We have it deleted as soon as every payment is completed or cancelled, including when a payment fails. If you leave the page during payment, or that deletion fails, a check every few minutes deletes it, usually within about 20 minutes. Legal basis: Art. 6(1)(b) GDPR.

Messages, reviews and reports

  • Messages you exchange with a Maeker are stored so both sides can read the conversation. Each new message is also sent to the recipient by email, with your email address as the reply address.
  • Reviews you write are shown publicly with your first name and the initial of your last name.
  • Reports you send about a listing or review (reason and details) are read by us to moderate the platform.
  • Legal basis: Art. 6(1)(b) GDPR (messages, reviews); Art. 6(1)(f) GDPR for reports and moderation (our legitimate interest in keeping the marketplace safe and lawful).

Applying to sell (Maekers)

  • Data: legal and business name, contact email and phone, country of residence, seller type, address, VAT and tax ID, a description of your craft, portfolio links, years of making, proposed shop name and bio, shipping regions, an EU representative if you are based outside the EU, photos and video of your workspace and work, and proof of business registration.
  • Purpose: to vet every applicant by hand. Vetting is done by a person; we make no automated decisions about you.
  • Legal basis: Art. 6(1)(b) GDPR (steps you ask for before a contract).
  • Published on the platform: once approved, your shop name, bio and listings are public. EU product safety law (GPSR) requires us to show the manufacturer's name and postal address on every listing (and, for Maekers outside the EU, the EU responsible person's details); the application form tells you this before you submit. Your email address is not published; buyers contact you through Maeker's messaging.
  • Tax reporting: EU law (DAC7, implemented in Austria by the DPMG) requires us to keep certain identity and sales data of Maekers and report it to the tax authority. Legal basis: Art. 6(1)(c) GDPR.

Emails

We send emails needed to run your account and orders: sign-up confirmation, password reset, order receipt, shipping and return updates, invoices, message notifications and, for Maekers, sale and statement emails. We do not send newsletters or marketing emails. Legal basis: Art. 6(1)(b) GDPR.

Security and abuse prevention

  • To stop password-reset and confirmation emails being used to flood inboxes, we store a one-way hash of the email address and of your IP address for 24 hours.
  • Technical errors are recorded without your IP address or email address and deleted after 30 days.
  • Our hosting provider keeps short-lived request logs (including IP addresses) to run and secure the site.
  • We choose the site language from your browser's language setting, or from your profile once you sign in. On listing pages we read the country your connection comes from (not your exact location) to show the shipping cost to you; we do not store it.
  • When you upload or replace an image, check out, add to your cart or use other order actions, an invisible bot check (Vercel BotID) evaluates technical signals from your browser to tell people from automated abuse. There is no puzzle to solve, and the result is not used for anything else.
  • Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a secure, working service.

Visitor statistics

We count visits with Plausible Analytics (Plausible Insights OÜ, Estonia; data stored in the EU). Plausible sets no cookies and stores nothing on your device. For each page view it receives the page address, the referring site, your browser, operating system and device type, and your IP address, from which it derives your country, region and city. It also counts clicks on links to other websites, file downloads and form submissions: only that they happened, with the page and link address, never what you typed into a form. The IP address itself is never stored: together with your browser's user-agent string it is turned into a one-way code using a secret that changes every day and is then deleted, so visitors cannot be recognised from one day to the next. The data reaches Plausible through our own domain. We only see summary statistics. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in knowing how the site is used.

Cookies

We only use cookies that are strictly necessary for the service you ask for, so no consent is needed for them (§ 165(3) Austrian Telecommunications Act 2021, TKG 2021):

  • sb-…-auth-token: keeps you signed in. Until you sign out or the session expires.
  • cart: remembers your basket. 7 days.
  • cart_bak: restores your basket if you leave payment. 45 minutes.
  • cart_paid: remembers which items of your basket are already paid, so they aren't removed again if you add them once more. 3 hours.
  • ref_…: records that you came through a Maeker's referral link, so your purchase from that Maeker gets the referral rate. 30 days.
  • NEXT_LOCALE: remembers your language. 1 year.

We currently set no optional cookies (no advertising, no tracking). If we ever add any, we will ask for your consent first, and you can change your choice at any time via "Cookie settings" in the footer. Your choice is then stored in your browser (local storage), not sent to us.

Service providers

These providers process data on our behalf under data processing agreements (Art. 28 GDPR):

  • Supabase (database, sign-in, file storage), servers in the EU.
  • Vercel (hosting), functions run in Frankfurt; Vercel Inc. is based in the USA.
  • Resend (sending emails, including sign-in emails), sending from the EU; Resend Inc. is based in the USA.
  • Cloudflare (encrypted off-site backups), stored in the EU; Cloudflare Inc. is based in the USA.
  • Plausible (visitor statistics), data stored in the EU; Plausible Insights OÜ is based in Estonia.
  • DeepL (machine translation), DeepL SE, Cologne, Germany. DeepL translates the texts Makers write (listings, shop pages) and reviews when they are submitted, and messages and return notes only when you choose to translate them. The text is sent to DeepL for that purpose (Art. 6(1)(b) and (f) GDPR: showing pages and messages in your language). Under our paid plan DeepL does not use the text to train its models.

Where a provider is based in the USA, transfers rely on the EU-U.S. Data Privacy Framework and/or the EU Standard Contractual Clauses (Art. 45 and Art. 46(2)(c) GDPR).

Independent controllers you deal with through Maeker: Stripe (payments), the Maeker you buy from (your order), and Google or Facebook if you sign in with them.

How long we keep data

  • Account data: while your account exists. When you delete your account we erase it; if you have orders, we keep the order records (without your name, email or saved addresses on your profile) for as long as the law requires.
  • Invoices and accounting records: 7 years from the end of the calendar year (§ 132 Austrian Federal Fiscal Code, BAO).
  • Maeker tax-reporting records (DAC7): for the period the DPMG requires.
  • Visitor statistics: page views and events without your IP address, for as long as we use Plausible; the daily secret behind the anonymous code is deleted after 24 hours.
  • Unused guest sessions and unconfirmed sign-ups: deleted after 30 days if no order was placed.
  • Application documents (workspace and work photos, video, business proof): deleted 14 days after we decide on the application. Applications never completed are deleted after 60 days.
  • Messages: until the account of either party is deleted.
  • Images for personalised orders: 7 days if no order is placed (up to 30 days after a checkout you started with them); 180 days after the order.
  • Security hashes: 24 hours. Error records: 30 days.
  • Backups: encrypted, overwritten after about 60 days.

Your rights

You have the right to:

  • Access your data (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR), unless we must keep data by law
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Object to processing based on our legitimate interests (Art. 21 GDPR)
  • Withdraw consent at any time with effect for the future (Art. 7(3) GDPR), where we rely on it

You can export your data or delete your account yourself from your account page. For anything else, write to privacy@maeker.eu; we answer within one month.

You also have the right to lodge a complaint with a supervisory authority. In Austria this is the Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at.

Open-source software

This site uses the open-source libraries heic-to, libheif and libde265, licensed under the GNU Lesser General Public License v3.0, to read HEIC photos in your browser. Your photos are converted on your device before upload.

Changes to this policy

We update this policy when our services or the law change. The date at the top shows the latest version.

Contact

Pelikano Online, Daniel Pelikan, Oberfeldstrasse 62b/1, 4600 Wels, Austria — privacy@maeker.eu