Legal & privacy

What this is

Overprint is a non-commercial student demonstration, built for a course. Nothing here is actually for sale — no goods are shipped, and every payment runs through Stripe in test mode, so no real money can change hands. Please do not enter real card details or a real address.

Who runs it

Overprint — a student project by Peter. Contact: overprintdemoshop@gmail.com. No postal address is published here: our understanding is that the German address-disclosure duty (§5 DDG) attaches to services run on a sustained, organised (geschäftsmäßig) basis, not a one-off non-commercial demonstration like this one. Email is the way to reach us.

AI-generated images

Product images in this shop are AI-generated rather than photographed. Each image's record states how it was made, and any image generated by AI is labelled as such on its product page. Where an image is AI-generated, it also carries C2PA provenance metadata identifying the generator that made it.

Privacy

We collect your email, name, shipping address, order contents, and the Stripe identifiers for your payment (a checkout session id and a payment intent id), plus a record of your consent to these terms: a checkbox on the product page, linking back to this page, checked again on our server before checkout can start, and timestamped onto your order. Card details themselves go straight to Stripe — we never see or store them.

Our lawful basis is not the same for every item. Your email, name, shipping address, order contents and the Stripe identifiers are held to perform the contract of sale (Art. 6(1)(b) GDPR). The consent timestamp is held under our legitimate interest in being able to show that the terms were accepted before an order was placed (Art. 6(1)(f)) — it is a record that consent was given, not data we hold on the strength of that consent. Vercel and Supabase process all of it as our processors, acting only on our instructions. Stripe processes payment data as an independent controller, and performs its own fraud screening on it under its own legitimate interests — it decides its own purposes and means for that data, so it answers for it on its own terms, not ours. Because it decides those purposes itself, Stripe’s checkout page may ask you for details we never requested and never receive — a phone number, for example, if you choose to let Stripe save your payment details for future purchases. Those go to Stripe alone: we ask only for what is listed above, and this shop has nowhere to store a phone number.

Data is stored in AWS eu-west-1, with serverless functions pinned to the dub1 region. Our retention targets: unpaid orders are removed after 30 days, and paid orders are kept for 2 years, after which they are redacted. Redaction clears your email, name and address. It keeps the amount, the date, what was ordered, and the Stripe reference for the payment — so be aware that a redacted order is not fully anonymous: we, and Stripe, can still use that reference to connect the record back to you. Enforcement is manual and operator-initiated. Nothing is purged or redacted automatically, and no recurring schedule does this for them.

To exercise your rights of access, rectification, erasure, or portability, email the address above. None of these is self-service or automated: an operator with database access carries out every request by hand, and the fields holding your name, email and address are deliberately locked against editing through the admin panel and the API, so even a correction is made directly against the database. We aim to respond within one month. We cannot erase data held by Stripe: it is an independent controller with its own retention obligations, so you will need to contact Stripe directly for that. If you think we have handled your data badly, you can complain to a data protection supervisory authority in the EU country where you live.

Not legal advice

This page is a student project's good-faith attempt at a privacy notice, not a professionally drafted policy or legal advice.