Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

2. General Information on Data Processing

As a matter of principle, we process personal data of our users only to the extent necessary to provide a functioning website together with our content and services, or where you have given your consent. Data is shared with third parties only within the scope of the purposes described below and on the basis of the legal grounds stated.

3. What Data We Collect

a) Server log files

When you access our website, our hosting provider automatically collects information in so-called server log files that your browser transmits. These include in particular:

• IP address (usually shortened/anonymised)
• date and time of access
• page accessed / file requested
• browser and operating system used
• referrer URL (previously visited page)

This data is not merged with other data sources and serves solely the technical operation, security and stability of the website.

b) Contacting us

If you contact us by email or via a contact form, the information you provide (e.g. name, email address, message) is stored in order to process your request.

c) Cookies

Our website uses only technically necessary cookies and storage entries in your browser (localStorage), e.g. for your cart and your chosen language. They are required to operate the site and do not require consent (Section 25 (2) no. 2 TDDDG). We do not set cookies for analytics or marketing purposes. You can delete stored cookies at any time in your browser settings.

d) Design editor / image uploads

If you upload your own image in the design editor to create an individual shirt, that image and a rendered preview (mockup) are stored on the content delivery network of our shop system (Shopify) for order processing and production — already while you design, so that your design link (see h) shows the image; the respective image URL is attached to the order as a line-item property so we know what to print. We do not store the images on our own servers. All images uploaded this way are automatically deleted no later than 30 days after upload — including those belonging to an order; the image URL stored with the order stops working after that. The legal basis is performance of a contract (Art. 6 (1) (b) GDPR). Please upload only images to which you hold the rights — you confirm this before uploading.

e) Taste check (your three favourite artists)

Before checkout you may voluntarily name your three favourite artists. If the verdict comes out well, we unlock a discount. You need to provide nothing but the three names — the check is not an account and not a sign-up.

For the names you give, we retrieve publicly available information (genre tags, listener counts) from Last.fm. We then transmit that information and the names themselves to our service providers — the AI router Requesty (requesty.ai) and the language model behind it, operated by Anthropic PBC — which produce the verdict on our behalf. The verdict is decided by an automated system, not by a human. Requesty and Anthropic process the data in the USA; the transfer to a third country is based on the European Commission standard contractual clauses (Art. 46 (2) (c) GDPR).

Only the artist names are transmitted — no information about you. We store the result in a technically necessary cookie so that the discount can be applied at checkout; we do not build a profile about you. The legal basis is your consent, given by submitting the three names (Art. 6 (1) (a) GDPR).

The verdict only concerns whether you get a discount. It has no legal effect and does not similarly significantly affect you — without a discount you can order at the regular price as normal.

f) AI chat

In addition, before checkout you can write with a chat that helps you design your shirt. This chat is an automated system (artificial intelligence) — you are not writing with a human being.

To generate a reply, we transmit your conversation history to the same service providers described under e) (Requesty and Anthropic PBC, processing in the USA on the basis of standard contractual clauses).

We also log conversations (your message, our reply and a random session identifier) in our server logs and in a spreadsheet at Google (Google Sheets, see section 5), in order to check and improve the quality of the chat. This is not linked to your name or your order. We keep these logs for no longer than 90 days.

The legal basis is the performance of pre-contractual measures at your request (Art. 6 (1) (b) GDPR) and our legitimate interest in a working and improving advisory service (Art. 6 (1) (f) GDPR).

Please do not enter personal data into the chat — neither your own (name, address, phone number, payment details) nor anyone else’s. We do not need them there for your order.

g) First-print wall (public listing)

Whoever prints a sentence first may, after ordering, enter a self-selected name on our publicly visible first prints page. Shown there permanently and visible to everyone are: the printed sentence, the name you chose and the date of the order. We store your order number internally for verification; it is not published.

The entry is voluntary and is made solely on the basis of your explicit consent (Art. 6 (1) (a) GDPR), which you give when entering it. You may withdraw this consent at any time with effect for the future — an informal message to message@makemepaytaxes.com is enough and we will remove the entry. We recommend using a pseudonym rather than your real name.

h) Design links and collections

As soon as you put something on the shirt in the editor, your draft gets a link that appears in your browser's address bar and updates with every further change — so you can show what you are working on at any time. For this we store the design data (text, positions, colours, references to uploaded images) and a preview image under a random identifier, for one year after the last change. Anyone who knows the link can open the draft — that is exactly its purpose, so only share it with people who should see the draft. Only the browser in which the draft was created can change it under this link (it keeps a key in local storage for this); anyone who opens someone else's link and keeps designing gets a link of their own. The legal basis is providing the editor you use to design your shirt before ordering (Art. 6 (1) (b) GDPR).

For collections we store the title, logo and released shirts for as long as the collection exists; only whoever holds the edit link can change it. The legal basis is your consent, given by creating the collection (Art. 6 (1) (a) GDPR).

i) Withdrawal via "Withdraw from contract"

If you withdraw from a contract using our withdrawal function, we process your name, the order number, your email address, an optional reason and the date and time of receipt. We need this information to assign and process the withdrawal and to confirm its receipt by email, which we are legally required to do (Section 356a BGB). The legal basis is Art. 6(1)(c) GDPR. We send the confirmation via the email service Resend (see section 5). We keep the information for three years after receipt as proof and delete it afterwards.

j) Orders, checkout and payment

We use the Shopify shop system for cart, checkout and order processing. When you order, we process your contact, delivery and billing details, the items ordered and your design data to perform the contract (Art. 6 (1) (b) GDPR). The checkout sets technically necessary Shopify cookies.

Payment is processed via Shopify Payments, operated by Stripe Payments Europe Ltd., Ireland (card, Apple Pay, Google Pay and other methods offered there). The data required for payment (name, billing address, amount, payment details) is transmitted to the payment provider. The legal basis is Art. 6 (1) (b) GDPR; the provider’s fraud prevention is based on Art. 6 (1) (f) GDPR. We keep order data relevant under commercial and tax law for up to 10 years (Art. 6 (1) (c) GDPR).

k) Shipping

For delivery we pass your name and delivery address to the carrier entrusted with delivery. We only pass on your email address or phone number if you agreed to this during checkout, so that the carrier can notify you about the delivery. The legal basis is Art. 6 (1) (b) GDPR or your consent (Art. 6 (1) (a) GDPR).

4. Legal Bases for Processing

• Art. 6 (1) (a) GDPR – consent (e.g. for your entry on the first-print wall).
• Art. 6 (1) (b) GDPR – performance of a contract and pre-contractual measures (e.g. order processing, enquiries).
• Art. 6 (1) (f) GDPR – legitimate interest (e.g. secure and stable operation of the website, server log files).

5. Hosting and Service Providers

Our website is hosted by an external service provider: Vercel Inc.. On our behalf, the provider processes the data generated when the website is accessed (in particular server log files). The basis for this is a data processing agreement pursuant to Art. 28 GDPR. Processing is carried out on the basis of our legitimate interest in the reliable provision of the website (Art. 6 (1) (f) GDPR).

In addition, we use the following service providers as processors. Data processing agreements pursuant to Art. 28 GDPR are in place with all of them:

• Vercel Inc. – hosting and delivery of the website (USA)
• Shopify International Ltd. – shop system, cart, checkout, order processing and storage of design files (Ireland, with processing in Canada and the USA)
• Upstash, Inc. – database for shared design links, collections, first-print entries, received withdrawals and protection against automated abuse (data stored in Frankfurt, Germany)
• Resend (Plus Five Five, Inc.) – sending emails, such as the confirmation of receipt of a withdrawal (USA)
• Requesty and Anthropic PBC – operation of the AI chat (USA)
• Last.fm – retrieval of public information about music artists (United Kingdom)
• Google Ireland Ltd. / Google LLC – spreadsheet (Google Sheets) for reviewing chat logs and taste-check results (Ireland/USA)

For payment providers and carriers see section 3 j) and k).

Where data is transferred to the USA, we base the transfer on the European Commission standard contractual clauses (Art. 46 (2) (c) GDPR) or on the provider’s certification under the EU-US Data Privacy Framework (Art. 45 GDPR). For the United Kingdom, an adequacy decision of the European Commission is in place. Despite these safeguards, access by US authorities cannot be entirely ruled out.

6. Storage Period

We store personal data only for as long as is necessary for the respective purposes or as required by statutory retention periods (e.g. up to 10 years under commercial and tax law). Server log files are generally deleted or anonymised after a short time (usually a few days to weeks). Enquiries by email are deleted as soon as their storage is no longer necessary.

7. Your Rights as a Data Subject

Under the GDPR you have, in particular, the following rights:

• right of access (Art. 15 GDPR)
• right to rectification (Art. 16 GDPR)
• right to erasure (Art. 17 GDPR)
• right to restriction of processing (Art. 18 GDPR)
• right to data portability (Art. 20 GDPR)
• right to object to processing (Art. 21 GDPR)
• right to withdraw consent with effect for the future (Art. 7 (3) GDPR)
• right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR)

To exercise your rights, an informal message to message@makemepaytaxes.com is sufficient. This expressly includes deleting your entry on the first-print wall: tell us which entry should go and we will take it down — you do not have to give a reason.

As of October 2026. This English text is a courtesy translation; the German version is legally binding.