Privacy Policy

paddedroom.art

Last updated: 20 August 2026

About this version

This is the launch version of our Privacy Policy, reflecting the site as it currently operates: a public showcase with no accounts, logins, or sign-ups of any kind. When membership accounts are introduced, this policy will be expanded and republished to cover that data. Please see "Changes to this policy" below for how you'll be notified.

Governing Language

These terms are provided in English. English is the controlling language for all purposes. If you are unable to read these terms in English, you should seek assistance before agreeing to these terms and/or using this site.

Who is the data controller

The data controller for paddedroom.art is the site operator (currently: Padded Room Art), reachable at compliance@paddedroom.art. The server is located in the Netherlands and this site operates under the EU General Data Protection Regulation (GDPR) and Dutch data protection law.

What data we collect and why

Account registration

This site does not have accounts, logins, or sign-ups. We do not ask you for your email address, a display name, or any other personal information to browse or view content on this site.

Server and access logs

Our server logs HTTP requests made to this site. A log entry typically includes your IP address, the URL you requested, the HTTP status code returned, your browser's user-agent string, and a timestamp.
Legal basis: Legitimate interests (Article 6(1)(f) GDPR). These logs are necessary for diagnosing errors, detecting abuse, and maintaining the security of the site.
Log data is retained for 30 days and then deleted automatically.

Analytics

We collect anonymised usage data (page views, navigation paths, and general traffic patterns) to understand how the site is used. This is Ghost's built-in, first-party analytics: it does not use cookies or any other form of persistent browser storage to identify or track visitors across sessions or devices. This data does not identify individual users.

Legal basis: Legitimate interests (Article 6(1)(f) GDPR).

What we do not collect

We do not collect payment card data (no paid tiers are active at this time). We do not use advertising tracking, social media pixels, or cross-site tracking of any kind. We do not sell personal data.

Links to external platforms

This site includes links to the artist's SubscribeStar page for those who wish to support the work financially. Clicking these links takes you to a third-party site outside our control, which has its own privacy policy and its own handling of your data. We recommend reviewing SubscribeStar's privacy policy before using their service. Nothing about your visit to SubscribeStar is shared with us.

Data processors

We use the following third-party services to operate the site. Each has access only to the data necessary for their function and is contractually bound to handle it in accordance with the GDPR.

Zomro B.V.
Role: Virtual private server hosting. All site data, including the database containing registered user accounts, is stored on hardware operated by Zomro in the Netherlands.
Location: Netherlands (EU)
Privacy information: https://zomro.com/privacy-policy

Grafana Labs
Role: Infrastructure monitoring and log aggregation. Server logs (which may include IP addresses) are forwarded to Grafana Cloud for storage, search, and alerting. We use the EU Frankfurt region.
Location: EU (Frankfurt)
Privacy information: https://grafana.com/legal/privacy-policy/

Tinybird
Role: Analytics data pipeline. Anonymised, cookie-free traffic event data is sent to Tinybird for aggregation and reporting.
Location: EU
Privacy information: https://www.tinybird.co/privacy

Namecheap, Inc.
Role: Domain name registrar and DNS. Namecheap resolves paddedroom.art to our server's IP address. DNS queries do not contain personal data beyond the IP address of the resolver making the request.Location: United States (standard contractual clauses apply for EU transfers)
Privacy information: https://www.namecheap.com/legal/general/privacy-policy/

StatusCake
Role: Uptime monitoring. StatusCake sends periodic HTTP requests to paddedroom.art to verify the site is reachable. It does not receive or process any user personal data.
Location: United Kingdom
Privacy information: https://www.statuscake.com/privacy-policy/

International transfers

Most of our data processing takes place within the EU/EEA. Where a processor is outside the EU (Namecheap, StatusCake), we rely on standard contractual clauses or adequacy decisions as the transfer mechanism. Details are available on request at compliance@paddedroom.art.

Your rights under the GDPR

You have the right to:

• Access the personal data we hold about you
• Rectification of inaccurate data
• Erasure ("right to be forgotten") of your personal data, subject to any legal retention obligations
• Restriction of processing in certain circumstances
• Data portability of data you provided to us in machine-readable format
• Object to processing based on legitimate interests

To exercise any of these rights, please email compliance@paddedroom.art. We will respond within 30 days. We may ask you to confirm your identity before acting on a request. In practice, since this site does not collect account data at this time, the personal data we might hold about a given visitor is limited to server logs (deleted automatically after 30 days) and anonymised analytics events that do not identify you individually. Basically, there is usually little or nothing to request access to or erase.

Cookies

This site does not currently set any cookies. There are no accounts or logins, so there is no session mechanism, and our analytics (see above) is cookie-free by design. If and when that changes: for example, when member accounts are introduced, this policy and the site's cookie notice will be updated accordingly, and a proper cookie consent mechanism will be put in place before any cookie-based feature goes live.

Data retention summary

Right to complain

If you believe we have handled your personal data unlawfully, you have the right to lodge a complaint with a supervisory authority. Because our server is in the Netherlands, the lead supervisory authority is:

Autoriteit Persoonsgegevens (Dutch Data Protection Authority)
https://www.autoriteitpersoonsgegevens.nl/en
+31 70 888 8500

You may also complain to the data protection authority in your country of residence.

Changes to this policy

We distinguish between material and non-material changes.

Non-material changes: correcting links, rephrasing for clarity, updating a processor's privacy policy URL, these will be reflected by updating the "Last updated" date at the top of this page. No separate notification will be sent for updates of this nature.

Material changes: adding a new data processor, collecting a new category of personal data, changing the legal basis for any processing activity, or altering your rights in any way, these and similar changes will be reflected on this page, with the "Last updated" date at the top of this page updated accordingly. As this site is in active development and its infrastructure is still evolving, we are not in a position to commit to a fixed advance-notice period or to individual notification by email at this stage; checking this page is the way to stay current. Once member accounts exist, this policy will be re-visited as far as notifications.

If you have concerns about a change to this policy, please contact compliance@paddedroom.art.