Privacy Policy

Last updated: 2 October 2026

Who is responsible

Uncanny Masks is run by Vladislavs Kivelevs, Zolitūdes iela 38, k-3 - 12, Rīga, LV-1029, Latvia, who is the controller of your personal data. Contact: uncannymasks@proton.me.

What we collect and why

• When you buy: your name, email address, shipping address, phone number and order details. We need these to take payment, ship your mask, send you order and shipping emails, and handle returns and complaints. Legal basis: performing our contract with you.
• If you ask us to tell you when a mask is back: your email address, and the country you chose if any. We use it only to send you that one email. Legal basis: your consent, which you can withdraw at any time with the link in that email, or by writing to us.
• For accounting: order and payment records. We must keep them under Latvian accounting law. Legal basis: legal obligation.
• For security: your IP address is used briefly to block automated abuse (bot checks and rate limits). Legal basis: our legitimate interest in keeping the shop safe.
• Visitor statistics: we count visits in total (country, device type, which page) using Cloudflare Web Analytics. It uses no cookies and does not identify you.

We do not sell your data, use it for advertising, or make automated decisions about you.

Who receives your data

• Stripe processes your payment. Stripe receives your payment details directly; we never see card numbers.
• Cloudflare hosts the website and database.
• Resend delivers our order emails.
• The delivery company that carries your parcel (named in the shipping email) receives your name, address and phone number to deliver it.

Some of these companies may process data outside the EU. They do so under safeguards approved by the European Commission, such as Standard Contractual Clauses or the EU–US Data Privacy Framework.

How long we keep it

• Order and payment records: 5 years after the end of the year of the order, as required by Latvian accounting law.
• Emails with you: as long as needed to resolve your question, then up to 2 years.
• Server logs: a few days.
• "Tell me when it's back" list: until 30 days after we've told you; removed at once when you use the link in the email or ask us.

Cookies

We don't use tracking or advertising cookies, so there is no cookie banner. The bot check on the Buy button and the payment page (run by Stripe on its own site) may use strictly necessary technical storage to work.

Your rights

You can ask for a copy of your data, ask us to correct or delete it, restrict or object to its use, and receive it in a portable format. Write to uncannymasks@proton.me. We may need to keep some records for accounting even if you ask for deletion. You can also complain to the Data State Inspectorate of Latvia (Datu valsts inspekcija), www.dvi.gov.lv.