What the workshop keeps, and why. Last updated 4 October 2026.
Andrhacula, a private person at Kamplaan 26, Groningen, the Netherlands, is the controller of your personal data. Questions go to andrhacula@gmail.com.
If you order a creature, the workshop needs your name, delivery address, email address, and the details of what you bought, including what you paid. If you write with a question or a commission idea, the message itself is kept, and whatever contact details you put on it.
The site does not run an advertising network and does not ask you to open an account. No payment card number is stored in the workshop’s own cupboard. Payment is handled by the payment service shown at checkout, under that service’s own rules.
A small script on each page notes the visit, so spiders that never run scripts are not counted. Kept for that visit: the page address and its name, the time, the page you came from, your browser, its language, the screen and window size, the time zone, the IP address, and a random number stored in a cookie so the same browser is recognised on the next page. This is kept for a year, to see which creatures draw a crowd. It is not sold, and it is not handed to an advertising network.
The legal grounds are the contract with you, steps taken at your request before that contract, a legal duty to keep records, a legitimate interest in answering the person who knocked, and a legitimate interest in seeing which pages are visited.
Your address is shared with the carrier who delivers the coffin-shaped box, because otherwise the creature stays in Groningen. Payment details go to the payment service. That is the list. Data is not sold, rented, or traded for favours.
Some of those carriers and payment services sit outside the Netherlands, including outside the EU. Where that happens, it is only as far as needed to deliver or to take payment, under the safeguards those services provide.
A form may ask Google reCAPTCHA to check that you are a person and not a mischievous script. Google then receives technical details of that visit, such as your IP address and some browser information, under Google’s privacy policy. The workshop uses this to keep the inbox free of nonsense.
Order records are kept for as long as the tax authorities can still ask about them, which in the Netherlands is generally 7 years. A message that never became an order is deleted once it is no longer needed to answer you, and in any case within a year. If you ask for deletion sooner, anything that must legally stay will stay, and the rest will go.
The shop sets two cookies of its own. One remembers what is in the cauldron. One holds the random visitor number described above, and it lasts a year. Neither follows you around the rest of the web. Google reCAPTCHA may set cookies when it is checking a form. Those cookies are Google’s, and they are there to tell a person from a script.
You may ask to see the data held about you, to correct it, to have it deleted, to limit its use, or to receive a copy of what you provided. You may object to a use based on legitimate interest. You may also complain to the Autoriteit Persoonsgegevens, the Dutch data protection authority (autoriteitpersoonsgegevens.nl).
Write to andrhacula@gmail.com. A reply will come within a month, unless the request is a particularly tangled haunting, in which case you will be told why it is taking longer.
The rules of buying a creature are in the terms and conditions.