Privacy Policy
Last updated 23 September 2026
This site is run from Germany, so the General Data Protection Regulation applies to everything described here — wherever in the world you are reading from.
The short version
This site sets no cookies. It runs no analytics, no advertising and no tracking of any kind. Fonts are served from this site rather than from Google, so simply reading the page sends your data to nobody. That is why you are not being asked to dismiss a cookie banner — there is nothing to consent to.
Two things do involve your data, and only if you choose them: joining the waiting list, and buying something. Both are described below.
1. Who is responsible
The controller for the processing described here, within the meaning of Art. 4(7) GDPR, is:
Richard Bobrov
trading as buylineart.com
Rudolf-Schöppe-Weg 18
85748 Garching bei München, Germany
Email: [email protected]
We have not appointed a data protection officer. A sole trader of this size is not required to under Art. 37 GDPR or § 38 BDSG. Send any privacy question to the address above and it will reach the person responsible.
2. Visiting the site
This site is hosted by Netlify, Inc., 512 2nd Street, San Francisco, CA 94107, USA. Like every web server, Netlify's infrastructure records technical information when a page is requested:
- your IP address
- the date and time of the request
- the page or file requested, and whether it was served successfully
- the referring page, if your browser sent one
- your browser and operating system identifiers
These logs exist so the site can be delivered at all, kept available and defended against attack. The legal basis is Art. 6(1)(f) GDPR — our legitimate interest in operating a functioning and secure website. The logs are not combined with anything else and are not used to identify you.
Because Netlify is based in the United States, serving this page involves a transfer of personal data to a third country. Netlify is certified under the EU–U.S. Data Privacy Framework, and transfers take place on that basis. Should the Framework be declared invalid, or should Netlify fail to re-certify, the transfer falls back to the EU Standard Contractual Clauses (Module Two, controller to processor), which Netlify has pre-agreed. This reflects sections 14.2 and 14.3 of Netlify's Data Processing Agreement as last updated on 9 June 2026; you can check its current status in the Data Privacy Framework list.
3. The waiting list
If you enter your email address in the "notify me" form, we store that address in order to send you one message: an announcement when the full buylineart.com marketplace opens.
| What we collect | Your email address, and the date you submitted it. Nothing else — there is no name field and we do not profile you. |
|---|---|
| Why | To send a single launch announcement. |
| Legal basis | Your consent, Art. 6(1)(a) GDPR, given by submitting the form. |
| Who processes it | Netlify Forms, i.e. Netlify, Inc. (USA), acting as our processor under Art. 28 GDPR. |
| How long | Until the announcement has been sent, or until you withdraw — whichever comes first. The list is then deleted in full. |
| Passed on? | No. It is never sold, rented, shared or used for any other message. |
You can withdraw your consent at any time, with effect for the future, by emailing [email protected]. Withdrawal does not affect the lawfulness of processing carried out before it. There is no downside to withdrawing and you do not have to give a reason.
4. Buying an artwork
We do not process payments and we never see your card details. When you click through to checkout you leave this site for Gumroad, Inc., 548 Market St, San Francisco, CA 94104, USA.
Gumroad is the seller of record. For the purchase itself Gumroad acts as its own controller, not as our processor, and its own privacy policy governs what it collects — typically your email address, payment details, billing country and the IP address used, as it needs these to take payment and to work out the tax due. Please read Gumroad's privacy policy before buying.
From Gumroad we receive limited information about completed sales — which artwork was bought, when, the amount, the buyer's email address and their country. We use this only to fulfil our obligations as the artist and to keep the books we are required to keep. German tax and commercial law (§ 147 AO, § 257 HGB) requires records of this kind to be retained for up to ten years, and for that period the legal basis is Art. 6(1)(c) GDPR — compliance with a legal obligation — rather than your consent.
5. Fonts and other third parties
The Inter typeface is stored on and served from this site. It is not loaded from Google Fonts, so no request is made to Google and no IP address is disclosed to them when you read a page here. Nothing else on this site is loaded from anyone else either: there is no embedded checkout, no payment script, no video player, no map and no social button. Every file your browser fetches to display these pages comes from this site alone.
6. Cookies and tracking
None. This site sets no cookies, uses no local storage, embeds no pixels and runs no analytics, so there is nothing requiring consent under § 25 TDDDG. Checkout is deliberately not embedded here: clicking through opens Gumroad's own site in a new tab. Any cookies Gumroad sets are therefore set on Gumroad's domain, after you have left this one, and are governed by Gumroad's policy rather than ours.
7. Your rights
Under the GDPR you have the right to:
- Access (Art. 15) — ask whether we hold data about you and get a copy.
- Rectification (Art. 16) — have inaccurate data corrected.
- Erasure (Art. 17) — have your data deleted, unless we are legally required to keep it.
- Restriction (Art. 18) — have processing limited while a dispute is resolved.
- Data portability (Art. 20) — receive your data in a machine-readable form.
- Object (Art. 21) — object to processing based on legitimate interests.
- Withdraw consent (Art. 7(3)) — at any time, with effect for the future.
Write to [email protected] to exercise any of these. We will respond within one month, free of charge.
You also have the right to complain to a supervisory authority (Art. 77 GDPR). The one responsible for us is the data protection authority of Bavaria, where the address above is located. For private businesses that is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Postfach 1349, 91504 Ansbach — www.lda.bayern.de. You may also complain to the authority where you live or work.
8. Changes to this policy
We will update this page if what we do with data changes — for example when the full marketplace launches, which will involve accounts and payouts and therefore a different policy. The date at the top always shows the current version. Material changes affecting the waiting list will be announced in the announcement email itself.