Privacy policy

Last updated: 15 October 2026

Wegotthis BV, trading as OCTARR, respects your privacy. This policy explains which personal data we process when you visit octarr.com, create an account, collect with us on members.octarr.com, or contact us, and what your rights are. We follow the General Data Protection Regulation (GDPR).

Who we are

Wegotthis BV, trading as OCTARR, is responsible for your personal data. KvK 65690133 · Email: info@octarr.com

When you visit our website

Contact and newsletter: your name and email address when you contact us or subscribe to our newsletter.
Technical and usage data: such as IP address, browser type, device information and the pages you visit.

Our website octarr.com is hosted by Webflow. We use Google Analytics to understand how visitors use the website; it collects pseudonymised usage data such as pages visited and time spent. We use Mailchimp to manage newsletter subscriptions. Our website uses cookies and similar technologies to work properly and to analyse usage; you can manage or disable cookies in your browser settings.

When you create an account or buy from us

Your email address, when you confirm it with the link we send you: to sign you in, to know who bought what, and to send the emails your purchase needs.
Your name and the country of your billing address, and the rest of your address if you choose to give it, at checkout: for the invoice and to apply VAT. We sell only to private buyers.
A saved default address, only if you choose "Save as my default address": so you don't have to type it again. When it changes, we email you a notice.
Your purchases: what you bought, when, the price, the VAT, the payment status and any refund: to deliver your Collectible, keep our accounts, and handle refunds and questions.
Your Collectible, its number, and the record that you are its collector: to show it in your collection and keep its history. Its public Passport page shows the artwork, its provenance and the status of its Digital Record, never your name.
Sign-in and security records, such as when you signed in and whether you set a password: to keep your account secure.
A bot check on the sign-in forms (Cloudflare Turnstile): to stop automated abuse.
A withdrawal request, if you withdraw: your name, your order and the email address for the confirmation, with the date and time, to confirm and carry out your withdrawal and refund, and to keep proof of it.
Your invoice, kept by our payment provider Stripe for us; you can open it from your collection.

What we don't collect: your card details. They go straight to our payment provider, Stripe; we only receive the outcome of the payment. We don't ask for identification.

The Digital Record

Later, each Collectible will receive a Digital Record on a public blockchain (Base). It will hold the Collectible's number and a technical address, not your name or email address. Records on a public blockchain are permanent: nobody, including us, can change or erase them.

Emails

We send the emails your account and purchase need: sign-in links, security notices (for example a changed password or default address) and the confirmation of your purchase. Stripe emails you the payment receipt and, if you are refunded, a refund receipt. Sign-in links aren't stored by our email provider and aren't tracked. We only send news and updates if you've asked for them, and you can unsubscribe at any time.

Who we are. Wegotthis BV, trading as OCTARR, Hoogstraat 65, 5615 PA Eindhoven, the Netherlands (KvK 65690133). Questions: info@octarr.com.

Signing up. You give us your email address and we send you one email to confirm. You are subscribed only after you press the button in it. If you don't, we delete your address after 48 hours.

What we keep. Your email address (and your name, if we have it), a note of when and how you agreed, and a record that each newsletter was sent to you. We don't keep your IP address with this.

Opens and clicks. We count, in total, how many people opened each newsletter and which links were clicked. This is done with a small image in the email and tracked links. We don't look at who opened or clicked what. Unsubscribe and preference links are never tracked.

Leaving. Every email has an unsubscribe link that works at once. If you leave, we keep a scrambled fingerprint of your address (not the address itself) so we never email you again by mistake.

Who helps us. Customer.io (EU) sends the emails. Supabase (EU) stores our data. Vercel hosts the pages. Webflow hosts our website. Mailchimp holds our old list until we close it.

Your rights. You can ask to see, correct or delete your data at info@octarr.com. You can also ask us to restrict how we use your data, to receive a copy of it in a usable format, to object to its use, and to withdraw your consent at any time (unsubscribing does this). You can complain to the Autoriteit Persoonsgegevens.

Why we may use your data

To create and run your account, and to sell and deliver your purchase, including invoices, withdrawals, refunds and support: to perform our contract with you.
To keep invoices and tax records: because the law requires it.
To keep accounts and sales safe (sign-in records, the bot check, purchase limits): our legitimate interest.
To send news and updates, and for analytics cookies where consent is needed: your consent, which you can withdraw at any time.

Who processes data for us

Supabase hosts our database and sign-in, in the EU (Ireland).
Vercel hosts members.octarr.com; its server code runs in the EU (Dublin).
Stripe takes payments, sends receipts and keeps invoices.
Customer.io sends our account, purchase and newsletter emails, from its EU region.
Cloudflare runs the bot check on our sign-in forms.
Webflow hosts octarr.com, Google Analytics measures its use, and Mailchimp manages newsletter subscriptions.

Some of these providers are based in, or may process data in, the United States. Where that happens, appropriate safeguards such as the EU Standard Contractual Clauses apply.

How long we keep your data

Invoices and records of purchases, payments, refunds and withdrawals, including your billing details: 7 years after the end of the financial year, as Dutch tax law requires.
Your account and email address: for as long as you have an account.
Your saved default address: until you change or remove it, or close your account.
Your Collectible, its number and its history: kept as part of the Collectible's provenance.
Sign-in sessions: ended automatically after at most 30 days, and after 7 days without use.
Newsletter and contact data: until you unsubscribe or no longer need us to keep it.

Your rights

You have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, to withdraw your consent at any time, and to receive your data in a portable format. Two limits apply: we must keep invoices and tax records for the legal period, and a Digital Record on a public blockchain can't be erased. Changing the email address on an account isn't possible yet.

To use your rights, email info@octarr.com. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Security

We take appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access.

Changes to this policy

We may update this policy. The latest version is always on this page, with its date.