Privacy
This notice describes the site as it runs today. The data inventory it is derived from is kept in the repository and checked against the database schema by the test suite, so it cannot drift from what the site actually stores.
Who is responsible
Wolfpack Mail is a personal site run by a single operator, who is the controller for the personal data described here. The operator's name, address and contact address are on the Impressum page.
Write to that address for anything in this notice, including a copy of what is held about you, a correction, or a deletion. There is no company behind the site and no support ticket system — one person reads the inbox.
Why your data is processed
The site collects personal data only where an order, a subscription or a sign-in cannot happen without it. The list below is the whole list; the data inventory in the repository names every column that holds it.
Orders: your email address for the receipt, and the delivery address you enter at checkout. Card details are entered on the payment provider's own page and never reach this site's servers.
Mail club: your email address, used to send the mailings you signed up for. Unsubscribing stops every mailing and keeps your address only on a suppression list, so that nobody can accidentally mail you again.
Account: your email address, the postal address you save if you want to, and the free-text note you may add about yourself. Nothing else is collected — the database holds no profile picture, no phone number and no date of birth.
Sign-in with Google or Facebook: only the provider's account identifier is stored, so a later sign-in can be matched to the same person. The name, the email address and the profile picture the provider would offer are not kept.
Your rights
You can exercise every right below without writing a formal request; the account page is the shortest route to all of them.
Access: what the site holds about you is on your own account page. For a copy you can keep, ask the operator by email.
Erasure: one button on the account page deletes the account. It asks you to type your address back before it does anything, and it removes the account, its orders, its subscriptions, its addresses and its saved payment links in a single transaction. The order history is kept only as an anonymised total, because a shop has to be able to account for what it sold.
Objection: to the mail club, use the unsubscribe link in any mailing — it takes effect immediately and needs no explanation. To the shop's or the gallery's processing, write to the operator and say what you object to.
Complaint: if you are not satisfied with the answer, you may complain to your national data protection authority.
Who else sees your data
Three providers act on the site's behalf, and none of them is an advertising network.
Google and Facebook, for sign-in: they confirm who you are, and the site receives the account identifier described above and nothing else. The email host, for the mail club: it delivers the mailings and reports whether delivery succeeded. Each processes the data only on the site's instructions, and none of them may use it for its own purposes.
How long it is kept
Nothing is kept because it is easier to keep. Every table has a stated retention period and a deletion path.
The data inventory in the site's repository holds the full table: what each column is for, on what legal basis, for how long, and how it is deleted. It is derived from the database schema and a test fails the build if the two disagree, so this page cannot quietly fall behind the database.