Last updated: February 2026 · GDPR compliant
1. Controller
Tiny Mustard Seed (Belgium) is the data controller responsible for your personal data. Contact: mustard@tinymustardseed.com.
2. What data we collect
- Account data: name, email address, hashed password
- Order data: shipping address, phone number, order history, language preference
- Payment data: handled directly by Stripe — we never see or store your card number
- Communications: contact-form messages and email correspondence
- Technical data: IP address, browser type, basic analytics via PostHog (anonymised pageviews)
- Custom designs: artwork you upload, for the sole purpose of producing your order
3. Why we use it (legal bases)
- Fulfil your order — contract (Art. 6(1)(b) GDPR)
- Send order-status emails — contract
- Send marketing emails / referral updates — consent (Art. 6(1)(a)); you may withdraw at any time
- Comply with accounting / VAT obligations — legal obligation (Art. 6(1)(c))
- Fraud prevention & site security — legitimate interest (Art. 6(1)(f))
4. Who we share with
- Stripe — payments
- Eurosender — shipping
- GoDaddy / Microsoft 365 — transactional email delivery
- Cloudflare — DDoS protection & Turnstile bot challenge
- We do not sell your data to advertisers.
5. International transfers
Some processors (Stripe, Cloudflare) may transfer data outside the EEA under EU-approved Standard Contractual Clauses.
6. Retention
- Account data: until you delete your account, then 12 months for fraud screening.
- Order data: 7 years (Belgian accounting law).
- Marketing data: until you unsubscribe.
- Uploaded custom designs: 12 months after the order ships.
7. Your rights
You have the right to:
- Access, rectify, or erase your data
- Restrict or object to processing
- Data portability
- Lodge a complaint with the Belgian DPA: https://www.dataprotectionauthority.be
Email mustard@tinymustardseed.com to exercise any of these rights — we respond within 30 days.
8. Cookies
We use essential cookies (session, cart) and analytical cookies (PostHog, anonymised). No advertising cookies are set.
9. Children
Our services are not directed at children under 16.
10. Changes
Material updates will be announced via email and on this page.