Privacy Policy
Effective and last updated: August 5, 2026
This policy explains what personal data ANVIL0 Workshop ("ANVIL0", "we", "us") collects when you browse this site, create an account, place an order, or contact us — and what we do with it. We keep this short and specific to what this site actually does; we don't run advertising trackers or sell data to anyone.
Who we are
ANVIL0 Workshop is a handmade helmet, armor and prop workshop based in Novi Sad, Serbia. For any privacy question or request, contact us at [email protected].
What we collect
| When | What |
|---|---|
| Creating an account | Name, email address, and a securely hashed password (we never store your password in plain text). |
| Placing an order | Shipping name, address, phone number, and order contents. Payment card or PayPal account details are handled entirely by PayPal — they never pass through or get stored on our servers (see "Payment processing" below). |
| Using the contact form | Name, email address, subject, an optional order number, and your message. |
| Subscribing to the mailing list | Email address, and which page you subscribed from (so we know which product category to notify you about). |
| Just browsing | Standard web server logs (IP address, browser type, pages requested) kept briefly by our hosting provider, Cloudflare, for security and abuse prevention — see "Cookies & local storage" below. |
Why we collect it
- To fulfil your order — process payment, ship your item, and provide order support.
- To respond to you — answer messages sent through the contact form.
- To send what you asked for — a one-time notification email if you subscribe to be told when a product category opens, or (if you opt in at signup) occasional updates from the workshop.
- To keep the site secure — detect and block automated abuse (bot signups, spam submissions, credential-stuffing login attempts) using rate limiting and Cloudflare Turnstile, a privacy-friendly CAPTCHA alternative that generally does not require you to solve a visual puzzle.
The legal bases for this processing (under the EU/UK GDPR) are: performance of a contract (creating your account, fulfilling an order), our legitimate interest in running a secure, working store (fraud/bot prevention, basic server logs), and your consent (newsletter sign-up, which you can withdraw at any time).
Cookies & local storage
We keep this deliberately simple: ANVIL0 does not use advertising or analytics trackers, and there is nothing "non-essential" on this site for you to opt out of. Everything below is required for the site to function.
| Name / type | Purpose | Duration |
|---|---|---|
| Session cookie (httpOnly) | Keeps you signed in to your account. Cannot be read by page scripts. | Until you log out or it expires |
| Cart & language preference (browser local storage, not a cookie) | Remembers what's in your cart and your chosen site language between visits. Stored only on your device, never sent to our servers. | Until you clear your browser data |
| Cloudflare Turnstile | Confirms you're a real visitor, not a bot, on login, registration, contact and newsletter forms. | Short-lived, per form submission |
Payment processing
Checkout payments are handled directly by PayPal through their own secure, hosted flow. ANVIL0 never sees or stores your full card number, PayPal password, or other payment credentials — our server only receives a confirmation that a specific order was paid, and a PayPal transaction reference for our own order records. PayPal's use of your data is governed by PayPal's own privacy policy.
Who we share data with
- Cloudflare — hosts this site and our order database, and provides the bot-protection (Turnstile) and email-delivery infrastructure described above. Cloudflare processes data on our behalf as our infrastructure provider.
- PayPal — processes payments, as described above.
- Postal/courier services — receive your shipping name and address to deliver your order.
We do not sell your data, and we do not share it with advertisers or data brokers.
International data transfers
ANVIL0 is based in Serbia. Our hosting provider, Cloudflare, operates a global network, which means data may be processed on servers outside the country you're browsing from, including outside the EU/EEA. Cloudflare provides standard contractual safeguards for this kind of transfer.
How long we keep your data
We keep account and order data for as long as your account is active or as needed to meet our tax and accounting obligations, whichever is longer. Contact form messages are kept only as long as needed to resolve your inquiry. You can ask us to delete your account and associated data at any time — see "Your rights" below.
Your rights
If the GDPR or a similar law applies to you, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request deletion of your data ("right to be forgotten")
- Restrict or object to certain processing
- Receive your data in a portable format
- Withdraw consent at any time (e.g. unsubscribe from the mailing list — every email includes an unsubscribe option, or just email us)
- Lodge a complaint with your local data protection authority
To exercise any of these rights, email [email protected] — we'll respond within 30 days.
Children's privacy
This site is not directed at children, and we do not knowingly collect data from anyone under 16. If you believe a child has provided us with personal data, contact us and we'll remove it.
Changes to this policy
If we change how we handle your data in a meaningful way, we'll update the date at the top of this page. We encourage checking back occasionally if you have an account with us.
Contact
Questions about this policy or your data — [email protected], or see our contact page for more ways to reach us.