Privacy policy for Teddyshop

This English version is provided for convenience. Only the German version is legally binding.

In short: the tools work without signing in, and your images stay on your device. With an account we store only your email address, encrypted access to your Fourthwall store and a history. Teddyshop sets no cookies.

1. Controller

2. Visiting the website

When you visit, your browser transmits technically necessary data to our hosting provider: IP address, date and time, the address visited and browser type. This serves the secure delivery of the site. Hosting: Vercel Inc.; the server functions run in Frankfurt. There is no visitor counting or advertising identifier on teddyshop.app.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).

3. Tools without signing in

Merch calculator, collectible cards, wallpapers, members kit and link page work entirely in your browser. Images you open there are neither uploaded nor stored. The only exception is described in section 5.

4. Account and Google sign-in (optional)

To connect with Fourthwall you need an account. Sign-in runs via Google (Google Ireland Limited) and Supabase Inc. as processors; the data is held on servers in the EU (Ireland region).

Teddyshop stores your email address, a technical identifier and the time of creation. The sign-in itself is shared with other Teddynews services. If you delete your Teddyshop account, it therefore remains; on request we delete it by email to office@teddynews.at.

Legal basis: Art. 6(1)(b) GDPR (providing the service you requested).

5. Connection to your Fourthwall store

When you connect your store, you give your consent directly at Fourthwall. Teddyshop then receives access with these permissions: read store data; read, create, change and publish products and collections; read and create discount codes; read orders and membership tiers. Teddyshop does not store your buyers’ data, such as names or addresses.

We store your store’s identifier and name, the time of connection and the access itself. We encrypt the access before storing it (AES-256).

If you click “Add as sticker to my store” or use the store assistant on the Account page, your browser sends the chosen design with product name, description and your profit per item to our server. From there it goes to your Fourthwall account. We do not store the design. Provider: Fourthwall, Inc., Santa Monica, USA; Fourthwall’s privacy policy applies there.

With “Add as download to my store” on the Wallpapers page, your browser uploads the finished pack directly to Fourthwall’s file storage (Google Cloud Storage). The file does not pass through the Teddyshop server and is not stored by Teddyshop.

The sales overview in your account adds up the orders of the last 30 days at Fourthwall: number, items, revenue and best-selling products. Names, addresses and email addresses of your buyers are neither shown nor stored.

If you create a discount code on the Account page, the code, discount and limits go to your Fourthwall account. We keep only the history entry (code and discount).

Legal basis: Art. 6(1)(b) GDPR (carrying out your request).

6. Payment via Stripe

If you book “Have your store set up” or we invoice the Teddyshop share, payment runs via Stripe Payments Europe Ltd, Dublin, Ireland. Stripe processes name, email address, billing address and payment details and sends the invoice by email. Teddyshop never sees card details. Stripe’s privacy policy applies.

For the monthly statement, Teddyshop stores which products were created with the Teddyshop share, the time of your consent, the Stripe customer number and, per month, the number of items, amount and invoice number. Stripe keeps invoices for us as long as tax and company law require.

Legal basis: Art. 6(1)(b) GDPR (contract) and (c) (statutory retention obligations).

If you request a quote on the Plush figure page, we send your details (name or company, email address, channel, quantity, description) by email via the delivery service Resend to our inbox and answer from there. Teddyshop does not store the request in a database. Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract).

For existing customers we create, on request, a private preview page with their logo on products. We store the customer’s name, a personal sentence, the product images (created at Fourthwall, stored on its image server), the expiry date and the number and time of the latest visits, without IP address or device data. If you choose items and colours there and approve your selection, we store the selection, your optional message and the time and send them by email (Resend) to our inbox. When the page is first opened, we receive a short notification without any data about you. The page can only be reached via the personal link, does not appear in search engines and is deleted automatically 30 days after expiry, immediately on request. Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract).

If you request a preview on the Merch for clubs and companies page, we send your details (company or club, email address, website, message) and your logo as an attachment by email via the delivery service Resend to our inbox. Teddyshop does not store the request or the logo in a database; only the time of a request is recorded, without any other details, so that the form cannot be misused for mass mailing (Art. 6(1)(f) GDPR). For the preview we upload your logo to Fourthwall (see above). Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract).

7. History

Your account shows the latest actions: connecting, disconnecting, products created, collections, publishing, discount codes, changes of account status and errors, each with a time. The history serves your overview and protection against misuse; each account can create 30 products per day.

Legal basis: Art. 6(1)(b) and (f) GDPR (protection against misuse).

8. Operation and troubleshooting

To keep Teddyshop running reliably, an automatic monitor checks once a day whether pages and interfaces work and counts errors in the history. For support and troubleshooting, the operator sees email address, store name, times and history of accounts in a protected admin area. There are no other recipients.

In case of misuse or at your request, the operator can pause an account (no new items in the store) or block it (no use) and store an internal note. You see the status in your account; viewing, disconnecting and deleting always remain possible.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).

9. Storage period and deletion

All Teddyshop data remains stored until you delete it. On the Account page you have two options: “Disconnect” deletes the store access immediately. “Delete account” deletes email address, store access, account status, note and history immediately and completely.

Products already in your Fourthwall store remain there. You remove the Teddyshop app in your Fourthwall dashboard under “Apps”.

10. What is stored on your device

Teddyshop sets no cookies. Your browser’s storage holds two entries: your choice between light and dark (kept) and your sign-in token (deleted when you close the tab).

11. Links to other services

The “Create for free” link to Fourthwall is a referral link: Fourthwall recognises that you come via Teddynews and credits Teddynews. Teddyshop does not transmit any data.

On example stores such as NOVURA merch, your browser loads Spreadshirt’s store only when you click “Show the store here”. From then on it connects to Spreadshirt and transmits, among other things, your IP address; Spreadshirt may set its own cookies and asks for consent itself. The controller there is sprd.net AG, Gießerstraße 27, 04229 Leipzig, Germany; Spreadshirt’s privacy policy (German) applies. Legal basis: Art. 6(1)(a) GDPR (your click).

Links lead to, among others, teddynews.at, Fourthwall and Ko-fi. Their own privacy policies apply there, for example the privacy policy of teddynews.at (German).

12. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21 GDPR). Please contact office@teddynews.at.

You also have the right to lodge a complaint with a supervisory authority, in Austria the Austrian Data Protection Authority (Datenschutzbehörde).