Privacy & cookies
What we collect, and why
This policy covers celestiart.com: the guide pages, the star map editor, your purchase and the emails we send. It is written to meet the EU and UK GDPR and Türkiye’s Personal Data Protection Law (KVKK, No. 6698).
Last updated 28 September 2026.
The short version
- There are no accounts. You design anonymously; we never ask for a name or password.
- Your card and payment details go to Paddle, our reseller, never to us.
- We use your email address once, to send you the link to your files, and keep only a scrambled fingerprint of it so we can resend links if you ask.
- Your design and your files are deleted thirty days after purchase; unbought designs after thirty days without changes.
- Google Analytics runs on the guide pages only if you accept it. Cloudflare counts page visits without cookies and without identifying you. Fonts and everything else are served from this site.
Who is responsible
The data controller is Burak Kadan, an independent developer in Türkiye (see seller information). Contact for anything about your data: support@celestiart.com.
What we process
| What | Why | Legal basis | Kept for |
|---|---|---|---|
| Your design (place, date, words, style), stored on our server with an anonymous session cookie | To let you save and buy it and to make your files | Contract (GDPR art. 6(1)(b); KVKK art. 5(2)(c)) | 30 days after purchase, or 30 days after your last change if you do not buy |
| Purchase record from Paddle: transaction and customer IDs, amount, currency, date, refund status | To unlock your design, handle faults and refunds, and keep accounts | Contract; legal obligation (art. 6(1)(c); KVKK art. 5(2)(ç)) | As long as tax and accounting law requires |
| Your consent at checkout to immediate delivery, with its time and wording version | To prove the right of withdrawal was waived with your consent | Legal obligation | As long as the purchase record |
| Your email address, received from Paddle | To send the link to your files once | Contract | Not stored; only a keyed hash (a one-way fingerprint) is kept for link recovery, for as long as the purchase record |
| An email address you type into “recover my purchase” | To resend your links | Contract; legitimate interest | Not stored |
| Your files (PNG, PDF, SVG) | To let you download them | Contract | 30 days after purchase |
| Download records: when each file was downloaded, which format, whether through the editor or your private link, and a keyed hash of the IP address | To show that the files were delivered if a payment is disputed or charged back | Legitimate interest (fraud prevention) | 180 days |
| Security data: hashed IP address for rate limiting, request logs without personal content | To protect the service against abuse | Legitimate interest (art. 6(1)(f); KVKK art. 5(2)(f)) | Rate-limit records 1 day, logs up to 30 days |
| Visit statistics on every page (Cloudflare Web Analytics): the page, the referring site, browser and device type, country and page speed. No cookies or similar storage, and no profile of you is built | To see which pages are used and whether they load quickly | Legitimate interest (art. 6(1)(f); KVKK art. 5(2)(f)) | Aggregated statistics, per Cloudflare’s retention settings |
Analytics on the guide pages (Google Analytics 4, measurement ID
G-ELCZBRGQS8) | To see which pages are useful | Consent (art. 6(1)(a); KVKK explicit consent) | Google’s retention settings, up to 14 months |
Cookies
- Session and security cookies (editor): keep your designs together and protect your requests. They are strictly necessary and expire after 30 days.
- Analytics cookies (guide pages): only if you accept them below.
Your analytics choice
Analytics runs only if you accepted it when you first arrived.
Who else processes your data
- Paddle (Paddle.com Market Limited, United Kingdom) sells you the star map as our reseller and processes your payment and billing details as an independent controller under Paddle’s privacy policy.
- Cloudflare (Cloudflare, Inc.) hosts the site, stores designs and files, renders your files, sends our emails, counts page visits without cookies (Web Analytics) and runs the Turnstile bot check, as our processor.
- Open-Meteo receives the place name you search for in the editor to find its coordinates; nothing that identifies you is attached.
- Google receives analytics data only if you accept analytics.
Some of these providers process data outside Türkiye and the EU (for example in the United States). Transfers rely on the European Commission’s standard contractual clauses or the EU–US Data Privacy Framework, and for Türkiye on the safeguards of KVKK article 9.
What we do not do
- We do not see or store your card or payment details.
- We do not keep your email address in readable form.
- We do not sell your data, show adverts or build profiles.
- We do not ask for your age or identity documents.
Your rights
You can ask us for access to your data, to correct or delete it, to restrict or object to its use, and to receive it in a portable form (GDPR arts. 15–21; KVKK art. 11). You can withdraw your analytics consent at any time above. There are no accounts, so to identify your purchase please include the email you used at checkout or the Paddle receipt number. Write to support@celestiart.com; we reply within 30 days.
You may also complain to a data protection authority: in Türkiye the Personal Data Protection Authority (KVKK, kvkk.gov.tr), in the EU the authority of your country, in the UK the ICO.
Children
CelestiArt is not directed at children. Buyers must be 18 or have a parent’s or guardian’s permission (see the terms).
Changes
If we change how we handle data, we will update this page and the date at the top.