Privacy Policy

• We collect what we need to sell you things, deliver them, run artist accounts and keep the site safe.
• We never sell your personal data or share it for advertising. No analytics or ad trackers.
• Card and bank details for payments go straight to Stripe or PayFast — we never see them.
• You can ask to see, correct or delete your data, or object to how we use it, at any time.

Oddfunk and app.oddfunk.com are run by Neo Next Enterprises, trading as Oddfunk (“we”, “us”). We decide how your personal data is used, which makes us the controller under the EU and UK General Data Protection Regulation (GDPR) and the business under the California Consumer Privacy Act (CCPA).

EU representative (Article 27 GDPR): Neo Next Enterprises GmbH, Haus Cumberland, Kurfürstendamm 194, 10707 Berlin, Germany.

UK representative (Article 27 UK GDPR): Park House, 24 Park Square West, Leeds LS1 2PW, United Kingdom.

People in the EU or UK can contact our representative there, or us directly, about anything to do with their data.

This policy covers the shop, the Oddfunk iOS app, customer accounts, Art Corner and our team workspaces. Cookies are covered in detail in the Cookie Policy.

For each thing you do with us: the data involved, what we use it for, our legal basis, and how long we keep it.

• Orders and checkout

  What: your name, email, phone number, billing and delivery addresses, the items you buy, prices, discounts, order history, and invoices we issue.

  Why: to take and deliver your order, send order and delivery emails, handle returns, refunds and support, and keep the accounting records the law requires.

  Legal basis: performing our contract with you; complying with tax and accounting law.

  Order and invoice records: 6 years after the end of the tax year of the sale (tax law); then deleted or anonymized

• Customer account

  What: your name, email, password (stored only as a secure hash), phone number, saved addresses and order history; your wishlist and the artists you follow.

  Why: to let you sign in, check out faster, see your orders, save pieces and follow artists.

  Legal basis: performing our contract with you.

  Until you ask us to close the account; orders inside it are then kept only as the tax records above

• Payments

  What: the payment amount, method and status, and a reference from the payment provider. Your full card or bank details go straight to Stripe or PayFast — we never see or store them.

  Why: to take payment, issue refunds and prevent fraud.

  Legal basis: performing our contract; our legitimate interest in preventing fraud.

  Kept with the order record (6 years)

• Delivery

  What: your name, delivery address and phone number, shared with the courier; the tracking number and delivery status.

  Why: to get your order to you and keep you updated.

  Legal basis: performing our contract with you.

  Kept with the order record (6 years)

• Contact form and Art Corner inquiries

  What: your name, email and message (and the piece you asked about).

  Why: to reply to you. These are emailed to our team; they aren't added to any mailing list.

  Legal basis: our legitimate interest in answering questions, or steps you ask for before buying.

  For as long as needed to deal with your question and keep a record of it, normally no more than 2 years

• Messages to artists

  What: your email and the messages you exchange with an artist through their profile.

  Why: to deliver your messages and their replies, and to keep the platform safe.

  Legal basis: performing our contract with you (the messaging feature); our legitimate interest in preventing abuse.

  While your account exists, unless you ask us to delete them

• Raffles

  What: your email address and, if you give it, your mobile number.

  Why: to enter you in the raffle, contact you if you win, and arrange the purchase or delivery of the prize.

  Legal basis: performing the raffle terms you agree to when you enter.

  Until the raffle is drawn and the winners' orders are completed, then deleted within 3 months

• Newsletter

  What: your email address.

  Why: to send drops, news and offers you signed up for.

  Legal basis: your consent, which you can withdraw at any time with the unsubscribe link or by emailing us.

  Until you unsubscribe

• Back-in-stock emails

  What: your email address, the exact item, color and size you asked about, whether you also ticked the box to get our newsletter, and the wording you agreed to when you signed up.

  Why: to email you once when that size is back in stock. We don't use it for anything else, and only your ticking the newsletter box adds you to the newsletter. Our team sees how many people are waiting for each size, never who.

  Legal basis: your request and consent when you ask us to notify you. You can ask us to remove you at any time.

  Deleted as soon as we've sent the email, or after 6 months if the size isn't back by then

• App notifications

  What: only if you turn notifications on in the Oddfunk iOS app: the push token Apple and Expo give your phone, which kinds of notification you chose (new drops, raffles, cart reminders), the cart you're shopping with, the items you asked us to tell you about when they're back in stock, your account if you're signed in, and when the app last checked in.

  Why: to send the notifications you chose — new drops, raffle openings and draws, one reminder about a cart you left, and back-in-stock alerts.

  Legal basis: your consent, given in the app and in your phone's notification settings. Withdraw it at any time in the app's Settings or your phone's settings.

  Until you turn notifications off (deleted straight away) or the app hasn't checked in for 180 days. Each back-in-stock request is deleted once we've sent it

If you apply to or work with Oddfunk as an artist or team member, we also handle the following.

• Artist applications

  Applicants

  What: your name, artist name, email, phone, city, portfolio link, statement, the categories and media you work in, process and AI-use answers, and our reviewers' scores and notes.

  Why: to assess your application and, if accepted, invite you to Art Corner.

  Legal basis: steps you ask for before entering an agreement with us; our legitimate interest in curating the platform.

  While the application is open; if not accepted, up to 12 months after the decision, unless you ask us to delete it sooner

• Artist accounts and works

  Artists

  What: your account details, public profile (artist name, bio, photo), the artworks, prints and e-zines you upload, certificates of authenticity and signatures, messages, followers, sales and notifications.

  Why: to run your Art Corner workspace, publish your work, issue certificates, sell your pieces and show your public profile.

  Legal basis: performing our agreement with you.

  While you're an Oddfunk artist; sales records then kept 6 years (tax law)

• Artist payouts

  Artists

  What: your payout method — mobile wallet, bank account (bank, account title, account number, IBAN) or an international payout email — and a ledger of payouts made to you.

  Why: to pay you for your sales.

  Legal basis: performing our agreement with you; complying with tax and accounting law.

  Payout method: until you change or remove it, or leave. Payout ledger: 6 years (tax law)

• Team accounts

  Staff

  What: name, work email, role, sign-in records (when, how, with which role), internal messages, and a record of administrative actions.

  Why: to give team members the right access, keep the systems secure and keep a record of who did what.

  Legal basis: our legitimate interest in running and securing the business; employment or service agreements.

  For the duration of the role, and up to 2 years after for security and accountability records

• Security check

  What: signals your browser provides to Cloudflare Turnstile, if we ask for a security check on a form (for example a sign-up or a raffle entry).

  Why: to keep bots and automated abuse off those forms.

  Legal basis: our legitimate interest in protecting the site and our customers.

  Handled by Cloudflare; we only use the pass/fail result for that form

• Your country, for prices

  What: your IP address, looked up on our own server against an offline database to find your country. Not stored, logged or sent anywhere — only the resulting currency is kept, in a cookie.

  Why: to show prices in your currency.

  Legal basis: our legitimate interest in showing prices you understand. Object by picking a currency yourself.

  Not kept (the IP address is discarded straight away)

• Abuse protection and server logs

  What: IP addresses held in memory to rate-limit public forms; technical server logs that record each request to our servers — the IP address, time, the page or API address requested, the response and the browser type.

  Why: to stop spam and abuse and to diagnose faults.

  Legal basis: our legitimate interest in keeping the site secure and working.

  Rate-limit data: minutes. Server logs: a limited period set by our host, typically days to weeks

• Cookies

  We use only essential cookies and, with your consent, one preference cookie for your currency. No analytics or advertising cookies. The full list is in the Cookie Policy.

  See the Cookie Policy

We don't make decisions about you based solely on automated processing, and we don't profile you. Artist applications are reviewed by people.

Almost everything comes from you — when you order, sign up, apply, message or contact us. We also receive payment confirmations from Stripe or PayFast, delivery updates from couriers, and, for team members, sign-in details from our own sign-in service.

We share personal data only with the service providers below, who process it on our behalf under contract and only to provide their service to us; with couriers and payment providers as needed for your order; and with authorities when the law requires it. Your public artist profile and published works are, of course, public.

• Railway

  Hosts the website, our sign-in service and uploaded files.

  United States

• Neon

  Hosts our database (orders, accounts, artist and team data).

  United States (AWS, Ohio)

• Cloudflare

  The Turnstile security check on some forms, and encrypted backup storage of uploaded files (R2).

  United States and worldwide network

• Resend

  Sends our emails (orders, accounts, invitations, back-in-stock emails) and holds the newsletter list.

  United States

• Stripe

  Card payments and fraud prevention.

  United States and Ireland

• Expo and Apple

  Deliver notifications to the Oddfunk iOS app if you turn them on (the push token and the notification text).

  United States

• PayFast

  Payments in Pakistan.

  Pakistan

• TRAX and DHL

  Delivery and shipment tracking.

  Pakistan / worldwide

We do not sell personal data, and we don't share it with advertisers, data brokers or social networks. If Oddfunk is ever reorganized or sold, data may pass to the new owner, who would have to honor this policy.

We operate from Pakistan and our providers are mainly in the United States, so your data is processed outside the EU, EEA and UK. Where a country has no adequacy decision, transfers rely on safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or the EU-US Data Privacy Framework where the provider is certified. You can ask us for details of the safeguard that applies.

We keep personal data only as long as we need it for the purpose it was collected for, then delete or anonymize it. The periods for each kind of data are listed above. In short: order, invoice and payout records for 6 years after the end of the tax year (as tax law requires); accounts until you ask us to close them; newsletter until you unsubscribe; inquiries normally no more than 2 years; rejected artist applications up to 12 months. Backups roll over and are overwritten on their own schedule.

All traffic is encrypted (HTTPS). Passwords are stored only as secure hashes. Artist payout details and payment-provider credentials are encrypted at rest (AES-256-GCM). Access to personal data is limited by role, administrative actions are logged, and our databases and backups are with established providers.

No system is perfectly secure. If a breach puts your data at risk, we will notify the relevant authority (within 72 hours where the law requires) and tell you without undue delay when there's a high risk to you.

EU, EEA and UK (GDPR). You have the right to:

• access the personal data we hold about you and get a copy;
• have it corrected if it's wrong or incomplete;
• have it erased, where we no longer have a reason to keep it;
• restrict how we use it in some circumstances;
• receive data you gave us in a portable, machine-readable format;
• object to our use of it based on legitimate interests — and to direct marketing at any time;
• withdraw consent at any time, without affecting what happened before;
• complain to a data protection authority — in the EU, the one where you live or work; in the UK, the Information Commissioner's Office (ico.org.uk). We'd appreciate the chance to sort it out first.

Elsewhere. Many other laws give similar rights, including Brazil's LGPD, Canada's PIPEDA and Switzerland's FADP. Wherever you are, you can ask us what we hold about you and ask us to correct or delete it.

How to ask. Email hello@oddfunk.com. It's free. We may need to confirm your identity first (usually by replying from the email on your account). We reply within one month (GDPR) or 45 days (California), and tell you if we need longer and why. Some data we must keep by law, such as invoices — we'll tell you if that applies.

This section is our notice at collection and privacy policy disclosure under the CCPA as amended by the CPRA, and also applies under other US state privacy laws (such as those of Virginia, Colorado, Connecticut, Utah and Texas).

Categories collected in the past 12 months, all for the business purposes described in this policy (providing our services, security, fraud prevention, accounting and legal compliance):

• Identifiers — name, email, phone, postal address, account and order IDs, IP address (used briefly, not kept), and the iOS app's push token if you turn notifications on.
• Customer records — billing and delivery details.
• Commercial information — products bought, order and return history, raffle entries.
• Internet activity — on this site only, as needed to run your cart and account.
• Approximate location — your country, from your IP address, to choose a currency.
• Professional information — for artists: portfolio, statement and works.
• Sensitive personal information — account sign-in details (all users), and for artists only, financial account details used solely to pay them. We don't use sensitive information to infer anything about you, so the right to limit its use doesn't apply.

Sources, disclosure and retention are as described in the sections above; we disclose these categories only to the service providers listed, for business purposes.

No selling or sharing. We do not sell personal information and do not share it for cross-context behavioral advertising, and haven't in the past 12 months — including of anyone under 16. We honor Global Privacy Control signals as an opt-out.

Your rights: to know what we collect, use and disclose; to delete; to correct; to opt out of sale or sharing; and to limit use of sensitive information. You can use an authorized agent, who must show your signed permission. Make a request by emailing hello@oddfunk.com. We won't discriminate against you — no different prices or service — for using these rights. If we decline a request, you can appeal by replying to our decision.

We send service emails you need — order confirmations, delivery updates, password resets, invitations — whether or not you're subscribed. Marketing emails go only to people who signed up for the newsletter, and every one has an unsubscribe link. The iOS app sends notifications only if you turn them on, and only the kinds you choose; switch them off in the app's Settings or your phone's settings. We don't send marketing by SMS and we don't sell or rent our list.

Oddfunk is not aimed at children. We don't knowingly collect personal data from anyone under 16 (or under 13 in the US). If you believe a child has given us their data, contact us and we'll delete it.

We'll update this policy when what we do changes, and change the date at the top. If a change is significant, we'll make it clear on the site or email account holders before it takes effect.

Questions, requests or complaints: hello@oddfunk.com, or write to Neo Next Enterprises, C33, 1st Floor, Business Bay, Lake City, Raiwind Road, Lahore 54790, Punjab, Pakistan.