Privacy
Last updated 2 August 2026
This page says exactly what this site records about you, why it is allowed to, how long it is kept and how to get rid of it. It is written to be read, not to be scrolled past.
Who is responsible
JobLeadHub, trading as TUMANIC, is the data controller for this site. Contact for any privacy question or request: tumanicmae@gmail.com.
Visit statistics
This site counts visits. It does not use cookies and stores nothing whatsoever on your device. Consent banners exist because of what sites put on your device, so there is no banner here. It does not build a profile of what you personally looked at either — which pages were viewed is kept only as a running total across everybody.
Your IP address is never written down. To tell one visitor from another, the server makes a one-way hash of your IP address, your browser's user agent and a secret it keeps. Nobody, including us, can work backwards from that hash to you or to your IP address.
Being straight with you about what that means: because the hash does not change from day to day, the same browser on the same connection produces the same value on every visit. So we can see that someone came back, without ever knowing who they are. That is how the "unique visitors" figure is counted honestly instead of counting you again each morning.
That stable value counts as personal data under UK GDPR, even hashed, because it singles out one person across visits. It is treated accordingly: it is deleted after 400 days without a visit, it is never combined with your order details, it is never shared, and rotating the server's secret destroys every existing value at a stroke. Still true throughout — no cookie, nothing stored on your device, and no raw IP address kept anywhere.
What is actually kept is a set of daily counts:
- How many page views and how many visitors
- Which pages were viewed
- Which website you arrived from — the site name only, never the full link
- Whether the device was a phone, tablet or desktop
- Your browser's preferred language
- Which sections and buttons were used, as totals
Lawful basis: legitimate interests — understanding whether the site works, using the least information that answers the question.
If your browser sends a Global Privacy Control or Do Not Track signal, nothing is counted at all.
Buying something
To post you an artwork we need your name, email address and delivery address. That is kept with the order.
Card details never reach this site. Payment happens on Mollie's own pages, and we are told only whether it succeeded.
Lawful basis: performance of a contract, plus a legal obligation to keep sales records.
The mailing list
If you join the list your email address is stored by our newsletter provider. Every email has an unsubscribe link, and leaving removes you.
Lawful basis: consent, which you can withdraw at any time.
Other companies involved
| Who | What for |
|---|---|
| Mollie | Taking payments. They handle your card details, we never see them. |
| Google Firestore | Storing orders and the artwork catalogue. |
| Render | Running the server. |
| GitHub Pages | Serving the pages you are reading. |
| Buttondown | The mailing list, if you join it. |
| Spotify | The music player embedded on the Music section. |
| Google Fonts | The typefaces used across the site. |
About the Spotify player
Worth being straight about: the embedded Spotify player is Spotify's, not ours, and loading it lets Spotify set its own cookies and see your IP address. We have no control over and no access to that. It is covered by Spotify's own privacy policy. If you would rather it did not load, block third-party cookies or use a content blocker before opening the Music section.
How long things are kept
| What | How long |
|---|---|
| Your visitor hash | Deleted after 400 days with no visit. Come back within that and the clock restarts |
| Daily visitor markers | Deleted within two days, once the day's count is settled |
| Daily visit counts | Up to about 13 months, then deleted |
| Orders and delivery details | Six years, which UK tax law requires for sales records |
| Mailing list | Until you unsubscribe |
Your rights
Under UK GDPR you can ask us to:
- Tell you what we hold about you, and give you a copy
- Correct anything wrong
- Delete it
- Restrict or object to how it is used
- Send it to you or someone else in a portable format
On deletion, one honest caveat: if you have bought something, the law requires the sale record to survive for six years. In that case your name, email and address are erased and only the anonymous transaction remains.
On visit statistics: the totals are anonymous and hold counts, not people, so there is nothing in them to find or correct. Your visitor hash is a different matter — it is personal data and you can ask us to erase it. One honest limitation: we cannot match it to your name or email, because it is built only from your connection and your browser, so we cannot pick yours out of the pile on request. What we can do is rotate the secret behind it, which destroys every visitor hash we hold, yours included. Ask and we will.
Ask by writing to tumanicmae@gmail.com. You will get an answer within one month.
Complaints
If you are unhappy with how this was handled you can complain to the Information Commissioner's Office at ico.org.uk, or call 0303 123 1113.
Changes
If this notice changes, the date at the top changes with it. Every past version is in the site's public history on GitHub.