At least 8 characters. No capital letter or digit required: the site only refuses passwords that are too easy to guess (common word, first name, date, qwerty, 1234…). If refused, add a second word after a hyphen. Both lines below must be green.
Cookies
Cart, checkout, payment, chosen language. They cannot be switched off, and are used for nothing else.
Google Analytics, with the IP address anonymised. Used only to count visits and see which pages interest people. No advertising, no resale.
Meta pixel (Instagram, Facebook), Pinterest tag and Google ad tags. They show which of the workshop's ads led to a visit or an order, and let it show its pieces to people who have already visited the site. No resale of data.