Privacy policy

Draft document. This text is a starting template. Highlighted fields must be completed with your real business details, and the whole document should be reviewed by a qualified professional for the countries you sell to before launch.

This policy explains how [Business legal name] (“we”), [Business address], collects and uses personal data when you use the Poppy Crochet website. Contact: [Contact email].

What we collect

Orders: your email address and name as entered at checkout, the patterns you bought, order amounts and download activity (including a hashed, shortened IP address used to prevent abuse).
Payments: handled by Stripe. We never see or store your full card details.
Free PDF requests: the email address you enter, the pattern you asked for, whether the email was delivered, how often the link was used and a hashed IP address used to prevent abuse. We store only a scrambled copy of your download link.
Newsletter: your email address and the time you gave consent, only if you tick the separate, optional box or subscribe. Requesting a free PDF never signs you up.
Advertising: when advertising is switched on, Google and its partners may collect information such as your IP address, device identifiers and the pages you view through cookies and similar technologies. See “Google advertising” below.
Contact form: your name, email, optional order number and message.

Why we use it

To deliver your patterns and send download links (performance of a contract). This includes the free PDF you ask us to email you.
To show ads on free pattern and journal articles (your consent where the law requires it).
To keep records required for accounting and tax (legal obligation).
To send the newsletter you asked for (consent, which you can withdraw at any time).
To answer your messages and prevent fraud or abuse (legitimate interests).

Who processes data for us

Stripe, for payments
Resend, for transactional and newsletter email, including free PDF links
Google, for advertising through Google AdSense, when advertising is switched on
Supabase, for the database and file storage
[Hosting provider]

Some providers may process data outside your country. [Describe transfer safeguards, for example Standard Contractual Clauses]

How long we keep it

Order records: [retention period required by your tax rules]. Free PDF requests: 90 days after the download link expires. Newsletter data: until you unsubscribe. Contact messages: [retention period].

Google advertising

Free pattern and journal articles may show ads served by Google AdSense. Third-party vendors, including Google, use cookies to serve ads based on your earlier visits to this and other websites. Google’s advertising cookies let it and its partners show you ads based on those visits.

If you are in the European Economic Area, the UK or Switzerland, Google’s certified consent message asks for your choice before these cookies are used. You can read the patterns and request free PDFs whichever choice you make. To change your mind, use the settings on our cookie policy page.

You can opt out of personalized advertising in your Google Ad Settings, and read how Google uses information from sites that use its services.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your data, to object to processing, and to complain to a data protection authority. Write to us at [Contact email]. See also our cookie policy.