This document is a first draft, written so the site has the pages a launch needs. It has not been reviewed by a solicitor and it is not legal advice. Anything marked to be confirmed is a decision nobody has made yet.
In short
We ask for an email address so you can sign in and reach what you bought. We never see your card details. We do not sell anything about you to anybody, and there is no advertising or cross-site tracking on this site.
Who this is about
Pattern Paste is run by JD. Questions about anything here, including a request to see or delete what we hold, go to [email protected].
What we collect
Only what an account needs:
- Your email address, to create the account, sign you in and send purchase confirmations
- A password, stored hashed, never in a form we can read
- What you have access to, so the catalogue can unlock for you
We do not ask for a name, a phone number, a postal address or a company.
What we never hold
- Card numbers, expiry dates or anything else off a payment card. Checkout happens on the payment processor's own form and those details never reach our servers
- Billing addresses and tax identifiers, which the payment processor holds for its own invoicing
- Anything about the sites you paste our patterns into. A pattern is markup in your database; it phones nothing home, and neither does the companion plugin
Why we hold it
To run the account, to give you what you paid for, and to email you about that purchase. Those are the contract we have with you. Marketing email is separate and opt-in: if you join the list we send you a confirmation link first, every send carries a one-click unsubscribe, and leaving takes effect immediately.
Who processes it for us
These services handle data on our behalf:
- Stripe, payments and checkout: privacy policy
- Supabase, accounts, sign-in and entitlement: privacy policy
- Umami, site analytics, self-hosted on our own server, cookieless and never used to identify you: privacy policy
- Resend, transactional email, and the mailing list if you opt in: privacy policy
Analytics
We count visits with Umami, which runs on our own server rather than a third party's. It records which page was viewed, which site or search sent you, the rough shape of your device and browser, roughly how quickly the page loaded, and an approximate country. It sets no cookie, holds no identifier that follows you between sites, and is never used to build a profile of you.
Your IP address is used only to work out that country and to count you as one visitor rather than several, and it is not stored beside what you looked at. We do not record your screen, your mouse or what you type. If you would rather not be counted at all, a tracker blocker stops it, or write to [email protected] and we will tell you what we hold.
How long we keep it
Your account and its purchase history stay while the account exists, because that record is what proves you own what you bought. Delete the account and the personal data goes with it. Payment records are kept by the payment processor for as long as tax law requires, which is their obligation and not something either of us can waive.
Your rights
Under UK and EU data protection law you can ask for a copy of what we hold, ask us to correct it, ask us to delete it, and object to a use of it. Write to [email protected] and we will answer within a month. If you are not satisfied you can complain to the Information Commissioner's Office at ico.org.uk.
Changes to this policy
Changes are posted here with the date at the top of the page. A change that affects what we collect or who processes it is emailed to account holders as well.