Privacy policy, Pattern Paste Canonical: https://patternpaste.com/privacy/ Privacy # Privacy policy Last updated 2026-09-09 ## In short We ask for an email address so you can sign in and reach what you bought. We never see your card details. We do not sell anything about you to anybody, and there is no advertising or cross-site tracking on this site. ## Who is responsible for your data This site is run by JD, trading as Pattern Paste, based in the United Kingdom. JD is the controller for the personal data collected through this site: we decide what is collected and why, and we are the one to contact about it. Stripe, our payment processor, and the merchant of record for buyers outside the UK, the US, Australia, New Zealand, Switzerland, Liechtenstein, Japan, Singapore, South Africa, Taiwan, Malaysia, Thailand and Iceland, is a separate controller for the payment itself; what it holds is covered by its own privacy policy (https://stripe.com/privacy). Questions about anything here, including a request to see or delete what we hold, go to support@patternpaste.com. The postal address is available on request and appears on Stripe's invoices. ## What we collect Only what an account needs: - Your email address, to create the account, sign you in and send purchase confirmations - A password, stored hashed, never in a form we can read - What you have access to, so the catalogue can unlock for you - The address and site type of a connected WordPress installation, so plugin updates and adding paid designs in WordPress can be authorised within the site allowance - When the account was created, because a new account's trial is counted from that day - Whether you ticked the marketing box, and when, so we can show you what you chose and honour it We do not ask for a name, a phone number, a postal address or a company. ## What we never hold - Card numbers, expiry dates or anything else off a payment card. Checkout happens on the payment processor's own form and those details never reach our servers - Billing addresses and tax identifiers, which the payment processor holds for its own invoicing - The content, visitors or page views of sites where you use our sections. Core Patterns make no connection back to us, and the companion plugin makes no request when a visitor loads a page. Its admin requests are limited to licence activation and status, updates, the pattern catalogue (which carries the free Core Patterns), the paid designs you choose to add from its library, and the pattern files described next ## What the companion plugin downloads When a site owner inserts a pattern, the companion plugin downloads its images and 3D models from patternpaste.com, once, into that site's own Media Library and uploads folder. The request comes from their server and carries its IP address and a user agent naming the plugin version and the site's address; no licence key or personal data is sent. Visitors to their site never contact us: its pages load those files from the site itself. ## Why we hold it, and the lawful basis UK data protection law requires a lawful basis for each use. Ours are: - Running the account, giving you what you paid for, and emailing you about the account itself (a receipt, a password reset, or a note when a subscription is about to renew or has lapsed): performance of our contract with you. These need no tick - Support replies and refund decisions: performance of the contract, and our legitimate interest in applying the refund policy (https://patternpaste.com/refunds/) fairly - Security and fraud prevention: rate limiting, blocking abuse, investigating a chargeback: our legitimate interest in keeping the site and its subscribers safe - Site analytics: our legitimate interest in knowing what is used, with the data kept to a minimum and no profiling - Marketing email: your consent, given by ticking the box, withdrawable at any time - Tax and accounting records of sales: legal obligation, held mainly by Stripe as our payment processor, and the merchant of record for buyers outside the UK, the US, Australia, New Zealand, Switzerland, Liechtenstein, Japan, Singapore, South Africa, Taiwan, Malaysia, Thailand and Iceland Marketing email (new patterns, the blog, an offer) is separate and opt-in. The box is unticked when you sign up, you can untick it on your account page at any time, every send carries a one-click unsubscribe, and leaving takes effect immediately. ## Who processes it for us These services handle data on our behalf: - Stripe, checkout, subscription billing, invoices and refunds, and the merchant of record (through Stripe Managed Payments) for buyers outside the UK, the US, Australia, New Zealand, Switzerland, Liechtenstein, Japan, Singapore, South Africa, Taiwan, Malaysia, Thailand and Iceland, where it also charges and remits VAT and sales tax. Card details and billing address go to Stripe and never reach us (United States, with processing in the EU and the UK): privacy policy (https://stripe.com/privacy) - Supabase, accounts, sign-in and entitlement (Sweden (EEA)): privacy policy (https://supabase.com/privacy) - Umami, site analytics, self-hosted on our own server, cookieless and never used to identify you (Finland (EEA), our own server): privacy policy (https://umami.is/privacy) - Resend, transactional email, and the mailing list if you opt in (United States): privacy policy (https://resend.com/legal/privacy-policy) - Cloudflare, content delivery, caching and protection against attacks, so it sees requests in transit (United States, with a global network): privacy policy (https://www.cloudflare.com/privacypolicy/) ## Where your data is processed Your account data lives in the EEA: the database in Sweden and the site itself, with its analytics, in Finland. The UK recognises the EEA as providing adequate protection, so those transfers need no further safeguard. Resend and Cloudflare are US companies and may process data in the United States; those transfers rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified, and otherwise on the International Data Transfer Agreement or standard contractual clauses with the UK addendum. Stripe processes payment data under its own safeguards as our payment processor, and the merchant of record for buyers outside the UK, the US, Australia, New Zealand, Switzerland, Liechtenstein, Japan, Singapore, South Africa, Taiwan, Malaysia, Thailand and Iceland. ## Analytics We count visits with Umami, which runs on our own server rather than a third party's. It records which page was viewed, which site or search sent you, the rough shape of your device and browser, roughly how quickly the page loaded, and an approximate country. It sets no cookie, holds no identifier that follows you between sites, and is never used to build a profile of you. Your IP address is used only to work out that country and to count you as one visitor rather than several, and it is not stored beside what you looked at. We do not record your screen, your mouse or what you type. If you would rather not be counted at all, a tracker blocker stops it, or write to support@patternpaste.com and we will tell you what we hold. ## Cookies The site sets a cookie to keep you signed in, and nothing else. There is no advertising cookie, no cross-site tracking pixel and no analytics cookie: the analytics above works without one, which is why there is no consent banner in front of it. If that changes, this section changes with it and you get a choice before anything non-essential is set. ## How long we keep it - Your account, its subscription history and your marketing preference stay while the account exists, because that record is what proves you own what you bought. Delete the account and the personal data goes with it - Support emails: up to 24 months after the last message, so we can follow up on a subscription or a refund - Analytics: aggregated, with no identifier, and kept indefinitely in that form - Payment records are kept by Stripe for as long as tax law requires, typically six years, which is its obligation and not something either of us can waive When data is no longer needed for these purposes it is deleted or anonymised. ## Security Everything travels over HTTPS, passwords are hashed and never stored in a readable form, database access is limited to the application and to us, and secrets are held outside the code. No system is perfectly secure, so if you believe your account has been compromised, write to support@patternpaste.com and change your password. ## Your rights Under the UK GDPR you can ask us to: - access the personal data we hold about you, and receive a copy - correct anything inaccurate - erase it: deleting your account from the account page does this immediately - restrict or object to processing that relies on our legitimate interests - port your data to you in a machine-readable form - withdraw consent to marketing at any time, on your account page or via the link in any email Write to support@patternpaste.com and we will answer within a month, extendable where the law allows for a complex request; we may ask you to confirm you own the account first. If you are not satisfied you can complain to the Information Commissioner's Office at ico.org.uk (https://ico.org.uk/make-a-complaint/), though we would rather hear from you first. ## Changes to this policy Changes are posted here with the date at the top of the page. A change that affects what we collect or who processes it is emailed to account holders as well.