DRAFT. This text is a draft under review and not yet final.
Privacy policy (DRAFT)
1. Who is responsible
BookPublisherTools, [legal form, for example sole trader (eenmanszaak) or BV], [street and number], [postcode] [city], the Netherlands, KvK [KvK number], is the controller of your personal data for this shop (Kitchen Table Escapes). Contact for privacy questions: hello@kitchentableescapes.com.
2. What we collect and why
| Data | Why | Legal basis (GDPR Art. 6) |
|---|---|---|
| Email address, name (if you give it), country and postcode or billing address (as Stripe Checkout asks, for example for tax) | To make and deliver your purchase, send your download link and receipt, and answer support questions | Contract (6(1)(b)) |
| Order details: product, price, tax, currency, date, order and payment IDs, promotion code used | Order records and bookkeeping | Contract (6(1)(b)); legal obligation for tax records (6(1)(c)) |
| Consent record: that you ticked the checkout box, when, and the terms version | Proof of your request for immediate delivery and your acknowledgement about withdrawal | Legal obligation and legitimate interest (6(1)(c), 6(1)(f)) |
| Download records: link token (stored only as a scrambled hash), number of downloads, expiry | To limit and protect your download link | Contract (6(1)(b)) |
| Marketing choice ("Send me tips and new kits?") | To send optional tips and new-kit emails only if you said yes | Consent (6(1)(a)); you can withdraw it at any time |
| Emails you send us | To answer you | Contract or legitimate interest |
| Technical data (IP address, browser, time of request) handled by our hosting provider | Security and abuse prevention | Legitimate interest (6(1)(f)) |
We do not receive or store your card or bank details; Stripe handles them. We do not sell your data. [Hans confirms: no analytics or tracking cookies at launch. If analytics are added later, update this section and check cookie consent rules.]
3. Who processes data for us
| Provider | Role | What they handle | Where (to confirm) |
|---|---|---|---|
| Stripe (Stripe Payments Europe, Ltd.) [reviewer confirms the entity] | Payment processing. Stripe acts as our processor for some processing and as an independent controller for its own legal duties (for example fraud prevention and financial regulation) [reviewer confirms] | Payment, email, billing details, device data for fraud checks | EU and other countries; see Stripe's privacy policy and data processing terms |
| Cloudflare | Hosting of the website, the order system (D1 database) and file storage (R2), and network security | Order records, download records, technical request data | Global network; see Cloudflare's data processing terms |
| [Email provider, Hans picks] | Sending delivery and follow-up emails | Email address, name, email content, delivery and open events [check what the provider records] | [to confirm] |
If any provider moves data outside the European Economic Area, it must use a lawful transfer tool (for example the EU Standard Contractual Clauses or the EU-US Data Privacy Framework). [Reviewer: confirm per provider.]
4. How long we keep data
| Data | Kept for |
|---|---|
| Order and payment records, invoices and receipts | 7 years, for Dutch tax record-keeping rules [reviewer confirms the exact rule and term] |
| Consent record for immediate delivery | As long as the order record |
| Download tokens and download counts | Until 30 days after the link expires, then deleted |
| Webhook event IDs (used to avoid double deliveries) | 90 days |
| Marketing choice and email list membership | Until you unsubscribe, then removed from the list within [30] days (we keep a minimal "do not email" record so we do not email you again) |
| Support emails | [2 years] after the last message |
| Technical request logs at Cloudflare | As set by Cloudflare's own retention [reviewer confirms] |
5. Your rights
You can ask to see, correct or delete your data, to limit or object to how we use it, and to get a copy (data portability). You can withdraw marketing consent at any time with the unsubscribe link or by email. Some data we must keep for tax rules, even if you ask us to delete it. Email hello@kitchentableescapes.com; we answer within one month.
You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the authority in your own EU country.
6. Security
Your data is sent over HTTPS. Download links are random and time-limited. Only BookPublisherTools has access to the order system. Secret keys are stored as encrypted secrets with our hosting provider, never in our code.
7. Children
The kits are for children to play, but buyers must be adults. We do not knowingly collect children's data. The birthday child's name is written by hand on the printouts and never sent to us.
8. Changes
We will update this policy if what we do changes. The date and version are at the top.