Privacy Policy

Last updated: August 14, 2026

Who we are

Stitch Jam Studio ("we", "us") is a small independent business selling digital cross-stitch and embroidery patterns. We are the data controller for the personal data described below.

Contact: jamstitch.studio@gmail.com

What data we collect and why

• Email address and name — when you subscribe to our newsletter or download a free pattern through our sign-up form. We use it to send the content you requested, pattern releases and occasional offers. Legal basis: your consent.
• Order and delivery information — when you buy through Etsy, Etsy processes your purchase and shares limited order details so we can deliver files and provide support. Legal basis: performance of a contract.
• Website, analytics and advertising data — if you accept analytics or marketing cookies, our pages collect aggregated visit data and advertising platforms may record that you visited us. We do not use this to identify you personally. Legal basis: your consent (see Cookies below).

We do not collect payment card details. Payments are handled entirely by Etsy, the marketplace we sell through.

Who we share data with

We use trusted third-party services that process data on our behalf, each under their own policy: Resend (holds our mailing list and sends the newsletter and the confirmation email), Supabase (stores the record of your consent and the delivery events for the emails we send you, hosted in the EU), Cloudflare (hosts this site, and its Turnstile anti-spam check runs on the sign-up form), Etsy (sales and delivery), and social platforms if you interact with our content there. We never sell your personal data.

How the newsletter is split between those two. Resend is the mailing list: it holds the addresses we actually send to, and it is where your unsubscribe takes effect. Supabase is the record-keeping side: it stores the date you subscribed and the exact wording you agreed to, so we can show that you really did ask for these emails, along with delivery events (whether a message was delivered or bounced). Your address is added to the mailing list in Resend only once you click the confirmation link — until then it sits in the record as an unconfirmed request and is never sent anything but that one confirmation email.

Turnstile deserves a plain-english note: it is an anti-spam check, not a tracker. It looks at your IP address and browser signals for a moment to tell a person from a bot, and it does not build a profile or set advertising cookies. Separately, when you subscribe we store a one-way hash of your IP address used only to rate-limit the form — that hash is deleted within 24 hours, and your actual IP address is never stored.

When you buy on Etsy, Etsy is an independent controller of your purchase data under the Etsy Privacy Policy; we only receive the limited order details needed to deliver files and provide support.

Cookies and similar technologies

We use three categories:

• Essential — needed for the site to work and to remember your cookie choice. These are always on and do not require consent.
• Analytics — help us see which patterns people look at, so we know what to design next. Set only if you accept them.
• Marketing — used by advertising platforms (such as the Pinterest Tag or Meta Pixel) to measure whether our pins and ads bring people here, and to show our patterns to similar audiences. Set only if you accept them.

Analytics and marketing cookies load only after you choose "Accept all" in our cookie banner. Legal basis: your consent, which you can withdraw at any time — change your cookie choices. You can also clear or block cookies in your browser settings.

How long we keep it

• The mailing list (Resend). We keep your address on the list until you unsubscribe or ask us to delete it. Unsubscribing removes you from the list, and we stop sending.
• The consent record (Supabase). When you unsubscribe we keep the record that you consented — the date, the wording, and the fact that you later opted out — for 3 years, and then delete it. We are required to be able to show that emails we sent were asked for, and that proof is worthless if we delete it the moment someone leaves. The record is only ever used as evidence; it is never used to email you again, and an old confirmation link cannot put you back on the list.
• Delivery events (whether a message was delivered, opened or bounced) are kept for up to 2 years and used only to keep our email working.
• Order records are kept as long as needed for support and tax obligations.

If you ask us to erase your data entirely rather than just unsubscribe, we will delete the consent record too, and keep only what the law requires us to keep.

Your rights

Depending on where you live, including under the EU and UK GDPR, you may have the right to access, correct, delete or export your data, to withdraw consent, and to object to processing. Every newsletter includes a one-click unsubscribe link: using it removes you from the mailing list held by Resend, and we keep only the consent record described above as proof that the emails you received were asked for. To exercise any right, including full erasure, email jamstitch.studio@gmail.com — we respond within 30 days.

If you are in the EU or UK, you also have the right to lodge a complaint with your local data protection authority (in the UK, the ICO; in the EU, your national supervisory authority).

California residents (CCPA/CPRA): we do not sell or share your personal information as defined by California law, and we do not use sensitive personal information. You have the right to know, correct and delete the information we hold, and you will not be discriminated against for exercising these rights — email us to do so.

Children

Our products and communications are intended for adults. We do not knowingly collect data from children.

International transfers

Because our providers operate globally, your data may be processed outside your country (including in the United States). Where required, our providers rely on recognized safeguards for such transfers, such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

Changes

We may update this policy. The "Last updated" date shows the latest version.

Contact

Questions about this policy or your data: jamstitch.studio@gmail.com — Stitch Jam Studio.