Privacy Policy

1. Who we are

SiteCrafted operates the website sitecrafted.shop and sells downloadable website templates. For the purposes of the UK and EU General Data Protection Regulation, SiteCrafted is the data controller for the personal data described in this policy.

You can reach us about anything in this policy at hello@sitecrafted.shop.

2. What we collect

When you buy a template

• Your email address — so we can send your download link and receipt;
• Your name — so the receipt and invoice are correct;
• Your billing country — to determine the correct VAT treatment;
• Order details: which templates, how many licences, amount paid, order reference, date.

We do not collect a postal or delivery address, because nothing is ever shipped. We do not receive, process or store your card number, CVV or bank details — those go directly to Stripe or PayPal and never touch our systems.

When you contact us

• Your name, email address and whatever you choose to write in your message.

When you subscribe to the newsletter

• Your email address, and the date you subscribed.

When you simply visit

• Aggregated, non-identifying analytics: pages viewed, approximate country, referring site, device type. We use a privacy-focused analytics provider that does not set advertising cookies or build cross-site profiles.
• Standard server logs kept briefly for security and abuse prevention.

3. Why we use it, and our legal basis

• To deliver your purchase — sending download links, receipts and licence details. Legal basis: performance of a contract.
• To provide support — answering your questions and re-issuing lost links. Legal basis: performance of a contract, and our legitimate interest in supporting customers.
• To meet tax and accounting obligations — retaining invoices and VAT records. Legal basis: legal obligation.
• To send the newsletter — only if you opted in, and only until you opt out. Legal basis: consent.
• To improve the site — understanding which templates and pages are useful. Legal basis: legitimate interest, using data that does not identify you.
• To prevent fraud and abuse — protecting downloads and payments. Legal basis: legitimate interest.

We do not sell your personal data, we do not share it with advertisers, and we do not use it for automated decision-making or profiling.

4. Who else processes your data

We use a small number of established providers, each bound by a data-processing agreement and permitted to use your data only to provide their service to us:

• Stripe — card payment processing, fraud checks, VAT calculation and receipts.
• PayPal — payment processing where you choose PayPal at checkout.
• Our email provider — sending transactional emails such as download links and receipts.
• Our newsletter provider — storing subscriber addresses and sending campaigns, if you opted in.
• Our hosting and file-delivery provider — serving this website and your download files.
• Our analytics provider — aggregated, cookie-free usage statistics.

We may also disclose data where we are legally required to, for example to a tax authority or in response to a valid court order.

5. Cookies and browser storage

SiteCrafted does not use advertising or tracking cookies, and there is no consent banner because there is nothing to consent to.

The site does use your browser's local storage to remember what is in your cart between visits, and session storage to carry your order details to the confirmation page. Both stay on your device, are never transmitted to us as personal data, and are cleared when you empty your cart or clear your browser data.

Your payment provider may set its own cookies during checkout for fraud prevention. Those are governed by their privacy policies.

6. How long we keep things

• Order and invoice records — retained for the period required by tax law, typically seven to ten years.
• Download entitlements — kept for as long as we trade, so we can always re-issue your files.
• Support emails — two years after the conversation ends.
• Newsletter subscription — until you unsubscribe, plus a suppression record so we don't email you again by mistake.
• Server logs — 30 days.

7. Your rights

Under the GDPR and equivalent laws you have the right to:

• Ask what personal data we hold about you, and receive a copy;
• Have inaccurate data corrected;
• Have your data erased, where we are not legally required to keep it;
• Restrict or object to our processing, including profiling — although we do none;
• Receive your data in a portable, machine-readable format;
• Withdraw consent at any time, for example by unsubscribing from the newsletter;
• Complain to your national data protection authority.

Email hello@sitecrafted.shop and we will respond within 30 days. We will never charge you for exercising these rights.

8. International transfers

Some of our providers — payment processors and email services in particular — operate outside the European Economic Area. Where data is transferred internationally, it is protected by an adequacy decision or by Standard Contractual Clauses approved by the European Commission, together with appropriate technical safeguards.

9. Security

The site is served over HTTPS. Payment data is handled exclusively by PCI-DSS compliant processors. Download links are time-limited and tied to a single order. Access to customer records is restricted to the people who need it to run the business, and protected by multi-factor authentication.

No system is perfect. If a breach affects your personal data and poses a risk to you, we will notify you and the relevant supervisory authority without undue delay, as required by law.

10. Changes and contact

If we change this policy materially we will update the date at the top of this page and, where the change affects how we use data you have already given us, tell you by email.

Questions, requests or complaints: hello@sitecrafted.shop.