Privacy notice

Who is responsible for your data

The data controller is Carly Docking, trading as The Curious Collective, Unit 135372, PO Box 7169, Poole, United Kingdom. Contact us at hello@thecuriouscollective.net about anything in this notice.

What we collect and why

• Purchase details. Your name, email address, the amount paid, the payment reference, your payment status and a record that you agreed to instant access when you paid. We need these to take your payment, deliver the pack and keep proper records. Lawful basis: performance of our contract with you, and our legal obligation to keep business and tax records.
• Card details. These are entered directly into Stripe's payment form. We never see or store your full card number.
• Delivery emails. We send one transactional email containing your download link and tracker link, plus any replies you send us. Lawful basis: performance of our contract. We do not add you to a marketing list and we do not send marketing emails.
• Analytics and advertising. If you accept cookies, Google Analytics and the Meta pixel record how you use the site, such as pages viewed and whether a purchase was completed, so we can improve the page and measure our ads. Lawful basis: your consent, which you can withdraw at any time using Cookie settings in the footer.
• Security and error logs. Our hosting provider keeps short-term technical logs, which can include IP addresses, to keep the site working and secure. Lawful basis: our legitimate interest in a secure, reliable website.

Who we share data with

Our service providers process data on our behalf:

• Stripe Payments Europe Ltd takes your payment and holds your payment record as a controller in its own right for fraud and compliance.
• Resend sends your delivery email.
• Supabase stores your order record and the product file.
• Lovable hosts and serves this website.
• Google provides Google Analytics, but only if you accept cookies.
• Meta Platforms Ireland Ltd provides the Meta pixel, but only if you accept cookies.

We do not sell your data. We may disclose data if the law requires it.

International transfers

Some of these providers process data outside the United Kingdom, including in the United States. Where that happens, transfers are covered by UK adequacy regulations or by standard contractual clauses with the UK addendum, as set out in each provider's data processing terms.

How long we keep it

Order and payment records are kept for six years to meet tax record-keeping rules. Download links expire shortly after use. Email correspondence is kept for up to two years. Analytics data is retained by Google Analytics for 14 months. Meta pixel data is kept by Meta under its own retention rules.

Your rights

You can ask us for a copy of your data, ask us to correct or delete it, object to or restrict how we use it, ask for it in a portable format, and withdraw consent for analytics at any time using the cookie settings link in the footer. We respond within one month.

Some data must be kept for tax purposes even if you ask for deletion. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Cookies

You can change your choice at any time using Cookie settings in the footer.