This policy explains what personal data Choocode Studio collects when you use choocodestudio.com, why, who receives it and what rights you have. We keep it short and we collect as little as we can.
1. Who is responsible
The controller of your data is [to be completed before launch] (tax ID [to be completed before launch]), [to be completed before launch]. Contact for anything about your data: [to be completed before launch].
2. What we collect
Only what the features below need:
- Email address and, if you give it, your first name: when you ask for access to a guide, join an early-access list or buy.
- Purchase data: the guide you bought, the amount, the date, the payment reference from Stripe, and the time you accepted the terms and the withdrawal waiver.
- Account data if you sign in with Google: your Google account identifier, your verified email address and your name. We never see your Google password.
- Technical data: your IP address and request details in the logs of our hosting provider, kept for security. We also count visits per page and traffic source as totals, with no personal identifier.
- Two small cookies, explained in the cookie policy: your language choice and, if you sign in, your session.
3. Why we use it and on what legal basis
- To deliver what you bought, take payment and let you sign in (performance of a contract).
- To keep invoices and tax records (legal obligation).
- To email you when a guide you asked about is ready, and to send news if you ticked that box (your consent, which you can withdraw at any time with the link in every email).
- To keep the site secure, prevent fraud and count visits in aggregate (our legitimate interest).
4. Who receives your data
We use a few providers to run the service. They process data on our instructions, except Stripe and Google, which are also independent controllers for their own purposes:
- Cloudflare, Inc.: hosting, database and file storage. Our database is in the EU region.
- Stripe Payments Europe, Ltd.: card payments. We never see or store your card number.
- Resend: sending the delivery and notification emails.
- Google: only if you choose to sign in with Google.
5. Transfers outside the EU
Some providers are based in the United States. Where that happens the transfer relies on the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework, as each provider publishes.
6. How long we keep it
- Mailing and early-access entries: until you unsubscribe or ask us to delete them.
- Purchase records: up to six years, because commercial and tax law require it.
- Sign-in sessions: 30 days. Your account: until you delete it.
- Server logs: as long as our hosting provider keeps them, normally a few weeks.
7. Your rights
You can ask for access, correction, deletion, restriction, portability or object to processing, and withdraw consent whenever you like, by writing to [to be completed before launch]. If you have an account you can download your data and delete your account yourself on the account page. You also have the right to complain to the Spanish data protection authority (Agencia Española de Protección de Datos, www.aepd.es) or to the authority in your country.
8. Children
Our guides are for adults and young people who can act on their own. The service is not directed to children under 14 and we do not knowingly collect their data.
9. Changes
If we change this policy in a way that matters we will update the date above and, for registered users, tell you by email.