Privacy Policy for Cedilla Studio

Cedilla Studio is a small, independent type and design studio in the United Kingdom, run by Ashley Lane. Ashley Lane, trading as Cedilla Studio, is responsible for (the “controller” of) the personal data described in this policy.

Postal address: email hello@cedilla.studio for our postal address
Email: hello@cedilla.studio

We may collect the following types of personal information:
• Orders and free downloads: your email address, what you bought or downloaded, the price, and whether you’d like emails about new releases and offers. Payments are handled by Stripe, which collects your card and billing details; we never see your card number.
• Your account, if you create one: your email address, your name if you add it, your password (stored only in scrambled, hashed form) and anything you save in our tools, such as Off Grid and BLEEDR recipes.
• Security and download records: the IP address and browser details used to sign in, and the date, file and IP address of each download.
• Messages: anything you send us by email.
• Usage Data: our web server keeps standard logs of each request (IP address, page requested, browser type, date and time).
• Cookies and Similar Technologies: We use cookies to run the Site, to keep our own anonymous visit statistics and, only if you agree, for Google Analytics and the Pinterest tag. Details are below.

What are Cookies?
Cookies are small text files a website stores in your browser. Some are needed for the Site to work; others help us understand how it’s used.

Cookies We Use:
• Essential (always on): keep you signed in to your account, protect our forms, and let Stripe process payments. Your basket is stored in your browser so it survives a page reload.
• Our own visit statistics (on unless you switch them off): described in the next paragraph.
• Google Analytics (only if you say yes): see Section 3.
• Pinterest tag (only if you say yes): see Section 3.
• Your choice: the cs_consent cookie remembers your answer for six months, so we don’t ask on every page.

Our Own Visit Statistics:
To see which pages and posts lead people to our shop, we keep simple statistics on our own server. Two first-party cookies hold random codes: cs_vid identifies your browser for up to a year, and cs_sid groups one visit and expires after 30 minutes of inactivity. With them we record the pages you view, which site or link brought you here, and shop steps such as choosing a license, adding to your cart, starting checkout and completing a purchase or free download. We don't store your name, email address or IP address with these statistics, we don't share them with anyone, and we delete them after about 13 months. We also keep an anonymous record of clicks, mouse movement and scrolling (the cs_hm_off cookie remembers if you've turned this off). If your browser sends a Global Privacy Control signal, none of this is recorded. You can turn it off for this browser at any time in Section 7.

Cookie Consent and Management:
On your first visit, a banner asks whether Google Analytics and the Pinterest tag can run. Both stay off until you say yes, and rejecting is as easy as accepting. You can change or withdraw your choice at any time with the “Cookie settings” link at the bottom of every page. If your browser sends a Global Privacy Control signal, we treat it as a no and don’t show the banner. You can also block or delete cookies in your browser settings.

Data protection law lets us use personal data only when we have a legal reason (a “lawful basis”). Here is each use, the reason, and how long we keep the data.

• Selling and delivering your order, and free downloads. Reason: to perform our contract with you (and, for paid orders, to meet our legal obligations on tax and accounting records). Kept for 6 years after the order, because tax rules and the time limit for legal claims mean we may need it for that long. This record is also how you can download your files again and prove your licence.
• Your account. Reason: to provide the account you asked for (contract). Kept until you delete it, which you can do at any time in your account settings. Your account, sign-ins and saved recipes are then deleted straight away; your orders stay, no longer linked to an account, for the 6 years above.
• Keeping accounts and downloads secure. Reason: our legitimate interest in protecting your account and stopping download links being shared or abused. Sign-in records are deleted when the sign-in ends (after 30 days at most), records of failed sign-in attempts after 24 hours, and IP addresses in download records after 12 months.
• Emails about your order. A reminder if you haven’t downloaded your files, and one request for an honest review a few days after you download them. Reason: our legitimate interest in making sure you get what you paid for and in hearing how we did. You can ask us to stop at any time.
• New releases and offers. Only if you ticked “Email me new releases and offers” when buying or downloading. Reason: your consent. Unsubscribe at any time with the link in any of these emails. We keep your email for this until you unsubscribe, and a note of your choice so we respect it.
• Our own visit statistics. Reason: our legitimate interest in improving the Site, under the statistics exception in UK cookie law (details in Section 1). Kept for about 13 months.
• Google Analytics and the Pinterest tag. Reason: your consent. See Section 3.
• Web server logs. Reason: our legitimate interest in keeping the Site secure and working. Kept for 14 days.
• Replying to your messages. Reason: our legitimate interest in answering you (or, if it’s about an order, our contract with you). Kept only for as long as we need it to deal with your message.

We only load these two services if you say yes in the cookie banner, and our legal basis for them is your consent. You can withdraw it at any time in Cookie settings; after that they stop loading and we delete their cookies from your browser.

Google Analytics: a service from Google that shows us how people find and use the Site: the pages you view and for how long, the site or search that brought you here, your device and browser type, and your approximate region. It sets cookies whose names start with _ga. Google Analytics doesn’t store IP addresses. You can read how Google handles this data at business.safety.google/privacy.

Pinterest tag: a service from Pinterest that tells Pinterest when you view a page, add something to your basket, request a free download, or complete a purchase (with the order value and the products bought). We use it to see which pins bring visitors and sales, and to help any Pinterest ads we run reach people likely to be interested. Pinterest may connect this to your Pinterest account if you’re signed in to Pinterest. It sets cookies such as _pin_unauth and _epik. See Pinterest’s privacy policy.

Google and Pinterest may process this data outside the UK, under the safeguards described in their own privacy policies. We don’t show third-party advertising on the Site.

We do not sell, trade, or rent your personal information to third parties. We share it only with service providers who help us run the Site and fulfil your orders: Stripe (payments), Postmark (order and account emails) and Hostinger (hosting). They may only use it to provide their service to us. If you agree to them, Google Analytics and the Pinterest tag receive the information described in Section 3.

We take reasonable measures to protect your personal information, but no method of transmission over the internet is completely secure. We cannot guarantee the security of your data. We encourage you to take steps to protect your personal information, such as choosing strong passwords and ensuring the security of your devices.

Under the UK General Data Protection Regulation and, if you are in the European Union (EU) or the European Economic Area (EEA), the EU GDPR, you have the following rights concerning your personal data:
• Right to Access: You have the right to request a copy of the personal data we hold about you.
• Right to Rectification: You have the right to request the correction of any inaccuracies in your personal data.
• Right to Erasure: You have the right to request the deletion of your personal data, subject to certain conditions.
• Right to Restrict Processing: You have the right to request that we limit the processing of your personal data under certain conditions.
• Right to Data Portability: You have the right to request the transfer of your personal data to another service provider.
• Right to Object: You have the right to object to our processing of your personal data for direct marketing purposes.
• Right to Withdraw Consent: Where we rely on your consent (Google Analytics and the Pinterest tag), you can withdraw it at any time in Cookie settings.

If you wish to exercise any of these rights, please contact us at hello@cedilla.studio. If you’re unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk.

You can choose not to provide certain personal information, but this may limit your ability to use certain features of our Site. You can also control cookies through your browser settings.

Google Analytics and the Pinterest tag: Open cookie settings to see or change your choice.

Turn off our visit statistics: Our visit statistics are on for this browser. Turn them off

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will post the updated policy on our Site with the date of the last revision.

If you have any questions or concerns about this Privacy Policy, or if you wish to exercise any of your GDPR rights, please contact us at hello@cedilla.studio.