Privacy & Cookies Policy
PRIVACY AND COOKIES POLICY
1. General Information
• The administrator of personal data collected through the Website is InProgress Paulina Brzeźniak, with its registered physical address at: Okrężna 37C/11, 58-100 Świdnica, Poland, VAT ID / Tax Number: PL8842500931 (hereinafter referred to as the "Administrator").
• Contact email: info@staytemplates.com.
• We respect your privacy and process personal data in compliance with the General Data Protection Regulation (GDPR) (EU) 2016/679 and other applicable local data protection laws.
2. Scope and Purpose of Data Processing
We process personal data for the following purposes:
• Order Processing & Billing: To facilitate your purchase, process payment, issue invoices where applicable, and handle tax obligations. Payments are processed through Lemon Squeezy (our Merchant of Record). (Legal basis: Art. 6(1)(b) and (c) GDPR).
• Template Customization: When using our Customizer, we temporarily process and store user-submitted inputs (such as your uploaded logo image, primary color choice, and custom URLs) in our secure database to generate your final HTML template. (Legal basis: Art. 6(1)(b) GDPR).
• Customer Support & Complaints: To respond to your inquiries, technical support requests, and complaints. (Legal basis: Art. 6(1)(f) GDPR – legitimate interest).
3. Data Recipients
Your personal data is transferred only to trusted third-party service providers that enable our store to operate:
• Lemon Squeezy (Merchant of Record) – processes payments, charges VAT/sales tax and remits it to the relevant tax authorities on our behalf, hosts the secure checkout, calculates applicable taxes where enabled, and supports fraud prevention and billing-related processing.
• Lovable Cloud – provides secure database and cloud storage services where customization data and template configurations are processed.
4. Cookies and Local Storage Policy
Our Website uses cookies and Browser Local Storage technologies. These are small text files stored on your device:
• Essential Session Storage / Local Storage: Used solely for technical reasons to remember your active shopping cart items and to power the live visual Customizer. These are mandatory for the website to function correctly and do not track you.
• Cookies Consent Status: We store a small cookie on your browser to remember whether you accepted or declined our cookie banner, so it doesn't pop up on every visit.
• Managing Cookies: You can manage, block, or delete cookies at any time directly through your web browser's settings. Please note that disabling essential cookies/Local Storage may prevent you from using the shopping cart or Customizer.
5. Your Rights (GDPR)
Under the GDPR, you have the following rights regarding your personal data:
• The right to access, rectify, or erase your personal data ("right to be forgotten").
• The right to restrict processing or object to processing.
• The right to data portability.
• The right to lodge a complaint with a data protection authority (e.g., Urząd Ochrony Danych Osobowych – UODO in Poland).
6. Data Retention Period (Data Minimization)
• Buyer email address: We store the buyer's email address in our own database for a maximum of 30 days from the purchase date, solely for the purpose of delivering the download/customizer link and handling any immediate post-purchase support. After 30 days, the email is automatically and permanently anonymized (deleted) from our order records by an automated daily process. The remaining transactional record (amount, currency, payment session ID, date) is retained without any personal identifier.
• Billing and tax data (invoices, VAT records): Stored and processed through Lemon Squeezy (our Merchant of Record) and/or our accounting records for the period required by applicable tax laws (typically 5–10 years). We do not store full card details in our own database.
• Support communications: Kept for the duration necessary to resolve the inquiry and protect against potential claims, then deleted.
• Customizer configurations: Stored only as long as needed to deliver the customized template; may be deleted on request at any time via info@staytemplates.com.
• Custom-request threads and uploaded materials: The request record, messages, and uploaded files are stored for 90 days from the last update to the request thread, then automatically purged. Attachments live in a private storage bucket and are only accessible via short-lived signed URLs generated from the thread page (customer via token, admin via authenticated session). The Buyer may request earlier deletion by email at info@staytemplates.com.
• Newsletter subscribers: If you sign up for our newsletter we store your email address, subscription status (pending/confirmed), interface language, and unique confirmation/unsubscribe tokens. We use a double opt-in flow: we only start sending newsletter emails after you click the confirmation link. Pending (unconfirmed) subscriptions are automatically deleted after 30 days. Confirmed subscriptions are kept until you unsubscribe. Every newsletter email includes a one-click unsubscribe link that permanently deletes your record from our database. (Legal basis: Art. 6(1)(a) GDPR — consent, which you can withdraw at any time.)
• Newsletter link tracking: Links inside our newsletter emails pass through a short redirect on our own domain so we can count aggregate clicks per campaign and measure interest in individual templates. We store only the campaign ID, template ID, destination URL, timestamp, and a truncated one-way hash of the browser User-Agent — no IP address, no email address, no identifier that ties the click back to you personally. This is used purely for editorial statistics (which templates resonate) and is not shared with third parties.
• Two-factor authentication (admins and affiliate partners): To protect administrator accounts and private affiliate management links from unauthorized access, we operate a mandatory two-factor authentication (2FA) layer. For admins this is a time-based one-time password (TOTP) enrolled in an authenticator app; the encrypted TOTP secret is stored by Supabase Auth. For affiliate partners it is a 6-digit one-time code sent to their on-file email; we store a short-lived hash of the code (10-minute expiry) and, if the partner chooses "trust this device for 30 days", a random device token together with the IP address and browser User-Agent captured at verification. These records are used solely to authenticate access, are auto-deleted after expiry, and can be cleared on request at info@staytemplates.com. (Legal basis: Art. 6(1)(f) GDPR — legitimate interest in account security.)
• Withdrawal-waiver and digital-delivery evidence: To evidence the Buyer's consent to immediate performance (Art. 16(m) of Directive 2011/83/EU) and the fact of digital delivery — primarily for defending against payment-provider disputes and chargebacks — we store, attached to each order: (a) the exact wording of the waiver checkbox shown at checkout, the acceptance timestamp and the Buyer's IP address at that moment; (b) a log of each subsequent download of the HTML file, opening of the online Customizer and copy-to-clipboard action of the raw code, together with the timestamp, IP address and browser User-Agent. This evidence is kept for the applicable dispute / chargeback and complaint window (typically up to 24 months from purchase, as required by our payment provider's dispute rules) and then deleted or anonymized. It is disclosed only to the payment provider (Lemon Squeezy) when responding to a dispute or to competent authorities where legally required. (Legal basis: Art. 6(1)(b) GDPR — performance of the contract, and Art. 6(1)(f) GDPR — legitimate interest in defending legal claims and preventing payment fraud.)