1. Who is responsible
[REGISTERED COMPANY NAME], trading as 24Design, of [REGISTERED ADDRESS], is the controller of the personal data described here. Write to hello@gazar.dev about anything on this page.
2. What we collect, and why
Your account. The email address you sign up or buy with, your name if you give one, and your password stored only as a hash. We need it to give you access to what you bought. Lawful basis: performance of our contract with you.
Your orders. What you bought, when, the amount, the tax and the jurisdiction it was charged in, and whether you have downloaded each item. We need it to deliver the design, to handle refunds, and to meet our tax record-keeping obligations. Lawful basis: contract, and legal obligation for the tax record.
Your work. The designs you own, the variations you save, and your practice if you belong to one. Lawful basis: contract.
Downloads. When a production file was released, and under which entitlement. We keep this to enforce the licence and to detect a file being harvested. Lawful basis: our legitimate interest in protecting the designs we license.
Counting visitors. How many people reach each step of buying something. This reuses the anonymous basket cookie the site already needs; no new identifier is created, and the records hold nothing that identifies a person. Lawful basis: our legitimate interest in knowing where the shop fails.
3. What we do not collect
No card numbers: payment is handled entirely by Stripe and card details never reach us. No analytics or advertising scripts. No IP addresses, device fingerprints, screen sizes or referrers for tracking purposes. No profile of an individual’s browsing, and no means for anybody here to look up what one person did. No data bought from or sold to anybody.
4. Cookies
Two, both strictly necessary, which is why this site has never asked you to accept cookies. One identifies your basket so it survives a reload. One identifies your session once you sign in. Neither is used for advertising and neither is shared.
5. Who else sees it
- Stripe, to take payment and calculate tax. They receive your email and billing address and act as their own controller for payments.
- Cloudflare R2, which stores the design files and images. It holds no personal data of yours.
- Resend, which sends receipts and password links. It receives your email address.
Each is a processor acting on our instructions, except Stripe for payment processing. Some are outside the UK and EEA; transfers rely on the safeguards in those providers’ data processing terms.
6. How long we keep it
Your account and the designs you own: for as long as you have an account. Order and tax records: six years, which is the period we are required to keep them. Client approvals recorded in the jeweller workspace: six years, because they are evidence of an agreement that was made. Visitor counts: they hold no personal data and are kept indefinitely as aggregate figures.
7. Your rights
You can ask us for a copy of your data, to correct it, to erase it, to restrict or object to how we use it, or to have it sent to another provider. Write to hello@gazar.dev from the address on your account and we will respond within one month.
One limit worth stating plainly: where a client has formally approved a piece, that approval is contract evidence and is retained even after an erasure request. Everything not in that category is erased.
8. Complaints
If we have not put something right, you can complain to the Information Commissioner’s Office (ico.org.uk). We would rather you told us first.