Privacy

The data controller is Jakub Ivančo, trading as Darksteady, Poděbradská 264, Poděbrady, Czech Republic — business identification number [TO BE COMPLETED — IČO].

For anything in this policy, write to hello@darksteady.com. A person reads it, and there is no separate data protection officer — the operation is not large enough to require one.

There are only three ways this site learns anything about you, and one of them you have to start yourself.

• Your email address, if you enter it — to send the free asset, the confirmation link, and one newsletter a month. Legal basis: your consent, given by confirming the address from your inbox. Also stored: which form you used, so we can tell what works.
• Your IP address, briefly — to count requests to the signup endpoint and stop it being flooded. Legal basis: legitimate interest in keeping the site working. It is used as a counter and is not stored alongside anything identifying.
• Standard server logs kept by the host — the request, the time, the browser, the IP. Legal basis: legitimate interest in security and diagnosing faults.

That is the complete list. There is no account, no login and no profile.

No advertising or tracking cookies are set. No third-party advertising or social network scripts run on this site, and nothing here follows you to another one.

Where visitor statistics are used, they are aggregate and cookieless: page, referrer, country, device type. No cookie, no identifier, and no way to single you out from the numbers.

This site does store a few things in your own browser — your basket, and whether you have already dismissed a banner or seen the opening animation. They stay on your device, none of them identifies you, and the basket never reaches the server. Every single one is listed on the browser storage page, with what it is for and how long it lasts. That is why there is no consent banner in front of you: not because storage is invisible, but because none of it is used to track you.

We never sell, rent or share a mailing list. There is no circumstance in which we would.

Payments are handled by Sold through Link, LLC (formerly Lemon Squeezy, LLC), trading as Lemon Squeezy as merchant of record. Your billing details, card data and address go to them, not to us — we never see or store a card number.

What reaches us from a purchase is the email address to deliver to, what was bought, and the country for tax purposes. We use it to deliver the files, to reissue a download link if you ask, and to keep the record of sale that tax law requires.

Sold through Link, LLC (formerly Lemon Squeezy, LLC), trading as Lemon Squeezy processes that data as its own controller under its privacy policy, linked from the terms page.

An address never joins the list on the strength of a form alone. Submitting a form sends one confirmation email; nothing is added anywhere until the link in it is opened. If you did not enter your address, ignoring that email is enough — nothing is stored and you will hear nothing further.

Every email has a one-click unsubscribe link, and it works immediately. It never expires, so a link in a two-year-old email still works.

Unsubscribing marks the address as opted out rather than deleting it, which is what stops a later import putting you back on a list you have already left. If you want the record erased entirely instead, ask and it will be.

• Email address on the mailing list: Until you unsubscribe or ask for erasure. An unsubscribed address stays on the suppression list so it is never mailed again. Consent — it lasts exactly as long as you let it.
• Rate-limiting counters keyed to an IP address: Minutes. They expire on their own and are never backed up. Legitimate interest in keeping the signup and checkout endpoints working.
• Server and delivery logs: As long as the host retains them — typically weeks. Legitimate interest in security and diagnosing faults.
• Purchase records, receipts and accounting documents: For as long as the tax authority may still assess the tax — three years as a rule, extended up to a maximum of ten in the cases the Tax Code lists. A legal obligation, and not something either of us can waive or shorten.

The tax retention is the one nobody can shorten. A request to erase everything still leaves the accounting record of a sale in place, because keeping it is a legal obligation rather than a choice — and the law that imposes it overrides consent.

Only the providers needed to run the store, each named here rather than described vaguely. All of them act under a data processing agreement, except the merchant of record, which handles the payment as a controller in its own right under its own privacy policy.

• Vercel Inc. — Hosting and delivery of this website; server logs including IP address. Processed in the United States, with EU data centres and Standard Contractual Clauses.
• Sold through Link, LLC (formerly Lemon Squeezy, LLC), trading as Lemon Squeezy — Merchant of record: takes payment, issues the invoice, holds billing details and purchase history. Processed in the United States, under Standard Contractual Clauses.

Those providers are outside the EU, so the transfers rely on the European Commission's Standard Contractual Clauses. Where a provider is additionally certified under the EU–US Data Privacy Framework, that framework applies too — but the clauses are what the transfer rests on, and they hold whether or not any given company is on that list.

Beyond that, data is disclosed only where the law requires it.

Under the GDPR you may ask for a copy of what is held about you, ask for it to be corrected, ask for it to be deleted, ask us to restrict what we do with it, object to processing based on legitimate interest, and ask for your data in a portable form. Where processing rests on consent, you may withdraw it at any time — which for the mailing list is exactly what the unsubscribe link does.

Send any of these requests to hello@darksteady.com. They are answered within 30 days, and there is no charge.

If you think the law has been broken, you may complain to the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz) or to the supervisory authority where you live.

This store sells production tools to people making things. It is not directed at children.

Czech law sets the age at which someone can consent on their own to an online service at 15 — Act No. 110/2019 Coll. uses the option Article 8 of the GDPR gives member states to lower it from 16. We do not knowingly collect data from anyone under 15 without the consent of whoever holds parental responsibility. If you believe a child has given us an address, tell us and it will be removed.

If this policy changes in a way that affects what happens to data already held, everyone on the mailing list is told by email before it takes effect. Smaller corrections are published here with a new revision date.