Privacy

The data controller is Jakub Ivančo, trading as Darksteady, Poděbradská 264, Poděbrady, Czech Republic — business identification number [TO BE COMPLETED — IČO].

For anything in this policy, write to hello@darksteady.com. A person reads it, and there is no separate data protection officer — the operation is not large enough to require one.

There are only three ways this site learns anything about you, and one of them you have to start yourself.

• Your email address, if you enter it — to send the free asset, the confirmation link, and one newsletter a month. Legal basis: your consent, given by confirming the address from your inbox. Also stored: which form you used, so we can tell what works.
• Your IP address, briefly — to count requests to the signup endpoint and stop it being flooded. Legal basis: legitimate interest in keeping the site working. It is used as a counter and is not stored alongside anything identifying.
• Standard server logs kept by the host — the request, the time, the browser, the IP. Legal basis: legitimate interest in security and diagnosing faults.

That is the complete list. There is no account, no login and no profile.

No advertising or tracking cookies are set, and no third-party advertising or social network scripts run on this site. There is no cookie banner because there is nothing to consent to.

Where visitor statistics are used, they are aggregate and cookieless: page, referrer, country, device type. No cookie, no identifier, nothing that follows you between sites, and no way to single you out from the numbers.

Your basket is kept in your own browser's local storage. It never reaches the server, and it holds only the asset names, the licence tier and the add-on choice — no personal detail and no price.

We never sell, rent or share a mailing list. There is no circumstance in which we would.

Payments are handled by Lemon Squeezy, LLC as merchant of record. Your billing details, card data and address go to them, not to us — we never see or store a card number.

What reaches us from a purchase is the email address to deliver to, what was bought, and the country for tax purposes. We use it to deliver the files, to reissue a download link if you ask, and to keep the record of sale that tax law requires.

Lemon Squeezy, LLC processes that data as its own controller under its privacy policy, linked from the terms page.

An address never joins the list on the strength of a form alone. Submitting a form sends one confirmation email; nothing is added anywhere until the link in it is opened. If you did not enter your address, ignoring that email is enough — nothing is stored and you will hear nothing further.

Every email has a one-click unsubscribe link, and it works immediately. It never expires, so a link in a two-year-old email still works.

Unsubscribing marks the address as opted out rather than deleting it, which is what stops a later import putting you back on a list you have already left. If you want the record erased entirely instead, ask and it will be.

• Email address: until you unsubscribe or ask for erasure. A list that has heard nothing back for two years is pruned.
• Rate-limiting counters: minutes. They expire on their own and are not backed up.
• Server logs: as long as the host keeps them, typically weeks.
• Purchase and invoice records: as long as Czech tax law requires them to be kept, which is longer than any consent-based retention and is not something either of us can waive.

Only the providers needed to run the store, each under a data processing agreement, and each listed here rather than described vaguely.

• Vercel Inc. — Hosting and delivery of this website; server logs including IP address. Processed in the United States, with EU data centres and Standard Contractual Clauses.
• Lemon Squeezy, LLC — Merchant of record: takes payment, issues the invoice, holds billing details and purchase history. Processed in the United States, under Standard Contractual Clauses.
• Resend (Plus Five Five, Inc.) — Sending confirmation and newsletter email, and storing the subscriber list. Processed in the United States, under Standard Contractual Clauses.

Data is transferred outside the EU to the providers above. Those transfers rely on the European Commission's Standard Contractual Clauses, and where applicable on the EU–US Data Privacy Framework.

Beyond that, data is disclosed only where the law requires it.

Under the GDPR you may ask for a copy of what is held about you, ask for it to be corrected, ask for it to be deleted, ask us to restrict what we do with it, object to processing based on legitimate interest, and ask for your data in a portable form. Where processing rests on consent, you may withdraw it at any time — which for the mailing list is exactly what the unsubscribe link does.

Send any of these requests to hello@darksteady.com. They are answered within 30 days, and there is no charge.

If you think the law has been broken, you may complain to the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz) or to the supervisory authority where you live.

This store sells production tools to people making things. It is not directed at children, and we do not knowingly collect data from anyone under 16. If you believe a child has given us an address, tell us and it will be removed.

If this policy changes in a way that affects what happens to data already held, everyone on the mailing list is told by email before it takes effect. Smaller corrections are published here with a new revision date.