Privacy Policy

The short version

Rosay's Creations ("we", "us", "our") operates this store from the United States and is the data controller for the personal data described here. This policy covers rosayscreations.com and the emails we send. We are reachable by email rather than by post: support@rosayscreations.com is the route for anything in this policy, including a request to see or delete your data, and if anything here is unclear you can write to the same address and ask.

What we collect

When you buy something

Checkout is hosted by Stripe. You enter your card details on Stripe's own page, not ours — we never see, receive, or store a card number. Stripe tells us the result of the payment, and we store that record so we can deliver your product and support the order:

• Your email address, as given to Stripe at checkout
• Stripe's identifiers for the checkout session, payment, and customer
• Which product you bought, its price, and the currency
• Payment and delivery status, how many times the download was used, and when
• Timestamps for the order, the payment, and the receipt email

When you join the newsletter

We store your email address, whether you have confirmed it, a one-way hash of your confirmation link (never the link itself), an unsubscribe token, and the page you signed up from. Signup is double opt-in: nothing is added to our mailing list until you open the confirmation link we email you.

When you contact support

The support form collects your name, email address, the topic you picked, an order ID if you give one, and your message. Submissions are stored by our hosting provider and emailed to us so we can reply.

When you leave a checkout unfinished

If you start a checkout and do not complete it, we keep the session identifier, the product, and — where Stripe captured it — your email address, so we can send you a reminder with a link back to your basket. Details of that are in marketing emails below.

Automatically, when you visit

Our host records standard server and request logs (IP address, browser user-agent, pages requested, timestamps) to serve the site and protect it from abuse. If you accept analytics and advertising cookies, the services in the next section also receive information about your visit.

Cookies, analytics and advertising

The store needs no cookies to function, and it sets none for tracking until you say yes. When you first arrive you are asked whether to allow analytics and advertising cookies:

• If you decline, no analytics or advertising cookie is written and no identifier is shared with Google or Meta. Your choice is remembered in your browser's local storage so you are not asked again.
• If you accept, we use Google Analytics and Google Ads to measure which pages and campaigns lead to a sale, and the Meta pixel for the same purpose on Facebook and Instagram advertising. These services set their own cookies and receive your IP address, the pages you view, and the value and currency of a purchase you complete. They do not receive your name, and we do not upload our customer or subscriber lists to them.

Advertising measurement runs in Google's consent mode, which means the tags load with storage switched off and only begin using cookies once you have accepted. You can change your mind at any time: review your cookie choices discards the answer stored in your browser, returns the tags to their switched-off state, and brings the question back — so withdrawing consent takes exactly as much effort as giving it did.

These tags are only active when the store has them configured. On a deploy with no measurement IDs set, no third-party script is loaded, no cookie is set, and no banner is shown.

Who else handles your data

We use a small number of processors to run the store. Each one only receives what it needs for its job, and each has its own privacy policy governing the data it holds.

We do not sell, rent, or trade your personal data, and we do not share it with anyone for their own marketing.

Every processor above is a US company, so using the store involves your data being transferred to the United States and to the other countries those providers operate from. Where the data comes from the UK or the EEA, that transfer rests on the safeguards in each provider's own terms — the Standard Contractual Clauses, the UK Addendum to them, or the EU–US and UK–US Data Privacy Framework. Each provider's privacy notice states which of these it relies on.

The emails we send

Some are part of buying; some are marketing. The difference matters, so here is the list.

Because you bought or asked

• A receipt for your order, with a link back to your download page
• A confirmation link when you sign up for the newsletter
• A reply when you write to support

Marketing, which you can stop at any time

• Abandoned checkout reminders. Up to two emails if you start a checkout with your email captured and do not finish it.
• A welcome sequence. Five emails over the days after you confirm your newsletter subscription.
• A product recommendation. One email about three days after a purchase, suggesting a related product.
• Occasional newsletters about new products.

Every marketing email carries an unsubscribe link, and using it stops all of them. You can also email support@rosayscreations.com and ask. Receipts and support replies are not marketing and will still be sent when you buy something or contact us.

How long we keep it

• Order records are kept for as long as we may need them for accounting, tax and refund obligations, and so we can reissue a download you have paid for.
• Newsletter records are kept until you unsubscribe or ask for deletion. An unconfirmed signup expires after 48 hours and stops being usable.
• Support messages are kept while we deal with your request and for a reasonable period afterwards in case you write back about the same thing.
• Abandoned checkout records are kept only long enough to send the reminders described above.

Your rights

You can ask us to:

• Tell you what we hold about you, and give you a copy
• Correct anything that is wrong
• Delete your data, subject to records we must keep for tax and accounting
• Stop using your data for marketing

Email support@rosayscreations.com from the address you want us to act on, or use the support form on the storefront. We will respond within 30 days.

If you are in the UK, EU, or a US state with its own privacy statute, you may also have the right to complain to your local data protection authority. Depending on where you live, our basis for holding your data is either your consent (the newsletter, and analytics and advertising cookies), performing our contract with you (your order and its delivery), or our legitimate interest in running and securing the store.

Children

This store is not intended for children under 16 and we do not knowingly collect their data. If you believe a child has given us information, write to us and we will remove it.

Changes to this policy

If we change how we handle your data, we will update this page and move the date at the top. Material changes to marketing or tracking will be reflected here before they take effect.

Contact

Rosay's Creations is the data controller for everything described in this policy and operates from the United States. For any of it — including a request to see, correct, or delete your data, or to stop marketing — email support@rosayscreations.com. That address is the contact route we operate, it is monitored, and we answer every message; requests about your data are answered within 30 days.