Privacy Policy

Who I am (link to this section)

Odinaddi is one person's studio and shop, not a company with a data department.

Odinaddi is run by Susanna, in Scotland, in the United Kingdom. For the purposes of UK data protection law, I'm the data controller for the personal data described here - meaning I decide what's collected and why, and I'm responsible for looking after it.

You can reach me any time at hello@odinaddi.com or through the contact page. I read every message myself.

What I collect (link to this section)

Grouped by what you were doing when you gave it to me.

When you buy something

Your order: What you bought, when, what you paid, and the email address you gave at checkout. That email is where your receipt and download links go.
Your delivery address: Only for something that has to be posted, like an original painting. You give it to Stripe at checkout, and I look it up there to send your parcel. It isn't copied into the site's own records.
Family details for a family tree: If you book a family tree, you fill in the names, dates and relationships it should show. That's about your family as well as you, so please only include what you're happy for me to stitch, and what the people in it would be happy to share. I use them only to make your tree.
Your payment: Payment is handled by Stripe - I never see or store your card number. I keep only the record of the transaction and the reference Stripe gives it.
Your download access: So you can download what you bought without an account, the site keeps a random access code linked to your email address. It's saved in a cookie on the device you bought on, and it's in the download links in your receipt, so opening one on another device works too.
Emails about your order: When I post something to you, I email to say it's on its way, with tracking if there is any. The site notes whether your files have been downloaded, and if none of them have after a couple of days, I email your links once more in case the first email went missing. Once your order has had time to arrive (a few days for a download, about a week after posting), I email you once to ask what you thought. That email has a link to stop review requests altogether, and I keep a note of your email address if you use it, so I don't ask again.

When you get in touch

Messages: What you send through the contact form - your name, email address, subject and message - and anything you write to me by email.
The newsletter: The email address you sign up with.
Reviews: If you review something you bought, the stars, any words and the name you choose. They go on the product page once I've read them, marked as from a verified buyer. Your email address is never shown.
Comments on the blog: The name you give, which is shown with your comment, and your email address, which is never shown. I use the address to send you a link to confirm the comment is yours, to tell you about replies if you tick the box, and to recognise you next time so your comments can go up without waiting.

Things collected automatically

Technical logs: My hosting provider keeps short-term server logs, which can include IP addresses, for security and to diagnose faults. I don't use them to build a profile of you.
Spam protection: To stop the contact, comment and newsletter forms being flooded, the site counts how many times each IP address (and, for comments, each email address) has sent one recently. The count deletes itself within the hour.

Things I don't collect

I don't run advertising trackers or third-party analytics that follow you around the web, and I don't buy data about you from anyone. I don't ask for your date of birth or phone number, and I only need an address when something has to be posted to you.

Why I use it (link to this section)

Under UK GDPR I need a lawful basis for each use. Here they are, in plain terms.

What I do	Why	Lawful basis
Take payment and give you what you bought	To sell you a pattern or a piece and deliver it	Performance of a contract
Make the family tree you booked	To stitch the names and dates you sent	Performance of a contract
Send your receipt and download links	So you can get what you paid for	Performance of a contract
Email you when your parcel is posted	So you know it's coming	Performance of a contract
Note whether your files were downloaded, and resend the links once if not	So you get what you paid for, even if the first email went missing	Performance of a contract
Ask you once for a review of what you bought	To hear how it went, and help other buyers choose	Legitimate interests - one email per order, with a link to stop them
Show your review on the shop	You asked me to publish it	Legitimate interests
Keep order and tax records	I'm legally required to	Legal obligation
Reply to your messages	You asked me something	Legitimate interests
Show your comment on the blog, and check it is yours	You asked me to publish it	Legitimate interests
Email you about replies to your comment	You ticked the box	Consent - every email has a link to stop them
Keep the site secure and stop spam	Preventing abuse, fixing faults, stopping fraud	Legitimate interests
Send the newsletter	You asked to hear from me	Consent

You can leave the newsletter at any time by telling me, and every newsletter I send will include a way to unsubscribe. Withdrawing consent doesn't affect anything I did before you withdrew it. A receipt isn't marketing, so it doesn't carry an unsubscribe link: it's the record of something you bought.

I don't use your personal data to make automated decisions that have a legal or similarly significant effect on you.

A short list of suppliers who help run the shop, and nobody else.

I don't sell your personal data, and I don't share it with advertisers. I do use a small number of service providers, who handle data on my instructions:

Stripe: Takes payment. You enter your card details, and any delivery address, directly with Stripe. They tell the site the payment went through, with your email address and a reference, and keep the rest with the payment record. Stripe's privacy policy.
Supabase: Stores my order records, download access codes, family tree details, reviews, contact form messages, blog comments and newsletter sign-ups. Supabase's privacy policy.
Cloudflare: Serves the site, protects it from attacks, and holds the spam counters, download access codes made before November 2026, and the weekly backup of my records, encrypted so that only I can open it. Keeps short-term logs. Cloudflare's privacy policy.
Resend: Delivers the emails the site sends, such as your receipt, and passes contact form messages on to me. To do that it receives your email address and the email itself. It also sends the newsletter, so it keeps the list of subscribers' email addresses and a note of anyone who has unsubscribed. Resend's privacy policy.
Sanity: Holds the shop's own content - product pages, photos, blog posts - and the pattern files you download. It doesn't hold your personal data. Sanity's privacy policy.
GitHub: Runs the weekly backup of my records. The copy is made and encrypted on GitHub's computer, which is wiped straight afterwards; GitHub doesn't keep it. GitHub's privacy statement.

For a posted order, your name and address go on the parcel, and so to Royal Mail or whichever courier carries it.

That's the whole list. The site's typefaces are served from odinaddi.com itself, so reading a page here doesn't send your browser to anyone else for a font.

Some of these providers operate outside the UK. Where personal data is transferred overseas, it's protected by the safeguards UK data protection law requires, such as the International Data Transfer Agreement or an adequacy decision.

I'd also share data if I were legally required to - a court order, for example - or where it's genuinely necessary to protect someone's safety. I'd tell you unless I were legally prevented from doing so.

Cookies & your device (link to this section)

Only the ones that make the shop work. No advertising cookies, no consent banner needed.

Odinaddi sets only strictly necessary cookies: the one that lets you download what you bought, and the ones checkout needs. Because they're essential to something you've asked for, they don't need a consent banner - which is why you haven't seen one.

Your basket is remembered in your own browser, so it's still there if you come back. It isn't sent anywhere until you check out, and clearing your browser's site data removes it.

I don't set advertising, profiling or cross-site tracking cookies. If that ever changes, I'll ask you first - properly, with a real choice.

How long I keep it (link to this section)

Only as long as there's a reason to.

Order and payment records: six years after the purchase, because UK tax law requires it.
Your download access: for as long as the order record, so your download links keep working. The cookie on your device expires after about a year; your receipt's links still work after that.
Family tree details: deleted six months after your tree is posted, in case anything needs correcting. What you chose and paid stays with the order record.
Delivery addresses: held by Stripe with the payment, for as long as Stripe keeps payment records.
Contact form and email correspondence: up to two years, so I can follow up on an ongoing question.
Blog comments: for as long as the comment is on the site, or until you ask me to remove it. A comment whose confirmation link was never clicked is deleted after 14 days.
Reviews: for as long as the product's page is on the site, or until you ask me to remove yours.
Asking not to be sent review requests: kept for as long as I sell things, because forgetting it would mean asking you again.
Newsletter sign-ups: until you unsubscribe.
Backups: an encrypted copy of my records is made each week. Each copy is deleted after about two months, and none is kept longer than four.
Server logs: a short period set by my hosting provider, typically days rather than months.

Your rights (link to this section)

You have these rights under UK GDPR, and I'd rather you used them than didn't.

Access: Get a copy of the personal data I hold about you.
Rectification: Correct anything that's wrong, such as the email address on an order.
Erasure: Ask me to delete your data. I'll delete everything except the order records the law requires me to keep.
Restriction: Ask me to pause using your data while a dispute or correction is sorted out.
Portability: Have your data in a machine-readable format to take elsewhere.
Objection: Object to anything I do on the basis of legitimate interests.
Withdraw consent: Leave the newsletter at any time.

To use any of these, email hello@odinaddi.com or use the contact page. I'll respond within one month, and there's no charge. I may ask you to confirm your identity first, so that I'm not handing your data to someone else.

If you're unhappy with how I've handled your data, please tell me first so I can put it right. You also have the right to complain to the UK's Information Commissioner's Office at ico.org.uk.