Last updated: November 7, 2026
Stitch Jam Studio ("we", "us") is a small independent business selling digital cross-stitch and embroidery patterns. We are the data controller for the personal data described below.
Contact: jamstitch.studio@gmail.com
We do not collect payment card details. Payments are handled entirely by Etsy, the marketplace we sell through.
Clicks to Etsy and other websites. Only after you allow analytics, we create a random identifier in your browser tab's session storage. Our private click record includes a keyed hash of that identifier, the time, public page path, the destination website's domain, Etsy listing ID when available, referring website domain, approximate country, broad device, browser and operating-system categories, a mark that tells our own studio computers apart from visitors, and consent version. It does not include your name, Etsy account, full referrer URL, URL query strings, raw IP address or full browser identification string. The country is inferred from the connection and may be inaccurate. A keyed hash of your address, deleted within 24 hours, is used separately to prevent abuse of the collection endpoint.
We ignore repeated clicks to the same Etsy listing within three minutes of a counted click in the same measured session. This cannot recognize a person across different browsers, devices or fresh tabs. A click does not tell us whether you made a purchase. We honor Global Privacy Control and Do Not Track by disabling optional analytics. Click records are stored privately in Supabase for up to 24 months and removed by a scheduled retention job. Historical records collected before this update used a pseudonym derived from the connection address, stored beside coarse device categories; new records use the random session identifier instead.
We use trusted third-party services that process data on our behalf, each under their own policy: Resend (holds our mailing list and sends the newsletter and the confirmation email), Supabase (stores the record of your consent and the delivery events for the emails we send you, hosted in the EU), Cloudflare (hosts this site, and its Turnstile anti-spam check runs on the sign-up form), Etsy (sales and delivery), and social platforms if you interact with our content there. We never sell your personal data.
How the newsletter is split between those two. Resend is the mailing list: it holds the addresses we actually send to, and it is where your unsubscribe takes effect. Supabase is the record-keeping side: it stores the date you subscribed and the exact wording you agreed to, so we can show that you really did ask for these emails, along with delivery events (whether a message was delivered or bounced). Your address is added to the mailing list in Resend only once you click the confirmation link. Until then it sits in the record as an unconfirmed request and is never sent anything but that one confirmation email.
Turnstile checks connection and browser signals to protect forms from automated abuse. It is not an advertising tag. We separately keep a keyed hash of your address for form rate limits. That hash is deleted within 24 hours, and our application never stores your raw IP address in these records. Hosting providers may process addresses in their own security and operational logs under their policies.
When you buy on Etsy, Etsy is an independent controller of your purchase data under the Etsy Privacy Policy; we only receive the limited order details needed to deliver files and provide support.
We currently use essential preferences and optional analytics:
sjs_theme remembers your choice of light, dark or system theme for up to one year; it holds only that choice and is not used for analytics or advertising. Security and delivery features may use storage needed for the service you request.Optional analytics load only after you choose "Allow analytics". The session identifier normally expires when the tab is closed; browsers may restore it with a restored session. You can change your privacy choice at any time. Choosing "Only essential" stops future optional measurement and clears the analytics session identifier. Withdrawal does not affect processing already carried out. You can also clear browser storage.
When you contact us through the custom-design form, we process your name, email address, message, optional images and sample preference to reply and discuss your request. Legal basis: your consent, given by ticking the box on the form; the form records the wording and version of the notice you agreed to. We use the email address from this form only to answer your request. It is not added to our newsletter and is not used for marketing. Please do not send sensitive personal information or images you do not have permission to share.
Cloudflare Turnstile checks for automated submissions. Supabase stores a private request record and delivery status, and Resend delivers your message and image attachments to our studio mailbox hosted by Google. Large images are prepared as smaller copies in your browser before sending. Uploaded images are not published on the website or saved in its public image library. Our private Telegram management alerts contain only a request reference, request type and attachment count; your name, email, message and images are not included in those alerts.
We keep the correspondence only as needed to handle your request and any resulting design or support, subject to applicable record-keeping requirements. You can ask us to delete the correspondence or withdraw your permission by emailing jamstitch.studio@gmail.com. Withdrawing permission does not affect processing already carried out.
If you ask us to erase your data entirely rather than just unsubscribe, we will delete the consent record too, and keep only what the law requires us to keep.
Depending on the law that applies, you may have rights to access, correct, delete or receive a portable copy of your personal data, restrict processing, object to processing based on legitimate interests, and withdraw consent. To make a request, email jamstitch.studio@gmail.com. We may need proportionate information to verify a request. We respond within the period required by applicable law, normally one month for GDPR requests, and explain any permitted extension. Some records may need to be retained to meet legal obligations or handle legal claims.
If you are in the EU or UK, you also have the right to lodge a complaint with your local data protection authority (in the UK, the ICO; in the EU, your national supervisory authority).
United States residents. Where an applicable state privacy law grants you rights, these may include access, correction, deletion, portability, appeal of a decision on your request, and opting out of sale, targeted advertising or certain profiling. Our current website does not sell personal information or use advertising tags for cross-context behavioral advertising. We do not make decisions with legal or similarly significant effects solely through automated processing. We do not discriminate against you for exercising applicable privacy rights. Contact us at the email above to make a request or appeal a response.
Our products and communications are intended for adults. We do not knowingly collect data from children.
Because our providers operate globally, your data may be processed outside your country (including in the United States). Where required, our providers rely on recognized safeguards for such transfers, such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.
We may update this policy. The "Last updated" date shows the latest version.
Questions about this policy or your data? Email jamstitch.studio@gmail.com.