Privacy policy
Who is responsible
march second GmbH, Hornau 9, 87600 Kaufbeuren, Germany. Managing director: Fabian Warmdt. Email: hello@designstostitch.com.
Reading the site
Outside the United States, our pages set no analytics cookies and send nothing to analytics until you agree, except the checkout cookie described below, which is set only when you press a buy button. Our hosting provider, Vercel, processes the technical data every web request carries, such as your IP address, browser type and the time of the request, to deliver the pages and keep the site secure. Legal basis: our legitimate interest in a working and secure site, Art. 6(1)(f) GDPR.
Analytics
We use Google Analytics 4 to count visits so we can see which pages help people find what they need. Whether it runs depends on the country you visit from, which our hosting provider Vercel derives from your IP address. We do not store that country.
In the United States, Google Analytics loads when you open a page. You can turn it off at any time: open “Cookie settings” in the footer and choose “Reject”. If your browser sends a Global Privacy Control signal, we treat it as an opt-out and load no analytics. Legal basis: our legitimate interest in understanding how the site is used, Art. 6(1)(f) GDPR; you can object at any time as described.
Everywhere else, and when your country is unknown, Google Analytics loads only if you choose “Accept” on the consent bar. If you choose “Reject”, or choose nothing, no analytics request is made. Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG.
Your choice is kept in this browser under the name designstostitch-com-consent, so the bar does not ask again; you can change it with the “Cookie settings” link in the footer. When analytics is turned off, the site deletes the Google Analytics cookies (_ga and _ga_…).
Buying a product
When you press a buy button, our server sets a cookie whose name starts with fdg_checkout_capability. The cookie is HttpOnly, scoped to the path /api/storefront, and lasts 1 day. It lets this browser reopen its own checkout. It does not provide order status, on-page downloads or a way to refresh download links. It is sent over HTTPS only to our checkout endpoint, and this site's scripts cannot read it. It is strictly necessary for the purchase you asked for (§ 25(2) no. 2 TDDDG) and is processed to perform that contract (Art. 6(1)(b) GDPR).
Payment happens on Stripe Checkout. Stripe collects your email address and payment details. We never see your card details. You need to give an email address and pay to buy; without them we cannot deliver the files.
Our order records hold the product, price, currency, Stripe's checkout and payment references, and the time of purchase. They do not hold your name, postal address or card details.
After payment, we read your email address from Stripe once and send a receipt email with a download link through Resend. If the email does not arrive or a link expires or reaches its download limit, contact us at hello@designstostitch.com. Your email address is held in the order record for this purchase.
Order records and the delivered files are kept with Supabase.
We keep order records as long as German law requires, generally up to 10 years.
Legal basis: performance of the contract, Art. 6(1)(b) GDPR, and our legal duty to keep accounting records, Art. 6(1)(c) GDPR.
Writing to us
Email you send to hello@designstostitch.com is processed by our email provider, Resend. We use it to answer you and keep it as long as needed for that and for any follow-up questions or claims, then delete it unless a statutory retention duty applies. Legal basis: Art. 6(1)(b) or (f) GDPR.
Service providers
Vercel (hosting), Supabase (database and file storage), Stripe (payment), Resend (email) and Google Analytics 4 (analytics; in the United States unless you opt out, elsewhere only after your consent). They process data on our behalf under our instructions; Stripe also processes payment data under its own responsibility for payment, fraud prevention and legal duties.
Transfers outside the EEA
Some of these providers process data outside the European Economic Area, including in the United States. Where they do, the transfer relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework, if the provider is certified, or on EU Standard Contractual Clauses.
Automated decisions
We make no decisions based solely on automated processing that have legal or similarly significant effects on you.
Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection under Articles 15 to 21 GDPR, and to withdraw consent at any time with effect for the future. In particular you may object at any time to processing based on our legitimate interests (Art. 21 GDPR). Write to hello@designstostitch.com. You may also complain to a data protection supervisory authority.