Privacy
Privacy notice — draft for legal review
TODO — not ready to ship
The live site marks this page as a draft for legal review. The text below is kept as a structural starting point only. Do not treat it as finished terms, a privacy notice, or consumer-law wording. Business identity, VAT, address, contact details and cancellation rights still need to be supplied by the client — they have not been invented here.
This starter site does not itself store card details. Checkout is handled by Stripe. The protected access endpoint retrieves the Checkout Session from Stripe solely to verify purchase and may read the purchaser's checkout email for display.
After payment, a purchase record (email, Stripe session ID and timestamp) is stored so that a download link can be emailed and re-issued if needed. Card details are never held on this website.
Before launch, add your controller identity and contact details, lawful bases, retention periods, data-subject rights, international-transfer information, processors, analytics/cookie information and any marketing practices you adopt.