How we look after your information
Privacy policy
Last updated: 6 October 2026
We keep this simple: we collect only what we need to sell you a book and send it to you, and we never sell your data.
Who is responsible
StoryCanvas ([legal business name], [address]) is the data controller for personal information collected through story-canva.com. Contact: books@story-canva.com.
What we collect
- Order details: your email address, the book you bought, the amount, and the date and time.
- Payment details: handled entirely by Stripe. We receive confirmation of payment and limited information (such as your email, name and country) but never your full card number.
- Download records: how many times your download link has been used, so we can keep links secure.
- Messages: anything you send us by email.
- Technical logs: our hosting providers keep short-lived server logs (such as IP address and browser type) for security.
Why we use it (and our lawful basis)
- To process your order and email your download link: performance of a contract.
- To keep accounting and tax records: legal obligation.
- To prevent fraud and keep the shop secure, and to answer your questions: legitimate interests.
We don't send marketing emails unless you've clearly asked us to, and you can unsubscribe at any time.
Who we share it with
We use a few trusted service providers who process data on our behalf:
- Stripe for payments (see Stripe's privacy policy).
- Resend to send order emails.
- Supabase to store orders and book files (servers in the EU, Frankfurt).
- GitHub Pages to host this website.
Some of these providers may process data outside the UK. Where they do, they use approved safeguards such as the UK International Data Transfer Addendum or adequacy regulations.
Cookies
This website doesn't use advertising or analytics cookies. We use your browser's temporary session storage only to remember your download link during your visit. Stripe's checkout page uses its own cookies to process payments securely and prevent fraud.
How long we keep it
We keep order records for six years after the end of the financial year they relate to, as required for UK tax purposes. Download links expire after 30 days. Emails you send us are kept for as long as needed to help you.
Your rights
Under UK data protection law you can ask to see, correct or delete your personal information, object to or restrict how we use it, and ask for a copy in a portable format. Email us and we'll respond within one month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ico.org.uk).
Children
Our books are for children, but our shop is for adults. We don't knowingly collect information from children.