Privacy Policy

1. Who is responsible for your data

M B Squared Inc., Phoenix, Arizona, USA (“we”, “us”), is responsible for your personal information (the “controller” under European law). Contact us about anything in this policy at hello@mycozycrossstitch.com.

2. Information we collect

• Account details: your name, email address and password (stored encrypted), or your basic Google profile if you sign in with Google; your display name, username, photo and bio if you add them.
• Purchases: what you bought, when, the amounts paid, your billing country and postal code (and full billing address where needed to calculate tax), gift card and membership activity. Card details are handled entirely by Stripe and never reach us.
• Creator information: your application, shop name, profile, listings, sales, and the details needed to pay you and meet tax reporting rules (collected by our payment provider where possible).
• Messages & content: blog comments, reviews, and messages you send us or, as a Creator, through your studio inbox.
• Newsletter: your email address, if you subscribe.
• Technical information: IP address, browser and device type, pages visited and similar usage data, collected through cookies, local storage and our privacy-friendly analytics.

3. How we use it, and our legal basis

For visitors in the EU and UK, the law requires us to state a “legal basis” for each use. Here they are:

• To run your account, process orders, deliver your files and pay Creators: necessary to perform our contract with you.
• To send order confirmations and account or service emails: necessary for our contract.
• To calculate and collect sales tax and VAT, keep accounting records, and handle legal requests: to comply with our legal obligations.
• To send our newsletter: your consent, which you can withdraw at any time with the unsubscribe link.
• To keep the site secure, prevent fraud and misuse, moderate content, provide support and improve the site: our legitimate interests in running a safe and useful service.

4. Who we share it with

We do not sell or rent your personal information, and we don’t share it for targeted advertising. We share it only with service providers that help us run the site, under contracts that protect it:

• Stripe: payments, tax calculation, fraud prevention and, for Creators, payouts and tax forms;
• Vercel and Amazon Web Services: website hosting, database and secure file storage;
• Our email provider: account emails and the newsletter;
• Google: only if you choose “Sign in with Google”;
• Tax authorities, courts or regulators: when the law requires it;
• A buyer or successor, if our business is sold or reorganized (this policy would continue to apply).

Creators see sales information about their own patterns (what sold and when). They don’t receive your email or address, and they may never use buyer information for their own marketing.

5. What is public

Blog comments and reviews are public and shown with your display name. Creator pages are public, with the shop name, photo and bio the Creator chooses to share. Your purchases, Library, email address and billing details are never public.

6. Cookies & similar technologies

We use a small number of cookies and browser storage items:

• Essential: keeping you signed in, your cart, security, and remembering your cookie choice. These are needed for the site to work.
• Preferences: small conveniences, such as which notifications you’ve already seen.
• Analytics: Vercel Analytics, which measures page visits in aggregate without advertising cookies, and Google Analytics 4, which sets first-party cookies (_ga, _ga_*) to understand how visitors use the site (pages viewed, patterns added to cart, purchases). Google Analytics runs with advertising features, Google Signals and ad personalization turned off. If you are in the EU, the EEA, the UK or Switzerland, it only runs after you click “Accept”. Elsewhere it runs by default, and you can turn it off at any time with “Decline” in the cookie banner or in your account’s Preferences. We also honor the Global Privacy Control signal as an opt-out.

We don’t use advertising or cross-site tracking cookies. You can clear or block cookies in your browser settings, but signing in and the cart need them.

7. International transfers

We are based in the United States, and our service providers store data in the US and elsewhere. If you are in the EU, UK or another country with data transfer rules, your information is transferred to the US under safeguards the law recognizes, such as the European Commission’s Standard Contractual Clauses or the EU-US Data Privacy Framework where our providers are certified.

8. How long we keep it

• Account information: while your account is open.
• Order, tax and payout records: as long as tax and accounting laws require (generally up to 7 years in the US, and up to 10 years for EU VAT records).
• Newsletter: until you unsubscribe.
• Support messages: up to 3 years after the conversation ends.

When you delete your account, we delete or anonymize your information, except what we must keep for legal reasons.

9. How we protect it

Passwords are encrypted, the site uses HTTPS, pattern files are stored privately and delivered through short-lived signed links, and access to personal data is limited to people who need it. No system is perfectly secure, but if a breach ever affects your data, we’ll tell you and the authorities as the law requires.

10. Your rights

Wherever you live, you can ask us to:

• tell you what personal information we hold about you and give you a copy;
• correct information that is wrong;
• delete your information (except what we must keep by law);
• stop sending you marketing emails (or use the unsubscribe link).

EU and UK residents also have the right to object to or restrict certain uses, to data portability, to withdraw consent at any time, and to complain to their local data protection authority.

California and other US state residents have the right to know, access, correct and delete their personal information and to not be discriminated against for using these rights. We don’t sell personal information or share it for cross-context behavioral advertising, so there is nothing to opt out of.

To use any of these rights, email hello@mycozycrossstitch.com. We may need to confirm your identity first, and we’ll answer within the time the law requires (usually 30 to 45 days).

11. Children

My Cozy Cross Stitch is not intended for children under 13 (under 16 in the EU and UK), and we don’t knowingly collect their information. If you believe a child has given us personal information, please contact us and we’ll delete it.

12. Changes to this policy

We’ll update this policy when our practices or the law change. The effective date at the top shows the latest version, and we’ll tell you about important changes by email or on the site.

13. Contact us

Questions or requests: hello@mycozycrossstitch.com, or write to M B Squared Inc., Phoenix, Arizona, USA. See also our Terms of Service.