Privacy policy
Last updated October 23, 2026
This policy explains what personal data Hoop & Paw collects, why, who we share it with and how long we keep it. The short version: we collect only what we need to make your pattern, we never sell your data, your photos are private and deleted after 30 days, and you can download or delete your data yourself at any time from My patterns.
Who is responsible
The data controller is [PLACEHOLDER: registered business name, e.g. Hoop & Paw ENK], [PLACEHOLDER: business address, Norway], Norway. Contact: privacy@hoopandpaw.com.
For payments, Paddle.com (our reseller and Merchant of Record) is a separate data controller for the payment details and billing information you give them. Their privacy notice applies to that data. We never see your full card details.
What we collect and why
| Data | Why we use it | Legal basis |
|---|---|---|
| Photos you upload and AI versions of them | To make your pattern and let you change it | Contract |
| Design settings (size, colors, name or dates you add) | To make and remake your pattern | Contract |
| Email address | To deliver your files, sign you in, send receipts and support replies | Contract |
| Order details (what you bought, price, date, country from Paddle) | To deliver, refund and keep required accounting records | Contract, legal obligation |
| Support messages | To answer you | Contract, legitimate interest |
| Reviews you choose to write (rating, text, the name you pick) and an optional photo of your stitching | To publish your review; we show the photo only if you agree and we've checked it | Consent — ask us to remove it any time |
| Marketing emails (only if you opt in and confirm) | Stitching tips, new patterns and occasional offers | Consent — withdraw any time with one click |
| Technical data: a random visitor ID cookie, a daily-salted hash of your IP address, browser type | Free-preview limits, security, preventing abuse | Legitimate interest |
| Usage statistics without cookies (pages viewed, preview and purchase counts) | Understanding what works so we can improve | Legitimate interest |
We don't use your data for automated decisions with legal effects. Support messages are sorted automatically (and common questions answered with help articles); a person handles everything else.
Who we share data with
We use these service providers ("processors"), who may only use your data to provide their service to us:
| Provider | What they do | Location |
|---|---|---|
| Vercel Inc. | Hosting, file storage, privacy-friendly analytics | USA / EU |
| Neon Inc. | Database | USA / EU |
| Resend Inc. | Sending email | USA |
| OpenAI | AI styles (only when you choose one), sorting support messages, and the automatic check on reviews | USA |
| Google (Gemini API) | Backup AI provider for AI styles, if enabled | USA |
| Cloudflare (Turnstile) | Bot protection on forms, if enabled | USA / global |
AI providers process your photo to return the styled image. Under their API terms, data sent through the API is not used to train their models.
Some providers are in the USA. Transfers are protected by the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
We never sell or rent your personal data, and we don't share it for cross-context advertising.
How long we keep it
| Data | How long |
|---|---|
| Uploaded photos and AI images | 30 days after upload, or until your free-changes window ends (30 days after purchase) plus 2 days |
| Pattern files | Until you delete your account, so you can re-download them |
| Account and design settings | Until you delete your account |
| Order records | As long as accounting law requires (in Norway, generally 5 years), without your name or email after account deletion |
| Support messages | Until you delete your account, or 3 years after the last message |
| Reviews and review photos | Until you delete your account or ask us to remove them |
| Marketing consent records | As long as you're subscribed, then up to 3 years as proof of consent |
| Sign-in links | A few days after they expire |
| Hashed IP and rate-limit records | 2 days |
| Usage statistics (no personal data) | Up to 400 days |
| Error logs | 90 days |
Your rights
You can, at any time:
- Download your data — My patterns → "Download my data".
- Delete your account — My patterns → "Delete my account". This removes your photos, patterns, email preferences and personal details straight away. We keep only the order records accounting law requires, without your name or email.
- Unsubscribe from marketing with the link in any email.
- Correct your data, object to processing based on legitimate interest, or restrict processing — write to privacy@hoopandpaw.com.
You can also complain to a data protection authority — in Norway that's Datatilsynet (datatilsynet.no), or the authority where you live.
California residents: you have the right to know, delete and correct your personal information and not to be discriminated against for using these rights. We don't sell or share personal information as defined by the CCPA.
Children
The site isn't meant for children under 16, and we don't knowingly collect their data.
Security
Photos and files are stored privately and only reachable through short-lived signed links. Data is encrypted in transit, sign-in links are single-use, and access to our systems is limited to what's needed.
Changes
We'll update this page when our practices change and tell you by email about important changes.