Privacy Policy

Last updated: 11 June 2026

1. Controller

Thomas Sojka, Rüthlingstr. 6, 80636 München, Germany. Email: contact@written-thinking.com.

2. What this service does

This site lets customers who purchased a digital product on Etsy download their files. Access is granted to the customer who made the purchase.

3. Data we process

Order data (via Etsy)

When you complete a purchase, Etsy notifies us (webhook). We store only the order details listed here: the Etsy order number, the order status (paid / cancelled), the purchased item and SKU identifiers, the order total and currency, timestamps, your first name (to greet you on your downloads page — we do not store your full name), and a count of which files have been downloaded for the order (to enforce reasonable download limits). We do not collect more than this.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR) — providing the files you bought. For the first-name greeting: our legitimate interest in a friendly, personal downloads page (Art. 6(1)(f) GDPR); you may object at any time by emailing us and we will remove the name from your order record.

Session cookie

When you enter a valid order number we set one essential cookie ("hfm-access") that keeps you signed in to your downloads. It stores your order number and expires after 30 days. We use no tracking or advertising cookies, so no cookie-consent banner is required.

4. Recipients and processors

• Hosting: Nextjournal GmbH (application.garden), Schinkestraße 9, 12047 Berlin, Germany. Servers are located in Germany.
• Etsy: Etsy Ireland UC operates the marketplace where the purchase is made and provides us the order data described above. Etsy is a separate controller for your purchase; see Etsy's own privacy policy.

5. Retention

Order records (including the download count) are kept for as long as we provide access to your purchased downloads and to meet any applicable legal retention obligations, then deleted.

6. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing. To exercise any of these, email contact@written-thinking.com.

You also have the right to lodge a complaint with a supervisory authority, e.g. the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA).

7. No automated decision-making

We do not use automated decision-making or profiling.