Privacy policy

Who is responsible for your information

This website is run by Natagor Finlayson, who designs and sells the patterns, in Lincolnshire, United Kingdom. She is the "data controller" for the information described here. For anything about your information, email or use the contact form.

What is collected, and why

When you buy a pattern

Payment is handled by Stripe (see Payments below). This site never sees or stores your card details. From each order it keeps your email address, the patterns you bought, the amount paid, your country, the order number and the date, plus a record of when each pattern was downloaded. This is needed to deliver your patterns, send new download links if you lose them, help with any problem, and keep the accounts the law requires. Legal basis: performing our contract with you, and legal obligation (tax and accounting records).

Before checkout you confirm that you want your pattern straight away and understand this ends your 14-day right to cancel. The time you confirmed is kept with your order.

About two weeks after your order you'll get one email asking how the pattern went, with a link to leave a review. It's sent once and never again. Legal basis: legitimate interest in hearing from customers.

When you leave a review

Reviews can only be left through the private link from your order. The review, your star rating and the name you choose are shown on the pattern page, marked "Verified purchase", once Natagor has checked them. Your email address is never shown. Reviews are only turned down for spam, abuse or not being about the pattern, never for a low rating. Legal basis: your consent, given when you send it; ask and your review will be removed.

When you send a message

The contact form keeps your name, email address, your message and anything else you choose to fill in (an order number, a pattern), so it can be answered. It's also emailed to Natagor. Legal basis: legitimate interest in replying to you.

When you ask for new download links

The email address you enter is used to find your orders and send the links. Requests are logged briefly to stop the form being misused. Legal basis: performing our contract with you.

Newsletter

Only if you tick the box in the basket (or sign up to the newsletter yourself), your email address is added to Natagor's mailing list for news of new patterns and offers. The box is never ticked for you. Every email has an unsubscribe link, and you can also just reply and ask. Legal basis: your consent, which you can withdraw at any time.

Protecting the forms

To stop spam, the contact and download-link forms use Cloudflare Turnstile, which checks that a person, not a program, is filling them in. To limit how often a form can be used, the site keeps a scrambled (one-way hashed) version of your connection's address, never the address itself. Legal basis: legitimate interest in keeping the site secure.

Cookies and storage in your browser

There are no advertising or tracking cookies. Visits are counted with Cloudflare Web Analytics, which sets no cookies and doesn't identify you: it records only things like which pages are viewed, the type of device and the country. The site stores only:

• Your basket: the patterns you've added, kept in your browser for up to 3 days, with a small cookie that lets the page show the right basket count.
• Light or dark appearance, if you choose one.

Both are needed for the features you use, stay in your browser, and aren't used to identify you, so no cookie banner is needed. Cloudflare Turnstile and Stripe's payment page may set their own strictly necessary cookies for security and fraud prevention.

Who your information is shared with

Only with the services that make the shop work, and only what each needs:

• Stripe takes payments. Purchases are sold through Onelink, Stripe's reseller service, which handles the payment, VAT and sales tax, receipts and payment questions. You give your payment details directly to them, under their own privacy policy.
• Cloudflare hosts the website, its database and the pattern files, and runs Turnstile.
• Resend sends the site's emails (order confirmations, download links, review requests, replies to the contact form), from servers in the European Union.
• Kit (ConvertKit) holds the mailing list, for people who have signed up.
• Google Fonts supplies the typefaces, so your browser connects to Google to load them.
• Cloudflare Web Analytics counts visits without cookies (see above).
• YouTube: tutorial videos use YouTube's privacy-enhanced mode and only load when you press play. Once playing, YouTube's own privacy policy applies.

Some of these companies are based in, or process information in, the United States and other countries outside the UK. Where they do, they protect it with the safeguards UK law requires, such as the UK International Data Transfer Addendum or the UK–US data bridge. Your information is never sold, and is never shared for advertising.

How long it is kept

• Orders: 6 years, the period UK tax law requires accounts to be kept. Orders from the old version of this shop (before October 2026) were carried over on the same terms, so earlier buyers can still get new download links.
• Messages from the contact form: 2 years.
• Download-link requests and the scrambled connection records used to limit the forms: 90 days.
• Reviews: for as long as they're shown on the site, or until you ask for yours to be removed. Reviews not yet checked: 90 days.
• Newsletter: until you unsubscribe.

After that, it's deleted.

Your rights

You can ask to see the information held about you, have it corrected or deleted, object to how it's used, restrict its use, or receive a copy to take elsewhere. Some information (orders, for example) may have to be kept for the period above even if you ask, because the law requires it. Email . There's no charge and you'll have an answer within a month.

If you're unhappy with how your information has been handled, please get in touch first. You also have the right to complain to the Information Commissioner's Office (ico.org.uk), or to the data protection authority where you live.

Changes

If this policy changes, the new version will be posted here with a new date at the top.