Privacy, plainly.

We collect the small amount of data needed to deliver files, keep accounts and meet tax law. We do not sell personal data. Last updated 12 November 2026.

What we collect and why

• Account data: email address, optional name, sign-in tokens and sessions. Used to perform the contract and keep accounts secure.
• Order data: product, amount, VAT, order status, Stripe customer and payment references, billing country and VAT ID if you provide one. Used to deliver the purchase and meet Dutch tax and accounting duties.
• Email list: email address, confirmation time, consent IP and unsubscribe status for the double opt-in weekly page. Used only with your consent.
• Security logs: IP address and user agent for sign-in throttling and download audit. Used for our legitimate interest in preventing abuse.
• Analytics: only if you press “Allow analytics”. Privacy-friendly aggregate page views; no advertising profiles and no cross-site tracking.

We never collect or store card numbers. Stripe collects payment details directly and returns only a payment reference.

Who processes data for us

• Stripe Payments Europe, Ltd. — payments, invoices, subscriptions and the billing portal.
• Vercel Inc. — hosting and server logs for the website.
• Cloudflare, Inc. — R2 object storage and DNS for the site and asset domain.
• Resend, Inc. — transactional email (magic links, receipts, weekly confirmations).
• Plausible Analytics — aggregate analytics, only after consent.

These providers process data under their own terms and standard contractual clauses for transfers outside the EEA. We do not add advertising networks or data brokers.

How long we keep it

Account data is kept until you ask us to erase it. Order and invoice records are kept for seven years because Dutch tax law requires it. Email-list data is kept until you unsubscribe or ask for erasure. Sessions expire after 30 days; sign-in links after 20 minutes. Server and download logs are kept for up to 90 days. Analytics aggregates contain no account identifiers.

Your rights

You can ask for access, correction, erasure, restriction, portability or object to processing based on legitimate interests. You can withdraw consent for the email list or analytics at any time; the site and any purchase keep working. Email hello@scriptureplayhouse.com. We answer within one month. You can also complain to the Dutch supervisory authority, Autoriteit Persoonsgegevens.

Cookies and consent

The site sets one essential cookie for your signed-in session. It is httpOnly, secure in production and expires after 30 days. Your analytics choice is stored in your browser. No analytics script loads before you allow it, and rejecting analytics does not reduce any functionality.

Checkout takes place on Stripe's hosted page, which uses its own strictly necessary cookies and fraud-prevention signals under Stripe's privacy policy.

Children

The shop is intended for adults buying resources for children. We do not knowingly create accounts for children or collect their data. The pages themselves contain no tracking.

Changes and contact

If this policy changes materially, we will post the new date here and, for account holders, email a summary. Questions or requests: hello@scriptureplayhouse.com. The controller is ScripturePlayhouse, Schildstraat 3, 5632 EL Eindhoven, Netherlands.

Terms · Privacy · Refunds and withdrawal