Privacy policy
Stitching Tracker orders, payment verification and manual licence delivery.
Stitching Tracker trial requests
We collect your email, language, date, request status and, only if you opt in, separate consent for news. Google Apps Script and a private Google Sheet record requests and group owner notifications so we can handle your enquiry before a possible purchase. We do not collect campaign parameters, passwords or licence codes with the request. Submitting it does not create an account or issue a licence. We retain request data while needed to handle it and related issues or responsibilities; request deletion at soporte@stitchingwithfru.com. Marketing is optional and you can withdraw that consent without affecting your request.
Controller and contact
Bordando con Fru · soporte@stitchingwithfru.com. This policy covers orders on this website, communications and private resources. Your Stitching Tracker app account is separate; this website does not access your private stitching projects or automatically link the accounts.
Purposes and data
We process your name, email, selected edition, acquisition context, payment method, amount and contractual acceptances to manage your order, communicate with you, verify payment and deliver your licence manually. Account and session data supports authentication, private resources and security. App licence, device and stitching data supports the functions of your edition and technical support. We do not request card or bank credentials in order forms: you make payment outside the form.
Legal bases
Order administration, pre-contractual measures and the purchased service rely on the contractual relationship. Applicable legal obligations also apply. News and marketing emails require separate optional consent. Campaign measurement requires prior optional consent, separate from purchase and marketing; refusing it does not affect the service.
Contractual emails and private resources
We may send order confirmations, access invitations, password recovery and communications necessary for your service. These are separate from optional marketing. Use a correct email and protect your password. Historical product resources remain separate from your new app licence.
Technical providers
Deno hosts this website and its administration panel. Supabase supplies authentication, access and website data; Inventario Profesional has a dedicated authentication project. Brevo supplies transactional email. Cloudflare supplies app API Workers, D1 and abuse protection. Netlify hosts the app frontends. Google Apps Script and Sheets support current forms and order records; Drive supports resources and history. Stitching Tracker does not use Google Sheets to track your stitching. Providers process data as necessary for these purposes; we do not sell it or share it for third parties’ own marketing.
International data transfers
Some technical providers may process personal data outside the European Economic Area. Where applicable, legally recognised mechanisms and safeguards are used, such as adequacy decisions or standard contractual clauses.
Retention
Personal data is retained only as needed for its purpose and, afterwards, to meet applicable legal obligations or contractual responsibilities. Order, payment, delivery and contractual evidence have their own retention obligations. App account, licence and data are retained as necessary for service; data no longer needed is deleted or restricted where appropriate, subject to legal obligations or claims. Marketing data is retained until consent is withdrawn. Campaign attribution follows the separate period below.
Optional project details and photographs
Projects may optionally include the designer, fabric, thread brands, text notes and a photograph to help identify them. Do not enter confidential information about other people or images you are not entitled to use for this purpose. The image is adapted on your device before upload; the service retains the optimised version and a thumbnail, without the original metadata.
Private photographs and storage location
Photographs and thumbnails are stored privately in Cloudflare R2, in a bucket configured with European Union storage jurisdiction. Viewing them requires authorised access to the account, licence, device and project. They are not published in a catalogue or through a public object link. R2 storage jurisdiction does not mean that all Cloudflare processing, its logs or other services operate exclusively in Europe; the international data transfers section of this policy also applies.
Temporary thumbnail cache
The browser may temporarily reuse an already authorised thumbnail in memory, subject to size and expiry limits. This memory is cleared on sign-out or an account change and invalidated when the photograph is replaced or removed. Private photographs are not included in the public cache or in the files prepared for offline use of the app.
Encrypted operational backups
For operational recovery, independent encrypted backups are made to private NAS storage managed by the controller; the NAS does not serve photographs to customers. Public-key encryption is used, and the private recovery key is held separately. Initial retention is limited to seven recovery points per account and seven days from the creation of each point. Incidents may reduce the backups available, and removing expired points depends on maintenance running successfully. This is not a permanent archive and does not guarantee recovery of every item.
Removal and limited recovery periods
Removing or replacing a photograph withdraws ordinary access to it. Unreferenced technical versions are retained for the recovery safety period, initially seven days, and removed through maintenance; a valid Trash or recovery reference may extend retention until that reference expires. Encrypted backups already created follow their own limited retention period. Trash for projects and sessions retains its 30-day recovery period; importing a backup does not restart it. Deletion requests are handled within the applicable periods and obligations described in this policy, withdrawing access and preventing deleted data from being reused when a backup is recovered.
Limitations of downloadable .sbcopia files
Downloadable .sbcopia files contain tracking data and the details included in the backup, but do not contain photographs or thumbnails. Importing them does not recover images or associate them again by name or code. Multimedia recovery requires support intervention and depends on the existence and integrity of a current backup and its key. Keep any originals you need to retain. Text in downloadable backups is not encrypted by the app: store these files privately.
Cloudflare R2 as a technical provider
Stitching Tracker also uses private R2 for optional photographs and their thumbnails, with the jurisdiction and conditions described in the dedicated section above.
Stitching Tracker cookies and similar technologies
We use our own local browser storage (localStorage) solely for this optional purpose. We do not install advertising pixels or send this data to advertising platforms. Consent only covers this measurement on this website.
Campaign fields
We only allow campaign labels: utm_source, utm_medium, utm_campaign, utm_content and ref. We do not store names, email addresses, account IDs, IP addresses or advertising identifiers in the source record.
Remembering your choice
We remember your accept or reject choice for 180 days, without extending that period when you browse. This preference, necessary to respect your choice, contains only a version, your choice and its date; no campaign, advert or referral label.
First source and expiry
With your consent, the first valid source is stored for up to 30 days from capture. Another campaign or a reload does not extend that period. It becomes invalid on expiry and is removed when you next visit the website; the browser cannot run removal while the website is closed. Server use stops at the exact expiry time, and the existing hourly maintenance removes the data physically; a maintenance failure may delay physical deletion but cannot extend its use.
Quotes, orders and payments
Linking sources to quotes, orders and confirmed payments through the order form relies on this consent. Attribution expires 30 days after the original capture, or earlier if you withdraw; a later payment remains a valid sale without attribution. Orders, contracts and evidence will be retained under their own obligations, without extending advertising attribution.
Withdrawal of measurement consent
Select “Reject” to withdraw consent: we remove the Stitching Tracker source from this browser and stop new captures. If this browser retains the private withdrawal key created when preparing a quote, we also withdraw attribution sent to the server. If the connection fails, we keep only that key to retry on your next visit. Clearing storage or using a different browser may prevent automatic withdrawal; attribution still expires after 30 days. No sign-in, email or support request is needed. Withdrawal does not affect the lawfulness of processing before withdrawal.
Your rights
Request access, correction, deletion and other applicable data protection rights at soporte@stitchingwithfru.com. You may withdraw consent at any time without affecting the lawfulness of earlier processing, unsubscribe from marketing and complain to the competent supervisory authority. Campaign withdrawal can be completed through Measurement preferences, without sign-in or an email request.
Place your order → · Purchase terms · Privacy policy · Measurement preferences