Privacy. Mostly a list of things that do not happen.

1. The short version

Charming Seal is the controller of the small amount of personal data this website produces, and of email sent to hello@charmingseal.com. That is the whole of the relationship. The project runs no service on your behalf, so there is no account, no profile, no order history and no customer list held here. Two things still leave a trace when you read this page, and section 3 names both.

2. What this site does not do

• No cookies are set by this website.
• No analytics, of any kind, first-party or third-party.
• No tracking pixels, no advertising, no advertising identifiers, no remarketing.
• No account to create, and no newsletter to be subscribed to.
• No profiling and no automated decision-making.

That is a design choice rather than a temporary state. There is nothing to switch off, which is why the site carries no consent banner.

3. What is processed anyway

Two things are unavoidable once a page is served.

Server logs at the host. This website is hosted by Vercel Inc. in the United States. Serving a page necessarily produces a request log, which includes the visitor's IP address, the user agent their browser sends, the URL requested and a timestamp. Vercel holds those logs as part of running the service. The project keeps no copy and builds no visitor database from them.

Requests to Google Fonts. The site loads its typefaces from fonts.googleapis.com and fonts.gstatic.com. That means your browser makes a request directly to Google on every page you open, which exposes your IP address and the user agent it sends. This is a convenience the project chose, and it is the one place a third party learns that you visited. If that matters to you, a content blocker or a browser that refuses those hosts will still render the site.

4. Email, and GitHub

If you write to hello@charmingseal.com, the message, your address and whatever you put in it are processed to answer you. The mail provider that hosts the address necessarily handles the contents in transit and at rest. Do not send card numbers, API keys or passwords to that address, or to anyone.

Anything you post publicly on the repository, in an issue, a discussion or a pull request, is public because you posted it there. GitHub is the controller of that platform and its own notice applies. A security report sent through the private route in SECURITY.md is not public.

5. Why, and on what basis

Request logs are processed in the legitimate interests of delivering the site and keeping it secure, which includes noticing an attack in progress. Email is processed in the legitimate interest of answering the person who wrote. Font requests are made in the legitimate interest of presenting the site as designed, and section 3 says out loud what that costs you. Nothing described here relies on consent, because nothing here is done that would require it.

6. How long it is kept

Retention of the host's request logs is set by Vercel under its own policy, not by this project, because the project neither controls nor copies them. Email is kept while the thread is useful and deleted when it is not. Public GitHub content stays until whoever posted it removes it. No other store of personal data exists here to have a retention period.

7. No sale, no sharing

Personal data is never sold, rented, or shared for advertising or cross-context behavioural advertising. There is no data broker in this picture, and no marketing list. Data is disclosed only to the vendors listed on the sub-processor page, who process it to run the site, or where a law or a valid legal order requires it.

8. Your own deployment

This section is the important one. A Charming Seal deployment you run is not ours and cannot be reached by us. It holds your shop's data and your buyers' data on your host, in your database, under credentials only you hold. The project receives no shop data, no buyer data, no card data and no Stripe keys, and there is no telemetry, no phone-home and no back door through which any of it could arrive.

You are the controller of that data. If one of your buyers asks for access, correction or erasure, that request must go to you, because there is nothing on this side to search and nothing to delete. The DPA sets the position out in full, and the sub-processor page lists the vendors you will be relying on.

9. Transfers to the United States

The vendors that run this website are in the United States, so reading these pages involves a transfer there. Where personal data of people in the United Kingdom or the European Economic Area is transferred, it is done under the safeguards those vendors provide, which include the standard contractual clauses and the UK addendum to them. The vendors are named on the sub-processor page.

10. Your rights

Depending on where you live, you have the right to ask for access to your personal data, correction of it, erasure of it, restriction of processing, portability, and to object to processing carried out on the basis of a legitimate interest. You also have the right to complain to your data protection supervisory authority.

To exercise any of them, write to hello@charmingseal.com. What can be acted on directly is correspondence, because that is what is actually held. The host's request logs are not copied or indexed here, so a request about those is passed to the host and answered as far as the host can identify anything.

11. Children

This website is documentation for a piece of developer software. It is not directed at children, nothing on it is designed to appeal to them, and no personal data is knowingly collected from them. If you believe a child has sent something to the contact address, write and it will be deleted.

12. Changes to this notice

If this notice changes, the date and version at the top of the page change with it, and a material change is noted in the repository so a record exists outside this website. No address list is held here, so nobody can be notified directly. Building one would mean collecting the data this site does without.

13. Questions

Privacy questions, rights requests and anything else go to hello@charmingseal.com, the single address for every enquiry. The companion documents are the terms of use, the acceptable use policy, the DPA and the sub-processor list.