Privacy policy

Last updated: 7 September 2026

This notice explains how we handle personal information when an adult visits Big Feelings Club, buys a printable kit or contacts us.

Who is responsible

We are the controller of personal data used to operate this store and fulfil orders. You can contact us about privacy by writing to the postal address above.

Information we use

• Orders: the buyer's email address, payment and order identifiers, payment status, purchase amount, delivery status and private download link. Stripe may also collect a name, billing address, country or tax information needed for payment.
• Payments: card details are entered directly in Stripe's embedded payment form. We do not receive or store the full card number or security code.
• Technical information: IP address, browser and device details, request and security information necessary to operate the website and prevent abuse. Hosting and service providers may process their own operational logs.
• Support: information you choose to send when contacting us. Please do not include children's health information or completed activity sheets.

Purposes and legal grounds

We use order information to accept payment, deliver the kit and provide order support, as necessary to perform our contract with you (Article 6(1)(b) GDPR). We keep records required for accounting, tax and other legal obligations (Article 6(1)(c)). We use proportionate security and support information to protect the store, prevent fraud, resolve disputes and respond to enquiries, based on our legitimate interests (Article 6(1)(f)). You may object to processing based on legitimate interests.

We do not add customers to marketing lists as part of a purchase. An order confirmation or delivery email is a service message, not a newsletter. We do not use this site to make legal or similarly significant decisions about you solely through automated processing. Payment providers may apply their own fraud checks.

Service providers

We share information only as needed to operate the store, deliver purchases and meet our obligations:

• Stripe: payment processing, authentication and fraud prevention. Stripe may act as our processor or as an independent controller for certain payment and legal purposes. See Stripe's privacy policy.
• Resend (Plus Five Five, Inc.): sending transactional delivery emails. It processes the recipient's email address, message content and delivery information. See Resend's privacy policy and data processing addendum.
• Meta: with your marketing consent, the Meta Pixel sends page and product views, checkout starts and confirmed purchases, together with browser/device information, IP address and advertising cookie identifiers, to Meta Platforms Ireland Limited and its providers. Meta can associate this information with its users for ad measurement and relevant advertising. We do not send children's activity responses or private download tokens to Meta. See Meta's privacy policy.
• Google Fonts: the site requests typefaces from Google, which receives technical request information including an IP address. See Google's privacy policy.
• Vercel: website hosting, server functions and private storage of the purchased PDF files. See Vercel’s privacy policy.
• Accounting and professional support providers: only information needed for their service or a legal obligation. Authorities may receive information where required by law.

We do not sell personal information for money. Optional advertising disclosures to Meta may be considered sharing for targeted advertising under applicable US privacy laws; you can reject them in Privacy settings.

International processing

Some providers process information outside the European Economic Area, including in the United States. Where GDPR requires transfer safeguards, these may include an applicable adequacy decision or the European Commission's Standard Contractual Clauses. Resend's data processing addendum describes its use of these clauses. Contact us for information about safeguards relevant to your data.

How long we keep information

Private download links work for 30 days after purchase. Expiry of a link does not automatically delete an order record. We retain order and payment records for applicable accounting and tax periods and as needed for claims, refunds and support. Support correspondence is kept until the enquiry is resolved and for any relevant claims period. Technical information is kept for operational and security needs; longer retention may be necessary to investigate an incident. Provider retention periods also depend on their role and legal obligations.

Cookies and browser storage

Optional Meta advertising measurement runs only after you choose Accept marketing. Its legal basis is consent (Article 6(1)(a) GDPR). Rejecting optional cookies does not prevent purchase. Use Privacy settings in the footer to change your choice or withdraw consent at any time. This stops future Pixel events and clears accessible Meta advertising cookies; it does not undo earlier processing.

We store your consent choice locally for up to 180 days. Meta may set _fbp and _fbc advertising cookies, typically for up to 90 days. After consent, we also store an anonymous purchase event identifier locally to avoid counting a return visit twice. Your order session is kept in session storage to let you refresh the confirmation page. These identifiers do not contain card details or children's responses.

Opening checkout loads Stripe's payment form, which may use cookies or similar technology for payments, security and fraud prevention. See Stripe's cookie policy. You can also manage browser storage through your browser settings.

Your rights

Depending on the circumstances, you can request access, correction, deletion, restriction of processing or a portable copy of your data. You can object to processing based on legitimate interests. If a particular use relies on consent, you can withdraw that consent without affecting earlier lawful processing. These rights may be limited where records must be retained by law.

You can contact us at the address above. We may request proportionate information to confirm your identity. You may also complain to your local supervisory authority or the Polish authority, the President of the Personal Data Protection Office (UODO).

Children and activity pages

The store and checkout are intended for adults. The printable activities are for children to use offline with a grown-up. We do not ask children to create accounts or submit answers, drawings or feelings. Buying the kit does not send a child's activity responses to us. If you believe a child has sent us personal information, contact us so we can address it.

Providing information

You can browse the site and use the free printable without giving an email address. An email address and the payment information requested by Stripe are needed to complete an online purchase and deliver the kit.