1. Introduction

This Privacy Policy explains how Woolmoot ("we", "us", "our") collects, uses, and protects your personal data when you use our platform. It should be read alongside our Terms of Service.

Our core principle is simple: your data is yours. We collect only what is strictly necessary to provide the Service. We do not sell, rent, trade, or monetise your personal data or content. Ever.

2. Data Controller

The data controller responsible for your personal data is Woolmoot. For any privacy-related inquiry, contact us at contact@woolmoot.com.

3. Data We Collect

3.1 Data you provide

3.2 Data collected automatically

We do not collect browsing history, location data, keystroke patterns, or any form of behavioural tracking data.

3.3 Data we never collect

• Financial data (credit card numbers, bank details), handled exclusively by LemonSqueezy
• Biometric data
• Health or medical data
• Political, religious, or philosophical beliefs
• Data from third-party trackers or advertising networks

4. Legal Basis for Processing

Under GDPR Article 6, we process your data on the following legal bases:

5. How We Use Your Data

Your data is used exclusively to:

• Provide, operate, and maintain the Service
• Authenticate your identity and protect your account
• Store and render your patterns, images, and PDFs
• Translate pattern text when you request it
• Process your subscription via our payment provider
• Send transactional emails (verification, account notifications)
• Send marketing emails (only with your explicit consent)

We do not use your data for profiling, automated decision-making, behavioural advertising, or any purpose not listed above.

6. Data Retention

When retention periods expire, data is permanently and irreversibly deleted. We do not archive User Content after account deletion.

7. Data Sharing & Sub-processors

We never sell, rent, or trade your personal data. We share data only with the following sub-processors, strictly as needed to deliver the Service:

Each sub-processor is bound by a data processing agreement. We will notify you at least 14 days before adding or changing a sub-processor.

7.1 What the text processing provider receives

Only generic text (titles, notes, free-form descriptions) is sent anonymously to our text processing provider for translation. Stitch terms and abbreviations are translated locally using our built-in lexicon. No account identifier or sensitive pattern data is transmitted.

7.2 Other disclosures

We may disclose your data only if required by law, court order, or to:

• Comply with a valid legal obligation
• Protect the rights, safety, or property of Woolmoot or its users
• Prevent fraud or abuse of the Service

In such cases, we will notify you unless legally prohibited from doing so.

8. International Data Transfers

Your primary data (account, patterns, images) is stored within the EU (Neon on AWS Frankfurt, Cloudflare R2 with European edge nodes). Some sub-processors (LemonSqueezy, Resend, our text processing provider, Vercel) are located in the United States. For these transfers, we rely on:

• EU Standard Contractual Clauses (SCCs) — approved by the European Commission (Module 2: Controller-to-Processor)
• Transfer Impact Assessments — conducted to evaluate supplementary safeguards for each sub-processor
• EU-US Data Privacy Framework — where applicable and certified by the sub-processor

No pattern content or account data is transferred outside the EU for storage purposes. Payment processing, transactional email, on-request text translation, and application hosting (Vercel) may involve US-based infrastructure. Vercel primarily serves requests from EU regions (Paris, Frankfurt) but may route traffic through US nodes.

9. Security Measures

We implement the following measures to protect your data:

• HTTPS/TLS encryption for all data in transit
• Passwords hashed using industry-standard algorithms (never stored in plaintext)
• Session tokens with automatic expiration
• Rate limiting on authentication and sensitive endpoints
• Image processing with EXIF metadata stripping (location, device info removed)
• HTTP security headers (Content-Security-Policy, HSTS, X-Content-Type-Options)
• No source maps exposed in production
• Dependency auditing in the CI pipeline

No system is 100% secure. If we discover a data breach affecting your personal data, we will notify you and the relevant supervisory authority within 72 hours, as required by GDPR Article 33.

10. Cookies & Local Storage

Woolmoot uses only strictly necessary cookies:

We use Plausible Analytics for anonymous, aggregated usage statistics. Plausible is cookie-free and does not collect personal data. We do not use advertising cookies, tracking pixels, or any third-party cookies. Since we use only strictly necessary cookies as defined by the ePrivacy Directive, no consent banner is required.

11. Your Rights

Regardless of where you are located, you have the following rights over your personal data:

• Access: request a copy of all data we hold about you
• Rectification: correct inaccurate or incomplete data
• Erasure: request permanent deletion of your account and all associated data
• Portability: receive your data in a structured, machine-readable format (JSON)
• Restriction: request that we limit how we process your data
• Objection: object to processing based on legitimate interest
• Withdraw consent: revoke consent for optional processing (e.g., marketing) at any time, without affecting prior processing

To exercise any right, email contact@woolmoot.com. We will respond within 30 days. If we need more time, we will inform you of the extension and the reason within that initial period.

11.1 EU/EEA residents

You have all rights under GDPR Articles 15‑22. You may lodge a complaint with your local Data Protection Authority if you believe your rights have been violated.

11.2 UK residents

You benefit from equivalent protections under the UK GDPR and the Data Protection Act 2018. Complaints may be filed with the Information Commissioner's Office (ICO).

11.3 California residents (CCPA/CPRA)

Under the CCPA/CPRA, you have the right to:

• Know what personal information we collect and why
• Request deletion of your personal information
• Opt out of the sale or sharing of personal information
• Non-discrimination for exercising your rights

Woolmoot does not sell or share personal information as defined by the CCPA. There is nothing to opt out of, but you may still submit a request and receive confirmation.

11.4 Other jurisdictions

We respect data protection laws worldwide, including the French Loi Informatique et Libertés, German BDSG, Spanish LOPDGDD, Italian Codice della Privacy, Norwegian Personal Data Act, and Russian Federal Law No. 152‑FZ. Where local law provides stronger protections, those protections apply.

12. Children's Privacy

Woolmoot is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child under 16 has created an account, contact us at contact@woolmoot.com and we will delete the account promptly.

13. Automated Decision-Making

Woolmoot does not use automated decision-making or profiling that produces legal effects or similarly significant effects on you. The automated translation feature is a tool you explicitly trigger, and its output is always subject to your review and editing before export.

14. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be communicated via email or a prominent notice on the Platform at least 30 days before they take effect. The "Effective date" at the top of this page indicates the latest revision.

15. Contact

For any questions, concerns, or requests related to your privacy, contact us at contact@woolmoot.com.

See also our Terms of Service for the full terms governing your use of Woolmoot.