Privacy policy

Who is behind this site

Crochetlin is run by me, Elin Thunman-Malmström, as a private individual in Sweden. There is no company behind the site, no staff and nobody else reading what you send — it is just me. I am the data controller for the personal data processed here.

If you have questions about your data, or want to use any of the rights further down, email info@crochetlin.com. If you need a postal address for a formal matter, I will send it on request.

What is collected, why, and on what legal basis

The site has no login, no shopping cart and no database. There are four moments when data about you passes through it:

• The free pattern — your email address. It is used to send one email with the download link, which is to deliver what you asked for. The legal basis is performing what you requested (Article 6(1)(b)). The address is not stored on the site, and the download link holds nothing about you — it only says which language the PDF should be in.
• The newsletter — your email address, the time, and which consent wording you agreed to. The box is optional and never pre-ticked; you get the pattern whether or not you tick it. If you do, the address is added to my mailing list at Resend, and I receive an email with the time and the exact sentence you ticked, so that I can show consent was given. The legal basis is your consent (Article 6(1)(a)), which you can withdraw at any time.
• The contact form — your name, email address and message. It is forwarded as email to my inbox so I can reply, and is not stored in any database. The legal basis is my legitimate interest in answering the people who write to me (Article 6(1)(f)).
• The abuse throttle — your IP address, for an hour, as a checksum. So that one visitor cannot send the pattern to any number of addresses, attempts are counted. The IP address is turned into a checksum using a random key that only exists in the server's memory, so it cannot be turned back into an address. It is never stored in plain text, never reaches a database, and is gone within the hour. The legal basis is legitimate interest in protecting the site from misuse (Article 6(1)(f)).

Server logs at the hosting provider

The site runs on Vercel and, like every web server, it logs traffic: IP address, time, which page was requested and which browser was used. Those are Vercel's own operational logs, used for security and troubleshooting, and not something I control in detail.

What you type into the forms does not end up in those logs — the application never writes email addresses, names or messages to the log, and if a send fails the address is stripped from the error message before it is logged. What does show is that a request happened, and the download link, as mentioned, holds nothing about you.

How long data is kept

I would rather not promise more than I can keep: once data has left me it lives on at the provider until their own routines for logs and backups have run their course.

• The free pattern: the address stays in Resend's sending history for a period Resend decides, not me. If you did not tick the newsletter box, it exists nowhere else.
• The newsletter: the address stays on the mailing list until you unsubscribe. The email showing that you said yes is kept for as long as I may need to show that consent existed, and is then deleted.
• The contact form: the message stays in my inbox as long as the matter needs it, and is then deleted.
• The abuse throttle: the checksum of the IP address is gone within an hour, and immediately if the server restarts.
• The server logs: they stay for as long as Vercel keeps them.

Who I share data with

I never sell your data and never hand it to anyone who wants to market something. Three providers are needed to run the site:

• Resend – sends all email from the site and holds the newsletter mailing list.
• Vercel – runs the site and keeps the server logs.
• Etsy – the shop where the patterns are sold. If you buy there, Etsy takes the payment and your details under Etsy's own privacy policy. From the order I see your name or username and what you bought, so I can deliver and answer questions. Your card details never pass through me.

Transfers outside the EU and EEA

Resend, Vercel and Etsy are US-based and may process data outside the EU and EEA. Such transfers rely on the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.

How the data is protected

I use reasonable technical and organisational measures to protect the data against unauthorised access, loss, alteration and disclosure: the site is served only over an encrypted connection (https), keys and passwords live in the server's environment variables and never appear in the code sent to your browser, everything you type into the forms is validated before it is used, the forms have a throttle against mass sending, the free pattern PDF sits outside the public files and is reachable only through a signed link, and personal data is not written to the application's logs.

If something does go wrong and unauthorised people gain access to data, I will contact you if it could mean a risk to you, and report it to the Swedish Authority for Privacy Protection where the law requires it.

Cookies

No cookies for analytics, marketing or tracking. No Google Analytics, no advertising pixels, no third-party scripts — the fonts are served from the site's own server, so not even those are fetched from anywhere else.

The only cookie the site sets is called NEXT_LOCALE and contains sv or en, meaning the language you chose. It is a session cookie that disappears when you close the browser, and it is needed for the site to remember the language. Strictly necessary cookies do not require consent, which is why there is no cookie banner.

Your rights

Under the GDPR you have the right to:

• know what data about you I process, and receive a copy of it
• have inaccurate data corrected
• have data erased, where no legal obligation requires me to keep it
• request that processing be restricted
• object to processing based on legitimate interest
• receive your data in a machine-readable format and move it elsewhere
• withdraw consent at any time, without affecting processing carried out beforehand

Unsubscribing from the newsletter

Every newsletter has an unsubscribe link at the bottom — click it and the emails stop. You can also email info@crochetlin.com and I will take you off the list. Unsubscribing does not affect the free pattern you already received.

If you are unhappy

Please contact me first at info@crochetlin.com and I will try to sort it out. You also always have the right to complain to the Swedish Authority for Privacy Protection, imy.se.

Changes to this policy

If the processing changes I will update this page and the date at the top. If the change is significant and affects you, and I have your address, I will email you. If it touches something you consented to, I will ask for consent again rather than assume the old one still holds.