Privacy Policy

1. Who is responsible

The data controller for the personal data described here is:

Controller

Ondřej Medek, sole trader registered in the Czech Republic, trading as Shipped By Alex

Business ID (IČO)

30096481

Registered address

Děčínská 552/1, Střížkov, 180 00 Praha 8, Czech Republic

Privacy contact

[email protected]

When you buy, Paddle (see section 2) is also a controller of the data it collects at checkout, under its own Privacy Policy.

2. What we collect, and why

If you ask for the free Blueprint

Your email address. It goes to Kit (formerly ConvertKit), our email provider, which sends you the Blueprint and, afterwards, occasional emails about the products and the method.

Legal basis: your consent, given by submitting the form. Every email has a one-click unsubscribe, and unsubscribing is instant.

If you buy a kit

Our order process is conducted by our online reseller Paddle.com. Paddle.com is the Merchant of Record for all our orders. Checkout runs in Paddle’s secure window: Paddle collects your email address, country, postcode where needed, and payment details, and uses them to take the payment, calculate tax, prevent fraud and send your receipt and invoice. Card numbers never reach this site.

From Paddle we receive, and keep, the order record we need to deliver your files, handle refunds and keep our accounts: your email address, your country, the product, the amount, the date and the order reference. We see these in Paddle’s dashboard; they are not stored on this website.

Legal basis: performance of the contract with you, plus our legal obligation to keep sales and accounting records.

When your download links are issued

Straight after checkout, the confirmation page sends Paddle’s order reference to our server, which asks Paddle to confirm the order is paid before issuing your links. To make links expire and count downloads, we store a small record in Netlify Blobs: which files, the expiry time, a download counter and the order reference.

If you email us

We keep your message and our reply for as long as we need them to help you, and longer where it concerns a refund or a legal request, so there is a record of what was agreed.

Legal basis: our legitimate interest in answering you, or the contract, where it is about an order.

If you claim the 30-Day Ship-It Guarantee

We receive what you send with the claim: your order reference, your written account, and the screenshots, links and exports the Refund Policy asks for. We use them to decide the claim, to defend that decision if it is disputed, and to fix the kit where it is clear what broke.

Please hide other people’s personal data (your users’, subscribers’ or testers’ names, email addresses, usernames and profile pictures) before you send anything. If it arrives visible, we delete it and ask you to resend it hidden.

Legal basis: the contract, since the guarantee is part of it, and our legitimate interest in establishing and defending legal claims.

When you simply visit

Our host, Netlify, records standard server logs (IP address, timestamp, page requested, browser user-agent) for security and to keep the site up.

Legal basis: our legitimate interest in running a site that works and is not being attacked.

Analytics

No analytics or measurement script is currently running on this site. If that changes, this section and the date at the top of the page change with it.

3. Cookies

This site sets no advertising cookies and no cross-site trackers. There is no Meta pixel, no Google Ads tag, no retargeting of any kind.

• Paddle loads its checkout script on pages with a buy button and sets cookies and similar technologies in its checkout, including for fraud prevention. Those are strictly necessary for taking a payment safely.
• Kit sets no cookie here. The signup form sends your address straight to Kit without loading any Kit script on this site.
• No analytics cookie is set, because no analytics is running.

4. Who else sees your data

Only the providers we need to run the business:

Paddle (Paddle.com Market Limited and its group companies)

Merchant of Record: checkout, payment, tax, invoicing, refunds and fraud prevention. An independent controller of checkout data under its own privacy policy.

Kit (ConvertKit)

Email list and delivery of the free Blueprint. Acts on our instructions.

Netlify

Hosting, server logs, and the download-link store. Acts on our instructions.

Our email provider

Hosts the mailbox your messages to us arrive in.

Paddle is based in the United Kingdom, which the EU recognises as giving adequate protection. Some of the other providers are based in the United States, so your data may be transferred outside the EEA. Those transfers rely on the providers’ Standard Contractual Clauses and, where applicable, their certification under the EU–US Data Privacy Framework.

We never sell your data, rent it, or hand it to advertisers or data brokers. We would disclose it only where the law compelled us to.

5. How long we keep it

• Newsletter subscribers: until you unsubscribe, then removed from the active list; a suppression record is kept so we cannot accidentally re-add you.
• Order records: for as long as Czech tax and accounting law requires, typically several years after the end of the year of the sale.
• Download-link records: they hold no name and no email address, only Paddle’s order reference for a paid order. The links stop working after 24 hours.
• Emails with us: as long as needed to deal with your request, and for orders and refunds as long as the order record.
• Guarantee claims and their evidence: as long as the order record, so a decision can be explained or defended later. Anything that arrives with other people’s personal data visible is deleted straight away.
• Server logs: kept short-term by Netlify under its own retention policy.

6. Your rights

Wherever you live, you can ask us to show you what we hold, correct it, or delete it. Under the GDPR (EEA) and UK GDPR you also have the right to:

• Access a copy of your personal data, and have it ported to another provider.
• Have inaccurate data rectified, or data we no longer need erased.
• Restrict or object to processing based on legitimate interest.
• Withdraw consent for marketing at any time. This does not affect anything sent before you withdrew it.
• Complain to a data protection authority. Ours is the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz); you can also go to the authority where you live. We would rather you told us first, but it is your right either way.

Email [email protected] and we will respond within one month. We may ask one question to confirm the request really comes from you. There is no charge. For data Paddle holds as controller, you can also contact Paddle directly.

An order record we are legally required to keep for tax cannot be erased on request until that retention period ends. Everything else can.

7. Children

These products are sold to adults building businesses. The site is not directed at anyone under 16, and we do not knowingly collect their data. If you believe a child has given us theirs, email us and it will be deleted.

8. Security

The site is served over HTTPS only, with HSTS. Product files sit outside the public web root and can be fetched only through a signed, expiring link that is issued after Paddle confirms the order. The site stores no buyer email addresses, no card numbers and no passwords. No system is perfect, but there is very little here to take.

9. Changes

If this policy changes materially we update the date at the top of the page, and tell subscribers by email before the change takes effect.

10. Contact

Any privacy question, request or complaint: [email protected].