Last updated: 13 October 2026
This Privacy Policy explains how XStitchPattern (“we”, “us”) handles personal information when you browse www.xstitchpattern.com, contact us, subscribe to updates, or order digital cross-stitch products. If you have any questions, email mail@xstitchpattern.com.
1. Who is responsible for your information?
XStitchPattern is an independent personal craft project operated from Morocco, not a company incorporated under the XStitchPattern name. The individual operator is responsible for personal information handled for the site’s content, online store and customer support. For requests about personal information, contact mail@xstitchpattern.com. Postal contact address: 220 Qua Mesnana El ouarda Tanger, Tanger 90000, Morocco.
2. What information we collect
Depending on how you use the site, we may process your name, email address, billing details, purchased product details, order history, account credentials managed by WordPress/WooCommerce, contact messages, newsletter preferences, and information necessary to deliver digital downloads. Payment providers may process payment credentials directly; we do not ask customers to email payment card details.
We also receive technical information such as IP address, browser and device characteristics, pages requested, dates and times, cookie identifiers where permitted, and website security or error logs. If you submit photographs for a personalised design enquiry, we process the images and the instructions you give us to assess and respond to your request.
3. Why we use information and our legal bases
We use information to provide products and digital downloads, manage orders and customer accounts, respond to questions, maintain our site, prevent misuse, comply with accounting and tax requirements, and—where the required permission applies—send marketing messages or measure advertising performance.
- Contract: to process orders, deliver purchased PDFs, provide requested services and provide order support.
- Legal obligation: to keep records when required by applicable tax, accounting and consumer laws.
- Legitimate interests: to secure the site, prevent abuse, diagnose failures and respond to ordinary enquiries, subject to your rights.
- Consent: when required for optional analytics or advertising cookies, newsletters or other optional marketing. You may withdraw consent without affecting earlier lawful processing.
4. Checkout, payments and digital products
Our store runs on WooCommerce. We process order, billing and email information to administer purchases and make any available digital files accessible through order emails or customer accounts. Payment processing may involve WooPayments, PayPal or other payment options displayed at checkout, depending on what is active for your transaction. The selected provider processes the information needed to complete the payment under its own privacy notice. Do not send your full payment card number or security code to our support email.
5. Emails and newsletters
Transactional messages may be delivered through email infrastructure used by our store and its SMTP provider. If you separately opt in to a newsletter or marketing updates, we may use a marketing email service, including Klaviyo when enabled. You can unsubscribe from marketing emails using the link in the message or contact us. Order and account messages needed to fulfil a purchase may still be sent.
6. Cookies, analytics and advertising
WordPress and WooCommerce may use strictly necessary cookies for login, shopping carts, sessions, site security and preferences. The site may also use tools supplied by Google, including Google Site Kit, Analytics, Search Console, and Google advertising services, and integrations for Pinterest or other advertising/marketing channels where these services are enabled. These services may receive device information, identifiers and browsing or conversion events, depending on the active configuration and your choices.
Where applicable law requires it, non-essential analytics and advertising cookies should only be used after a valid choice through the site’s consent controls. Google advertising may use cookies or other identifiers to serve or measure ads if advertising is enabled. You can review Google’s explanations at How Google uses information for ads and control some Google advertising preferences at My Ad Center. Browser controls may also let you block or delete cookies, although doing so can affect login or checkout.
Important: the presence of this policy does not itself turn on a compliant consent banner or guarantee that optional cookies are blocked until consent; that requires a separate technical verification of the active integrations.
7. Service providers and disclosures
We share information only as needed for site hosting, WordPress/WooCommerce functionality, payments, email delivery, security, analytics, advertising integrations where enabled, and professional or legal compliance. Providers may include our hosting company, WooCommerce/Automattic services, payment processors, Google services, and our connected email and marketing providers. Their handling of personal information is subject to their own agreements and privacy notices.
We may also disclose information when required by law or where reasonably necessary to protect our rights and prevent fraud. We do not publish customer purchase details or use customer photographs in public marketing without an appropriate basis or permission.
8. International data transfers
Some service providers may process information outside your country, including outside the European Economic Area. Where GDPR applies and a restricted transfer occurs, the relevant transfer must be supported by an appropriate legal mechanism, such as an adequacy decision or standard contractual clauses, as applicable to the service provider and processing activity.
9. How long we keep information
We keep information for as long as necessary for the purpose for which it was collected, including order fulfilment, customer support, security and any statutory accounting or tax retention periods. Customer accounts may remain active until deleted or closed, subject to records we must lawfully retain. Newsletter records may be retained until you unsubscribe, and support enquiries are reviewed periodically for deletion when no longer needed.
10. Your data protection rights
Depending on the law that applies to you, you may have rights to access, rectify, erase, restrict processing, object, request portability and withdraw consent. To make a request, email mail@xstitchpattern.com; we may ask for information necessary to verify your identity. If you are in Spain or the EEA, you may also have the right to complain to your competent supervisory authority; in Spain this is the Agencia Española de Protección de Datos (AEPD).
11. Children’s privacy
Our website is for a general craft audience and is not intended to collect children’s personal information knowingly. If you believe a child has sent us information without an appropriate basis, contact us so that we can review the situation.
12. Security and external links
We use access controls and other reasonable technical and organisational measures to protect the website and customer information. No online service can guarantee absolute security. Our posts or product pages may link to third-party websites; their privacy policies apply when you visit them.
13. Updates to this policy
We may update this policy when our services, suppliers or legal requirements change. The date at the top shows the latest revision. For questions about this notice or data rights, contact mail@xstitchpattern.com.
English 
French 
Spanish 
German 
Arabic