Privacy Policy

Effective date: May 26, 2026 · Version 2.0

Plain English summary: We sell printable children's products. We don't sell your data. We collect only what's needed to process orders and improve our content. You can request deletion of your data anytime by emailing support@storyteller-mari.com.

1. Who we are

Storyteller Mari ("we", "our", "us") is operated by Luan Rodrigues. We publish digital printable products for children and parents. Our website is storyteller-mari.com and our products are sold via Gumroad, Inc.

Contact: support@storyteller-mari.com

2. Information we collect

2.1 Information you provide

Email address — when you purchase a product or subscribe to our newsletter
Billing details — collected and stored by Gumroad (our payment processor); we never see your card number
Support messages — content of emails you send us

2.2 Information collected automatically

Cookies and similar technologies — see Section 6
Analytics data — anonymized pageviews, device type, country (via Google Analytics 4)
Pinterest pixel — anonymous conversion events used to measure ad effectiveness; no personal identifiers attached

2.3 Information from third parties

Pinterest, TikTok, Instagram, YouTube — aggregated, anonymized analytics about how our content performs on those platforms. We do not receive individual user profiles.
Gumroad — purchase confirmation, customer email, order metadata

3. Pinterest API data — specific disclosures

We integrate with the Pinterest API to schedule and publish pins, analyze the performance of our own pins and boards, and (with explicit user opt-in) help parents discover our content. In doing so:

We only access data from Pinterest accounts that have explicitly authorized us via OAuth 2.0 (in practice, only our own business account).
We do not collect Pinterest user data of people who simply view our pins.
We store OAuth tokens encrypted at rest and rotate refresh tokens per Pinterest API guidelines.
We delete Pinterest-derived data within 30 days of an authorization being revoked, or upon written request to support@storyteller-mari.com.
We never sell, share, or transfer Pinterest-derived data to third parties.
Our use of information received from Pinterest APIs adheres to Pinterest's Developer Policy.

4. How we use information

Purpose	Legal basis (GDPR)
Deliver the product you purchased	Contract
Send order confirmation emails	Contract
Newsletter (only if you opt in)	Consent
Improve our products and site	Legitimate interest
Comply with tax, accounting, fraud laws	Legal obligation
Measure ad and content performance	Legitimate interest / Consent

5. Children's privacy (COPPA / GDPR-K)

Although our products are designed for children, the website and purchasing experience are intended for adults (parents, caregivers, teachers). We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such data, please contact us at support@storyteller-mari.com and we will delete it within 7 days.

6. Cookies and tracking

We use a small set of cookies. The list below is exhaustive:

Cookie	Set by	Purpose	Duration
_ga, _gid	Google Analytics	Anonymous traffic analytics	2 years / 24h
_pin_unauth	Pinterest	Anonymous conversion attribution	1 year
_gumroad_*	Gumroad	Cart state during checkout	Session

You can opt out of analytics by enabling "Do Not Track" or using a browser extension like Ghostery / uBlock Origin. Pinterest tag opt-out: Pinterest tag controls.

7. Sharing and disclosure

We share personal data only with the following service providers, each under a data processing agreement:

Gumroad, Inc. — payment processing and product delivery (privacy policy)
Google LLC — analytics (privacy policy)
Vercel Inc. — website hosting (privacy policy)
Pinterest, Inc. — ad measurement (privacy policy)

We never sell personal data. We do not share email lists with third-party advertisers.

8. Data retention

Order records: 7 years (legal/tax requirement)
Newsletter subscribers: until you unsubscribe
Pinterest OAuth tokens: deleted within 30 days of revocation
Support emails: 2 years from last reply
Analytics data: anonymized after 14 months (GA4 default)

9. Your rights

Depending on your jurisdiction (GDPR, UK GDPR, CCPA/CPRA, LGPD-Brazil), you have the right to:

Access your personal data
Correct inaccurate data
Delete your data ("right to be forgotten")
Restrict or object to processing
Data portability (receive your data in a portable format)
Withdraw consent at any time
Opt out of the "sale" or "sharing" of personal data (we don't sell, but the CCPA right applies)
Lodge a complaint with your local data protection authority

To exercise any right, email support@storyteller-mari.com with the subject line "Privacy Request" and we will respond within 30 days (often within 7).

10. International data transfers

We operate from Brazil and use service providers in the US and EU. Where data is transferred outside the EEA / UK, we rely on the European Commission's Standard Contractual Clauses (SCCs) or equivalent. You can request a copy of these clauses by contacting us.

11. Data security

We take reasonable technical and organizational measures: TLS encryption in transit, encrypted secrets at rest, principle-of-least-privilege access, regular security review. No method is 100% secure; if a breach affects you, we will notify you within 72 hours per GDPR Article 33 / 34.

12. Changes to this policy

We will update this page when material changes occur. The "Effective date" at the top reflects the most recent revision. Significant changes will be announced via email to subscribers and a banner on the homepage for at least 14 days.

13. Contact

Questions, requests, complaints? Email support@storyteller-mari.com — we read every message.