Last updated: 9 August 2026
This policy explains what personal information heartspace.com collects, why, and what you can do about it. We keep it short and specific rather than long and vague.
Who is responsible. Heartspace, 925 McEntire Rd, Tryon, North Carolina 28782, United States. Contact: don@heartspace.com.
1. What we collect
When you place an order, we collect what is needed to complete the sale: your name, billing address, shipping address, email address, and phone number if you give one. We also record what you bought, the amount, and the order date.
We do not collect or store your card details. Payment is handled by PayPal. Your card number never reaches our server. We receive only confirmation that payment succeeded, plus the email address associated with the transaction.
When you create an account, we store your username, email address, hashed password and saved addresses.
When you simply visit, our server and security software log your IP address, browser type and the pages you request. This is ordinary web-server logging, used to keep the site running and to block attacks.
If you contact us, we keep your message and email address so we can reply and refer back to it.
2. Why we use it
- To fulfil your order — process payment, ship your book, deliver your download, and send order emails. Without this we cannot sell to you.
- To provide customer service — answer questions, handle returns and refunds.
- To meet legal obligations — keep records of sales for tax and accounting.
- To keep the site secure — detect and block abuse and fraud.
We do not send marketing email unless you have asked us to, and there is no newsletter sign-up on this site at present.
3. Legal basis (for visitors in the UK, EU and similar jurisdictions)
We rely on performance of a contract to process your order, legal obligation for tax and accounting records, and legitimate interests for site security and fraud prevention. Where we rely on consent, you can withdraw it at any time.
4. Who we share it with
We share the minimum necessary with:
| Who | Why | Where |
|---|---|---|
| PayPal | To take payment. They act as their own data controller. | See PayPal’s own privacy policy |
| SiteGround | Web hosting. Your data sits on their servers. | United States |
| Shipping carriers | Your name and address, to deliver a physical book. | Varies |
We do not sell your personal information. We do not share it with advertisers or data brokers. We may disclose information where the law requires it.
5. Cookies
We use only what the store needs to work:
- Cart and session cookies set by WooCommerce, so your basket survives page loads and you can check out.
- Login cookies if you have an account, so you stay signed in.
- Security cookies set by our security plugin to detect abusive traffic.
We do not use advertising cookies, tracking pixels or third-party analytics that profile you across other sites. You can block cookies in your browser, but the cart and checkout will stop working.
6. How long we keep it
- Order records — seven years, to satisfy tax and accounting requirements.
- Account details — until you ask us to delete the account.
- Support emails — up to two years.
- Server and security logs — around 30 days.
7. Your rights
Wherever you live, you can ask us to:
- tell you what personal information we hold about you
- correct anything inaccurate
- delete it, where we are not legally required to keep it
- send you a copy in a portable format
- stop using it for a particular purpose
If you are in the EU or UK, these are your rights under the GDPR, and you may also complain to your national data protection authority.
If you are a California resident, you have the right to know what we collect, to request deletion, and not to be discriminated against for exercising those rights. We do not sell personal information as defined by the CCPA.
To exercise any of these, email don@heartspace.com. We will respond within 30 days. We may need to confirm your identity first — usually by checking that the request comes from the email address on the order.
8. International transfers
We are based in the United States, our hosting is in the United States, and we ship to United States addresses only. Your information is stored in the US. If you contact us from outside the US, your message will be transferred to and stored in the US, which may have different data protection laws than your own country.
9. Children
This site is not intended for children under 16, and we do not knowingly collect their information. If you believe a child has given us personal information, contact us and we will delete it.
10. Security
The site runs over HTTPS. Payment is handled entirely by PayPal. Purchased files are stored in a protected directory that cannot be reached by direct URL and are served only after a purchase is verified. Access to the store’s admin area is restricted and password-protected.
No system is perfectly secure, but we take reasonable measures appropriate to a small independent store.
11. Changes
If we change this policy we will update the date at the top. Material changes will be noted on this page.
12. Contact
Heartspace
925 McEntire Rd
Tryon, NC 28782
United States