Privacy Policy

1. Who we are

Emerald Diary is operated from Ireland. We are the data controller for personal data collected through this website. Contact us at hello@emeralddiary.com.

2. Data we collect

We collect the following personal data:

• Parent/guardian: name, email address, delivery address, payment information (tokenised — stored by Stripe, not us)
• Child: first name and age only. No surname, no contact information, no direct interaction with the website.
• Usage data: We use Plausible Analytics — a privacy-first, cookie-free tool that collects anonymous page view data. No personal identifiers are tracked.

3. How we use your data

• To process and fulfil your subscription or gift purchase
• To personalise letters with your child's name
• To send transactional emails (receipts, dispatch notices, login links)
• To manage your account
• To improve our service (anonymous analytics only)

4. Third parties

We share data with the following trusted services only:

• Stripe — payment processing (PCI DSS Level 1 compliant, EU data processing)
• Resend — transactional email delivery (GDPR compliant)
• Plausible Analytics — privacy-first, cookie-free analytics (no personal data)

We do not sell, rent, or share your personal data with any other third parties.

5. Cookies

We use essential cookies only to keep the service running (session management, authentication). We do not use tracking cookies or advertising cookies.

Our analytics provider (Plausible) does not use cookies. No cookie consent is required for analytics under GDPR.

6. Children's data

We collect only a child's first name and age. This information is used solely to personalise letters. We do not allow children to create accounts or interact directly with this website. All purchases are made by adults aged 18 or over.

7. Data storage

All personal data is stored on servers located in the European Union. We take appropriate technical and organisational measures to protect your data.

8. Your rights (GDPR)

Under GDPR, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data ("right to be forgotten")
• Object to processing of your data
• Request a copy of your data in a portable format

To exercise any of these rights, email hello@emeralddiary.com. We will respond within 30 days.

9. Retention

We retain your personal data for as long as you have an active account. After cancellation, we retain data for 7 years for legal and accounting purposes, then delete it. You may request earlier deletion by contacting us.

10. Contact & complaints

For privacy questions, contact us at hello@emeralddiary.com. If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Data Protection Commission Ireland: dataprotection.ie.