Privacy Policy

1. Who is responsible for your data

larsen.studio, a sole proprietorship registered in Denmark, operates Yudane and is the data controller. To contact us about privacy, email [email protected].

2. What we collect and why

• Your email address — to create your account, deliver your purchase, and, only with your explicit consent, send new-auction alerts. Legal basis: performance of a contract and consent.
• A hashed form of your IP address — for anti-abuse and rate-limiting. We store a one-way SHA-256 hash, not your raw IP address. Legal basis: our legitimate interest in keeping the service secure.
• Purchase records — which Deep-Read you bought and when, linked to your account, as needed to provide the service and meet accounting obligations.

We do not collect or store card or payment-instrument data. Payments are handled entirely by Stripe; Yudane never sees your card details.

3. Who else processes your data

We share the minimum necessary with a small set of providers who process data on our behalf, or, in Stripe's case, as an independent controller for the payment:

• Stripe — payment processing and Merchant of Record. Stripe is the seller of record for your purchase and handles your payment data under its own privacy policy.
• Resend — delivery of transactional and newsletter email.
• Cloudflare — hosting, content delivery, and security.

4. Newsletter and consent

Auction alerts are double opt-in: we only ever email an address after you confirm it by clicking a link we send you. Every alert carries a one-click unsubscribe. You can withdraw consent at any time, and we stop.

5. How long we keep it

We keep your account and purchase records for as long as your account is active and for as long as accounting and tax rules require. Hashed IP addresses and rate-limit records are short-lived and used only for abuse prevention.

6. Your rights

Under the GDPR you have the right to access, correct, delete, restrict, and port your data, to object to processing, and to withdraw consent. To exercise any of these, email [email protected]. You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet).

7. International transfers

Some providers (for example Stripe and Cloudflare) may process data outside the EU/EEA. Where they do, they rely on appropriate safeguards, such as the European Commission's standard contractual clauses.

8. Changes and contact

The current version of this policy always lives at this address, with the date shown above. For any privacy question, email [email protected].