Legal
Privacy Notice
Last updated 7 October 2026
On this page
1. Who we are
Everyday Arc Ltd, trading as Due Form Editions, is the controller of the personal information described in this notice. Our registered office is 66 Paul Street, London, England, EC2A 4NA, and our company number is 17064023.
For any privacy question or request, email support@dueformeditions.com, or use the form on our Support page and choose Your information.
2. What we do not collect
- Your Interactive entries and photographs. Everything you type or add in an Interactive Edition stays in your browser on your own device. It is never sent to us, and we cannot see it. Backup files you save are your own.
- Your PDF entries. What you write or type in a downloaded PDF stays with you.
- What you put into a free utility. The utility builders make your workbook in your browser. Your choices and entries are not sent to us.
- Your card details. Stripe takes your payment. We never see your card number.
- Your name and address. Stripe collects the details it needs for payment and tax. We do not receive your name or address from Stripe.
3. Information we use
| Information | Where it comes from | Why we use it | Lawful basis (UK GDPR) | How long we keep it |
|---|---|---|---|---|
| Orders: your email address, what you bought (edition, cover, price), the amount paid, Stripe’s payment references, the immediate-access words you ticked and when, any refund, and any change to your email address | Stripe and our checkout, when you buy | To supply your edition, confirm your order, handle refunds and problems, and keep accounts | Contract; legal obligation (tax and accounting records) | 6 years after the end of the financial year in which you bought |
| Checkout records: basket contents, prices, immediate-access wording shown and any Correspondence code. For a gift, the recipient’s email address and optional sender name. For an upgrade, the email address linked to the purchase. Other checkout records do not include an email address | Our checkout page | To charge the right amount and keep a record of what you agreed to | Contract | 30 days |
| Library entitlements: which editions, covers, versions and upgrades your email address can access, including editions received as gifts, when you bought, your first download while a cover change is still possible, and any cover change | Created from your order | To run your library, give you updates and the cover change | Contract | While we run the library, so you can keep downloading your editions. If you ask us to delete it, your library access ends, and the order record above is kept for the accounting period |
| Gift records: buyer’s email address, recipient’s email address, optional sender name, gift code, order reference and editions | The buyer at checkout | Add gifts to the recipient’s library, send gift emails and help with an email-address change | Contract with the buyer; legitimate interests in delivering the gift and supporting the recipient | While the gift is listed in the recipient’s library. If the recipient asks us to delete the record, gift access ends. Order records remain for the accounting period above. |
| Sign-in codes: your email address, the code (stored in a coded form we cannot read back) and when it was sent | You, when you ask for a code | To let you open your library without a password | Contract | Each code expires after 10 minutes; used and expired codes are deleted within 24 hours |
| Sign-out records: a coded form of your email address and the time you chose Sign out on all devices | You | To end your library sessions on every device | Contract | Deleted within 24 hours |
| Security limits: a coded form of your email address or internet (IP) address and a count of recent requests | Your browser | To prevent abuse of sign-in, checkout and forms | Legitimate interests (keeping the service secure) | Deleted within 24 hours |
| Due Form Correspondence: your email address, the words you agreed to, the page you joined from, and when you joined and confirmed | You, when you join | To send Due Form Correspondence | Consent | Unconfirmed addresses are deleted soon after the 7-day confirm link expires. Confirmed addresses are kept until you unsubscribe. When you unsubscribe, your address is deleted; we keep a coded record that it once joined, so a new-reader code is not issued twice |
| New-reader codes: the code, your email address, whether it was used and on which order | Created when you confirm, while the offer runs | To apply the 20% code once | Contract; legitimate interests (preventing misuse of the offer) | 30 days after the code’s last day |
| Edition sign-ups: your email address, the edition, the page you signed up on, the wording you agreed to and the date | You, when you ask to hear about an edition | To tell you once when that edition is ready | Consent | Deleted after we send that email, or two years after you signed up if the edition is not yet ready, or sooner if you ask |
| Utility requests and feedback: your message, its topic, the page or tool it came from, the date, and your email address if you choose to add one | You, when you send a request or feedback | To read and act on what you tell us, and reply if you asked us to | Legitimate interests (improving our tools and editions, and answering you) | 24 months |
| Support form messages: your email address, topic, order reference if given, and message | You, when you send the support form | To help you, and to send you a copy of your message | Contract; legitimate interests (resolving problems) | 24 months after you send it |
| Support emails: your messages and our replies in our mailbox | You, when you email us or reply | To help you and keep a record of what was agreed | Contract; legitimate interests (resolving problems and complaints) | 24 months after the matter is closed, or 6 years where it concerns a complaint, refund or dispute |
| Emails waiting to be sent again: a copy of an order, gift, refund or Correspondence email that failed to send, with your address | Our email system | To make sure the email reaches you | Contract; legitimate interests | Up to 7 days |
| Site analytics: page views counted without cookies (page, referring site, country, device type and browser), and which free utility or card was downloaded | Your browser | To see which pages are useful and fix problems | Legitimate interests (understanding how the site is used) | We cannot identify individual visitors. The visitor identifier is discarded after 24 hours. Checkout, order and library pages are not counted |
If you receive a gift, the buyer supplies your email address so we can add the gift to your library and send service emails about it. We do not add you to marketing lists. You can ask us to delete the gift record using the contact details in section 8. This ends access to the gift. If you already use the same email address for other purchases or subscriptions, those records are handled separately under this notice.
We do not sell personal information, use it for advertising, or make automated decisions about you that have legal or similarly significant effects.
We send marketing email only to people who have requested it and confirmed their email address, and every such email has an unsubscribe link. Order, refund, sign-in and support emails are part of supplying your edition or answering you, and are not marketing.
4. Stripe and Onelink
Onelink (Link, LLC), a Stripe company, is the seller of record for your payment (Terms of Sale, section 2). Stripe and Onelink collect your payment, billing and tax details and use them as an independent controller under their own privacy policy at onelink.com/privacy. Stripe passes your email address and the order details to us so we can supply your edition.
5. Who processes information for us
| Provider | What they do for us | Where information is stored |
|---|---|---|
| Google (Firebase) | Database for orders, entitlements, gift records, sign-in codes, security limits, Correspondence, sign-ups, feedback and support messages | London (United Kingdom). Edition files are stored in the United States and contain no personal information |
| Resend | Sends sign-in codes, order, gift and refund emails, copies of support messages, and Due Form Correspondence | United States |
| Vercel | Hosts the website, library and checkout, and provides cookie-free site analytics | United States and Vercel’s global network |
| Microsoft (Microsoft 365) | Our support@dueformeditions.com mailbox | Europe |
These providers process personal information for us under data-processing agreements.
We may also share information with our professional advisers, or with authorities where the law requires it.
6. Transfers outside the UK
Some providers process information in the United States. Where they do, the transfer is protected by the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge) where the provider is certified, or by the UK International Data Transfer Addendum to the EU standard contractual clauses. Email us for details of the safeguard for a particular provider.
7. Security
Access to our systems is limited to the people who run Due Form and protected by multi-factor authentication. Data is encrypted in transit and at rest. Sign-in codes are stored only in coded form. Download links work for 5 minutes.
8. Your rights
You have the right to:
- see the personal information we hold about you;
- have it corrected;
- have it deleted;
- restrict or object to how we use it;
- receive it in a portable format;
- withdraw consent at any time, where we rely on consent (for example Due Form Correspondence or an edition sign-up).
Email support@dueformeditions.com or use the Support form to use any of these rights. We may ask you to confirm your identity, usually by sending a code to the email address we hold. We reply within one month.
Some rights have limits. For example, we must keep order records for tax purposes even if you ask us to delete them.
To exercise rights over payment data held by Stripe and Onelink, use their privacy tools at onelink.com/privacy.
9. Complaints
If you are unhappy with how we handle your information, please tell us first at support@dueformeditions.com. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
10. Changes to this notice
We will update this notice when we change providers or how we use information, and change the date at the top of this section. If a change affects you significantly, we will tell you by email.
---
Everyday Arc Ltd · Company number 17064023 · Registered in England and Wales · 66 Paul Street, London, England, EC2A 4NA · support@dueformeditions.com