Privacy & cookies

Last updated 16 September 2026

This notice explains what personal data Dayframe Planners collects, why, and the rights you have under the GDPR and similar laws.

Controller

• Seller: Lizanne Turner, trading as Pennyleaf Studios
• Address: CAlle Azor 10C, 28229, Villanueva del Pardillo, Madrid, Spain
• Country of establishment: Spain
• NIF: Y7609957F
• Email: hello@dayframeplanners.com

What we collect and why

• Orders: your name, email address, billing country (and billing address when tax requires it), the products bought, amounts and payment references. Used to deliver your files, send receipts, provide support and meet tax and accounting duties. Legal basis: performance of a contract and legal obligation.
• Payments: handled by Stripe. With your purchase Stripe securely saves your payment method so that a one-click offer on the confirmation page can be charged only if you accept it. We never receive your full card details. Legal basis: performance of a contract.
• Downloads: the time of each download and a one-way hashed (not reversible) form of your IP address, to prevent abuse of download links. Legal basis: legitimate interest in protecting our products.
• Affiliate program: name, email, PayPal email, promotion channels and the commissions you earn. Clicks on affiliate links are stored with a hashed IP address and the browser user agent — never the raw IP. Legal basis: performance of the affiliate agreement and legitimate interest in fraud prevention.
• Email sign-ups: when you request a free download or a “get notified” reminder we store your email address, what you asked for, the wording you agreed to, the time and a hashed IP address. We first send a confirmation link (double opt-in). You get marketing emails only if you ticked that box, and every one has a one-click unsubscribe. When you unsubscribe, a one-way hash of your address goes on a suppression list so you are never emailed again by mistake. Legal basis: your request (delivery) and your consent (marketing).
• Site statistics: page views and button clicks counted per product without cookies or personal identifiers. With your consent we also set a random visitor ID cookie to count unique visitors. Legal basis: legitimate interest (anonymous counts) and consent (visitor cookie).

Cookies

Essential cookies are always on because the site doesn’t work without them. Optional cookies are only set after you choose “Allow cookies” in the banner.

• sm_consent — essential — remembers your cookie choice (6 months).
• sm_cart — essential — remembers the items you put in your cart (30 days).
• sm_aff_session — essential — keeps affiliates signed in to their dashboard (30 days).
• sm_admin — essential — store administrator sign-in only (12 hours).
• sm_aff — optional — remembers which affiliate referred you so they can be credited (60 days).
• sm_utm — optional — remembers the campaign that brought you here (60 days).
• sm_vid — optional — random visitor ID for unique-visitor statistics (12 months).

To change your choice, clear this site’s cookies in your browser; the banner will appear again.

Who processes data for us

• Cloudflare, Inc. — hosting, content delivery and databases.
• Stripe — payment processing, fraud prevention and tax calculation.
• Resend — sending receipts, confirmation links and, if you opted in, marketing emails.
• PayPal — paying affiliate commissions.

Some of these providers process data outside the European Economic Area. Where they do, transfers rely on the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

How long we keep data

Order and invoice records are kept for as long as tax and accounting law requires (typically up to 6 years). Download and click logs are deleted or anonymised within 13 months. Affiliate records are kept while your account is active and afterwards for as long as tax rules require for paid commissions.

Your rights

You can ask for access to, correction, deletion, restriction or portability of your data, object to processing based on legitimate interests, and withdraw consent at any time. Email hello@dayframeplanners.com. You can also complain to a supervisory authority — for us that is the Agencia Española de Protección de Datos (AEPD, www.aepd.es) — or to the authority where you live.