Privacy policy

Studmark(“we”, “us”, or “our”) operates the storefront and the small set of pages and routes that hang off it. This policy explains what personal information we collect from you when you visit the storefront, join a waitlist, message us, or buy a kit — and what we do (and intentionally do not do) with that information.

It applies to the storefront only. The kit files themselves are built in Notion, spreadsheet, and PDF format and delivered through their own platforms; the third-party services that host or render them have their own privacy terms, which we link to in the section on Where your data lives.

The categories of information we collect depend on what you do on the storefront:

• Email capture — free-kit signups. When you submit your email on /free-kit to receive the free starter kit, we store the email address you provided along with the timestamp of signup. We use it to send you the sample kit file and to notify you when Studmark opens to the public; we hold it on the waitlist until you unsubscribe.
• Email capture — product waitlist.When you submit your email on a kit page (or anywhere a “Notify me” or “Join the waitlist” form appears in the storefront), we store the same email + signup timestamp and tag it with the kit you expressed interest in. We use it to notify you when that kit opens for purchase; we hold it on the waitlist until you unsubscribe.
• Contact-form messages. If you write us through the contact form on /help or any other contact surface, we store the name, email, and message you sent, plus the timestamp. We use it to read, triage, and reply to your message.
• Anonymous page views. Every storefront page load fires a single one-pixel beacon. The beacon captures the page path, the referrer (if any), a coarse user-agent class (desktop / mobile / bot family), and the timestamp of the visit. We aggregate these into a single page-view metric so we can see which storefront pages and kit listings get read. We do not place advertising cookies, we do not share these events with any ad network, and we do not fingerprint your device.
• City-level IP geolocation. The web server sees your IP address for the duration of each request, just like every site you visit on the open web. We keep only the city, region, and country derived from it (not the full address) and use the rollup to understand geographic demand so we know which markets to expand the catalog into. We do not store the raw IP address past the request.
• Payment transaction records (when Stripe opens). When the storefront begins taking payments, the order record we keep is: the kit purchased, the order total, the billing email, the billing name and address, the last four digits of the card, the card brand, and the merchant reference id from Polsia’s payment proxy. We never see or store full card details at any point — the card number, CVV, and full expiry live only with the payment processor.
• Transactional email.Order confirmations, free-kit delivery, waitlist notifications, contact-form replies, and privacy or refund requests are routed through Polsia’s email proxy. The proxy holds the message in transit; on our side we keep a copy of the rendered message in the order or support record it relates to.

We use the data above only for the narrow purposes that running the storefront and supporting your visit or purchase require:

• Send the kit or the launch note. Deliver the free kit file when you sign up for it, and notify you when a kit you expressed interest in opens for purchase.
• Provide support. Reply to messages you send us, replace broken files, and process a refund or exchange if the kit does not match its listing (see the refund policy).
• Improve the catalog. Aggregate which pages and kits get read, opened, and bought — at the city level, never at the individual level — so we know which kits to refresh, retire, or write next.
• Prevent abuse. Detect spam, fraudulent orders, and license violations, and protect the storefront from automated scraping.

We do not run our own servers, so a small set of trusted third parties hold specific pieces of the data above on our behalf. Each one has its own privacy terms:

• Payment processor (when Stripe opens).Card details, merchant reference ids, and the order line items pass through Polsia’s Stripe payment proxy to settle the charge. We receive only what we need to fulfill the order and to support the buyer.
• Kit hosting.The Notion-based kit is delivered to the buyer through a shared, read-only page; spreadsheet and PDF files are served from our object store. Notion’s and the object store’s privacy terms apply to the buyer-facing delivery.
• Email.Order confirmations, kit notifications, and our replies to messages you send us are routed through Polsia’s email proxy.
• Analytics endpoint.The one-pixel page-view beacon is received by Polsia’s analytics endpoint, which aggregates the events into the page-view metric we describe above.

We do not use advertising cookies and we do not run any cross-site tracking. The only browser-side storage the storefront sets is:

• Analytics visitor id.A single random UUID stored in your browser’s localStorage by the per-page-mount beacon so we can deduplicate repeat visits from the same browser inside a rolling window. It is not used to recognise you across other sites, and clearing your site data deletes it.
• Session cookie (if and when accounts land). When accounts and sign-in land, a single first-party session cookie will be set to keep you signed in. It contains no marketing data and is not shared with any third party.

You can clear the visitor id and any cookie at any time through your browser’s site data settings; clearing it does not delete the records we hold on our side, which are removed only if you ask us to delete them (see Rights you have over your data below).

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes. The narrow cases when we do share:

• Service providers. The payment processor, kit host, email proxy, and analytics endpoint listed above receive only the data they need to do their job.
• Legal. If compelled by a valid legal process, and only the data the process requires.
• Aggregated, de-identified reporting. We may share read or purchase counts in aggregate form with kit authors and creators.

Whatever the law in your home jurisdiction requires, the following are the baseline rights we honour for every visitor and buyer, written in the language of GDPR (for visitors in the EEA and UK) and CCPA (for visitors in California):

• Access. Request a copy of the personal data we hold about you.
• Correction. Ask us to fix anything that is inaccurate or outdated.
• Deletion. Ask us to delete your account, your waitlist or contact-form records, and the order records tied to your email, subject to the retention rules in the next section.
• Data portability. Receive the data you gave us in a portable, machine-readable format (for example, a JSON export of your order history).
• Opt out of marketing. Unsubscribe from any future launch or waitlist notification by replying to any email we send, or by sending a privacy request from /help. Unsubscribing from marketing never affects transactional emails tied to a kit you have bought or a message you have sent us.
• Non-discrimination. We will not deny service, charge a different price, or give you a lower-quality experience for exercising any of these rights.

To exercise any of these rights, send a note from the contact section below. We reply within 7 days and act on confirmed requests within 30 days.

We hold order records for at least the period required to satisfy tax, accounting, and consumer-rights obligations, and we may hold a smaller, de-identified record of past orders past that point so we can answer support questions about long-lived kits.

Waitlist and contact-form records are kept on the waitlist or in our support inbox until you unsubscribe, ask us to delete them, or they become inactive (24 months without a confirmed open or reply). If you ask us to delete your account or waitlist entry, we delete the personally identifiable record within 30 days, and the order records once the retention period above has elapsed.

Studmarkis a storefront aimed at teachers, schools, and adult self-directed learners. It is not directed at children under 13, and we do not knowingly collect information from them. If a kit is purchased on behalf of a classroom, the personal information we hold is the teacher's, not the student's.

When we change this policy, we update the “Last updated” date at the top and, for a clearly material change, send a note to active account holders before the change takes effect.