This Privacy Notice explains how PlumberPDF ("PlumberPDF", "we", "us") collects, uses and protects information when you visit plumberpdf.com or purchase our digital products. PlumberPDF is the data controller for personal information processed through this website.
Seller identity
PlumberPDF, organization number 920844375, trading as PlumberPDF. Registered address: Bergen 5017, Norway. Contact: hello@plumberpdf.com.
Information we collect
- Contact details you submit voluntarily, such as name and email.
- Order information processed by our reseller and Merchant of Record, Paddle.com Market Limited ("Paddle").
- Basic technical data (device, browser, referrer) as required to operate the site.
- Purchase-recovery requests: the email address you submit and a short-lived opaque token (only its hash is stored).
How we use information
- To deliver purchased digital files and provide customer support.
- To respond to enquiries submitted through our contact form or email.
- To meet legal and accounting obligations.
Legal basis for processing
- Performance of a contract — to deliver the digital products you have purchased and provide support.
- Legitimate interests — to operate, secure and improve the site and prevent fraud.
- Legal obligation — to meet tax, accounting and other statutory duties.
- Consent — where you voluntarily provide information (e.g. contact enquiries).
Payment processing and Merchant of Record
Our order process is conducted by our online reseller Paddle.com Market Limited. Paddle is the Merchant of Record for all our orders. Paddle handles the checkout, payment processing, tax collection, invoicing, subscription management, customer service inquiries related to payments, and returns. Paddle acts as an independent data controller for payment data it collects; please refer to Paddle's Privacy Notice and Buyer Terms. We do not store full card details on our servers.
Data sharing
- Paddle, as Merchant of Record, for the sale of our products, payments, tax compliance, invoicing and refunds.
- Hosting and infrastructure providers strictly to operate the site and deliver files.
- Professional advisers (legal, accounting) where necessary.
- Public authorities where required by law.
Data retention
We retain contact enquiries for up to 24 months after the last interaction. Order and entitlement records are retained for up to 7 years to meet tax and accounting obligations. Website technical logs are retained for up to 90 days. When no longer needed, personal data is deleted or anonymised.
Cookies
We use one essential browser-session cookie, ppd_ck, set as Secure, HttpOnly, SameSite=Lax. Its sole purpose is to bind checkout and download authorization to the browser that started the purchase or the browser that verified a recovery link. It has a maximum lifetime of two hours and contains no marketing or advertising data. It cannot be used to track you across other websites. We do not currently use any marketing, advertising, or analytics cookies.
Optional analytics
With your explicit consent we use Google Analytics 4 (measurement ID G-STJ979FWMR) for aggregated website and conversion measurement — for example, page views, checkout starts and completed purchases. Google Analytics is optional and is activated only after you click "Accept analytics" in the cookie banner. Before that, no Google Analytics script is loaded and no analytics data leaves your browser.
Google advertising signals (ad_storage, ad_user_data, ad_personalization) remain denied at all times. We do not send names, email addresses, payment card details, Paddle checkout tokens, download links or recovery tokens to Google Analytics. Purchase events include only the aggregate product (SKU, price, currency) and the Paddle transaction ID, used solely to prevent duplicate attribution.
You can withdraw or change your choice at any time via the "Cookie settings" link in the site footer. Withdrawing consent stops future analytics events from being sent.
Purchase recovery
If you use the "Recover your purchase" flow, we send a one-time recovery link to your purchase email. Only a SHA-256 hash of the token is stored in our database; the raw token exists only in the email and in your browser's memory when you open the link. Recovery links expire after 15 minutes and become invalid on first use. Email delivery is handled by Lovable Cloud as a processor/subprocessor.
Security
We apply appropriate technical and organisational measures — including encryption in transit, access controls and least-privilege service accounts — to protect personal data.
Your rights
Depending on your location, you may have rights to access, correct, delete, restrict, object to or port your personal data, and to withdraw consent at any time. To exercise these rights, contact us via paddle.net for order-related matters, or use the contact details on this site. You may also lodge a complaint with your local data protection authority.
Contact
PlumberPDF. For payment, invoice and refund matters, contact Paddle at paddle.net.