Privacy Policy

Last updated: 2026-09-23 · Effective immediately

1. Who we are

StitchKit is operated by MavenWright Studio ("we", "us"), based in Istanbul, Türkiye. We are the data controller for personal data processed via mavenwright.com and the StitchKit applications. Contact: [email protected].

2. What we collect

We aim to collect the minimum data needed to provide and improve the service.

  • Account data (when you create an account): email, name, password hash, billing country.
  • Billing data: payment is processed by Polar Software Inc. (our merchant of record); we receive only the last 4 digits and expiry for receipts.
  • Usage analytics (anonymous): page views, referrer, country, device class via Plausible (no cookies, no cross-site tracking).
  • Product-improvement analytics (see section 7, which says how to turn it off): Google Firebase Analytics logs page views and product events (e.g. which pricing tier you clicked, which installer arch you downloaded), and Microsoft Clarity records how pages are used, with what you type into forms masked. Used to improve the product.
  • Advertising measurement (see section 7, which says how to turn it off): Google Ads and the Meta Pixel record whether an ad led to a visit, a sign-up or a purchase.
  • Support communications: emails to us, Chatwoot chat transcripts.
  • Application telemetry (opt-in only): crash reports and feature usage counts.

We do not collect: your embroidery designs, client lists, stitch patterns, or any creative content. The StitchKit desktop app is local-first.

3. Third-party data processors

  • Polar Software Inc. (USA) — merchant of record (payment, invoicing, tax compliance) via Stripe + Adyen rails.
  • Plausible Insights OÜ (Estonia) — privacy-friendly analytics.
  • Google LLC (USA) — Firebase / Google Analytics product analytics and Google Ads conversion measurement (see section 7).
  • Meta Platforms, Inc. (USA) — Meta Pixel ad measurement (see section 7).
  • Microsoft Corporation (USA) — Microsoft Clarity usage analytics (see section 7).
  • Cloudflare, Inc. (USA) — CDN, DDoS protection.
  • Resend (USA) — transactional email.
  • Chatwoot (self-hosted) — live chat support.
  • Hostinger — application hosting.

International transfers use EU Standard Contractual Clauses where applicable.

4. Legal basis (GDPR Art. 6 / KVKK Art. 5)

  • Contract performance — account, billing, license.
  • Legitimate interest — fraud prevention, security, basic analytics.
  • Consent — opt-in telemetry, marketing emails.
  • Legal obligation — tax records.

5. Your rights

Under GDPR (EU/EEA users) and KVKK Art. 11 (Türkiye users):

  • Access your personal data
  • Correct inaccurate data
  • Erase your data ("right to be forgotten")
  • Restrict or object to processing
  • Data portability (machine-readable export)
  • Withdraw consent at any time
  • Lodge a complaint with your national data protection authority (in Türkiye: KVK Kurumu)

Email [email protected]. We respond within 30 days.

6. Data retention

  • Account data: while account active; deleted within 90 days of closure.
  • Billing records: 10 years (Turkish tax law).
  • Support communications: 24 months from last interaction.
  • Anonymous analytics: aggregated indefinitely; raw logs purged after 30 days.

7. Cookies and your choices

Wherever you are visiting from, the analytics and marketing tools below start when a page opens; we do not show a cookie banner first. Plausible, which sets no cookies, always runs.

You can turn analytics and marketing off, separately, at any time with "Cookie preferences" at the bottom of every page. Turning a tool off reloads the page so that it stops, and your choice is kept.

  • Strictly necessary: mw_consent (your choice, kept 180 days); language preference; the sign-in session of a StitchKit account; cf_ready on the Coeffy pages (one day); cf_buy only after you start a purchase on the website (a random one-time code that lets only that browser see the purchase and set the new account's password, one day).
  • Always on, no cookies: Plausible visit statistics.
  • Analytics: Google Analytics through Firebase (_ga cookies) and Microsoft Clarity, which records how pages are used with what you type into forms masked (_clck, _clsk).
  • Marketing: Google Ads conversion measurement (_gcl_au) and the Meta Pixel (_fbp); on the Coeffy pages, cf_click keeps the Google Ads click identifier from the ad link (gclid, gbraid or wbraid) for 90 days. It is not written, and one kept earlier is no longer used, after you turn marketing off.
  • Functional: Chatwoot chat session, only after you open the chat.

When you sign up for Coeffy or buy a Coeffy plan, the click identifier is kept with your account or order for 90 days. When an order is a first payment, we send Google Ads the click identifier if there is one, the order amount and currency, the time of the order and a SHA-256 hash of your email address, never the address itself or your payment details.

8. Security

TLS 1.3 for all traffic, encrypted backups, least-privilege access controls, periodic review. Reportable breaches disclosed within 72 hours per GDPR Art. 33 / KVKK Art. 12.

9. Changes to this policy

Material changes notified via email and in-app banner. Continued use after notice constitutes acceptance.

10. Contact

Privacy: [email protected]
General: [email protected]

MavenWright Studio · Istanbul, Türkiye