Privacy Policy
Effective October 2026
Look within. Within is the fountain of good.
Marcus Aurelius, Meditations VII.59, trans. George Long
Ash & Iron makes planners, journals and tools for people who take their inner life seriously. We hold the information you share with us to the same standard. We collect only what we need to deliver your order and answer your questions, we never sell it, and we keep it no longer than we must.
This policy explains what happens to your information when you visit ashiron.co, buy from our shop, download a free product or contact us. It is written to meet privacy laws in Canada, the United States, the European Union, the United Kingdom and other countries where our customers live. The Rise app has its own policy at ashiron.co/rise-privacy.
Our promise
- Only what we need. We ask for the details required to sell and deliver your order, and nothing more.
- Never sold. We do not sell or rent personal information, and we do not share it for targeted advertising.
- Secure payments. Card details go straight to our payment processor. We never see or store your full card number.
- Your choice. Marketing emails are only sent if you opt in, and every one has an unsubscribe link.
- Your rights, everywhere. You can ask to see, correct or delete your information wherever you live.
Who we are
This shop is run by Ash & Iron Publishing (“Ash & Iron”, “we”, “us”). We are responsible for your personal information, known in some laws as the controller. Our Privacy Officer is accountable for this policy and can be reached at privacy@ashiron.co. For orders and general questions, write to inquiry@ashiron.co or use our contact page.
What we collect and why
| What | Examples | Why we use it | Legal basis (GDPR and UK GDPR) |
|---|---|---|---|
| Order details | Name, email, billing address, products bought, order number | To process your order, deliver downloads, send receipts and keep tax records | Performing our contract with you; legal obligation |
| Account details | Email, password (stored encrypted), saved addresses, order history | To let you sign in and download your purchases again | Performing our contract with you |
| Payment information | Card type and last four digits, payment status | To confirm payment and handle refunds and fraud checks | Performing our contract with you; legitimate interests |
| Messages | Your name, email and what you write to us | To answer you and resolve problems | Legitimate interests; steps you ask us to take |
| Marketing preferences | Your email and whether you opted in | To send news and offers you asked for | Consent, which you can withdraw at any time |
| Technical data | IP address, browser type, pages visited, cookies | To keep the site working and secure, hold your bag between pages, and prevent fraud | Legitimate interests; consent where required |
We do not knowingly collect sensitive information such as health details, and we do not make automated decisions about you that have legal or similar effects.
Payments
Payments are processed by Stripe and by WooPayments (operated by Automattic with Stripe). They receive your card details directly and process them under their own privacy policies and the PCI DSS security standard. We receive only a confirmation of payment and limited card details, such as the last four digits.
Downloads
Digital products are delivered through secure download links tied to your order. Download files are stored in a protected folder and cannot be reached without a valid purchase. We record when a link is used so we can help if a download fails and to prevent abuse.
Emails
We send emails that are needed for your order, such as receipts, download links and replies to your questions. We send marketing emails, such as new releases and offers, only if you choose to receive them. In Canada, this follows Canada’s Anti Spam Legislation (CASL). You can unsubscribe at any time using the link in any email, or by writing to us.
Cookies
Our site uses a small number of cookies:
- Essential cookies keep your bag, checkout and account working, and help protect against fraud. The site cannot work without them.
- Payment cookies set by Stripe help detect fraudulent payments.
- No tracking cookies. We do not use analytics or advertising cookies. If that ever changes, we will ask for your consent first where the law requires it.
You can block or delete cookies in your browser settings, though the shop may not work properly without essential cookies.
Who we share information with
We share personal information only with service providers who help us run the shop, and only as much as they need:
- Hosting: Hostinger, which hosts our website and its data.
- Payments: Stripe and WooPayments, as described above.
- Email: our email provider, to send and receive messages.
- Store platform: WooCommerce, the shop software, which runs on our own website.
- Google: if you find us through Google Shopping, Google processes that visit under its own privacy policy.
Each provider is bound to protect your information and use it only for the service they provide. We may also disclose information when the law requires it, for example in response to a valid court order, or to protect our rights and our customers against fraud. If Ash & Iron is ever sold or reorganized, your information would pass to the new owner under the protections of this policy.
We do not sell personal information, and we have not done so in the past twelve months. We do not share it for cross context behavioural advertising.
Marketplaces
If you buy Ash & Iron products on Etsy, Gumroad, Payhip or another marketplace, that marketplace collects and processes your information under its own privacy policy. We receive only what we need to fulfil your order.
Where information is stored
Our website and service providers may store information in Canada, the United States and other countries. When personal information from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on recognized safeguards such as the European Commission’s Standard Contractual Clauses. Information stored outside your province or country may be subject to the laws of that place.
How long we keep it
| Information | How long |
|---|---|
| Orders and invoices | Seven years, for tax and accounting law |
| Customer accounts | Until you ask us to delete the account, or after three years without activity |
| Messages to us | Up to 24 months after your question is resolved |
| Marketing consent | Until you unsubscribe, plus proof of your consent and its withdrawal |
| Abandoned bags and technical logs | Up to 90 days |
After these periods, information is deleted or anonymized.
How we protect it
The site uses encrypted connections (HTTPS) throughout. Account passwords are stored encrypted. Access to customer information is limited to the people who need it, and our systems are kept up to date and backed up. No method of transmission or storage is perfectly secure, but we work to protect your information and will notify you and the relevant authorities of any breach that affects you, as the law requires.
Your rights
Wherever you live, you can ask us what personal information we hold about you, ask us to correct or delete it, and withdraw your consent to marketing. Write to privacy@ashiron.co. We will reply within 30 days, or sooner where the law requires, and we will not charge you or treat you differently for using your rights. We may ask for information to confirm a request is yours. Some information, such as invoices, must be kept for legal reasons even after a deletion request.
Canada. Under the Personal Information Protection and Electronic Documents Act, Quebec’s Act respecting the protection of personal information in the private sector and similar provincial laws, you can access and correct your personal information and withdraw consent. If you are not satisfied with our answer, you may contact the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information.
United States. Residents of California and other states with consumer privacy laws have the right to know what personal information we collect, use and disclose; to access, correct and delete it; and to opt out of its sale, sharing or use for targeted advertising. We do not sell or share personal information or use it for targeted advertising. We do not use or disclose sensitive personal information. If we decline a request, you may appeal by replying to our decision, and if you remain unsatisfied, contact your state attorney general. We honour Global Privacy Control signals as an opt out request.
European Union, United Kingdom and Switzerland. Under the GDPR, the UK GDPR and the Swiss Federal Act on Data Protection, you have the right to access, rectify and erase your personal data, to restrict or object to its processing, to data portability, and to withdraw consent at any time. You also have the right to complain to the data protection authority where you live or work.
Elsewhere. Residents of Brazil, Australia, Japan, South Korea, India and other countries with privacy laws have similar rights, and we honour them in the same way.
Children
Our shop is not directed at children under 13, or under 16 in the European Union, and we do not knowingly collect their personal information. If you believe a child has given us personal information, contact us and we will delete it.
Changes to this policy
If we change this policy, we will update this page and the date at the top. If a change materially affects how we use your information, we will tell customers by email or on the site before it takes effect.
Contact us
Questions, requests or concerns about privacy are welcome. Write to our Privacy Officer at privacy@ashiron.co, email inquiry@ashiron.co for anything else, or use our contact page. We reply within two business days.
Ash & Iron. Character is forged daily.