Privacy notice

1. Who is responsible for your information

Loop & Purl is the controller of the personal information described in this notice. Loop & Purl is a trading name of , a company registered in England and Wales with company number , registered office .

For any question about your personal information, email our email address.

2. What we collect

When you contact us (by the contact form or email): your name, email address, the topic and your message, plus any photos of your work you choose to attach.
When you enrol in the course: your name, email address, billing country, the course language you choose and the status of your subscription payments, which our payment provider shares with us, and any support emails you send. Your private course link is tied to your subscription, not to a password.
When you buy a pattern PDF: your name, email address, what you bought, when, the amount paid, and how many times (and when) your download link was used.
When you order a custom pattern: your name and email address, the item details you give us (type of item, knit or crochet, sizes, yarn weight, language, notes), the photos you upload, and a record that you agreed to our terms.
If you create an account: your name, email address, a scrambled (hashed) form of your password, when you confirmed your email address, and the purchases linked to it (see section 5).
Payments: your card or bank details are entered directly with our payment provider (). They never reach us. We receive confirmation of payment, your name and email, your billing country and the last digits of the card, as the provider makes available.
Technical information: like most websites, our hosting provider records basic technical details when you visit (such as your IP address, browser type and the pages requested) in server logs used for security and to keep the site running.

We don’t ask for any sensitive information, and we ask that you don’t send us any.

3. How we use your information, and our lawful bases

Data protection law (the UK GDPR and, for people in the EU, the EU GDPR) requires a lawful basis for each use of personal information. Ours are:

To deliver what you bought — giving you course access, sending pattern downloads, writing and emailing your custom pattern, answering your support questions, and handling cancellations and refunds. Lawful basis: performing our contract with you.
To answer questions before you buy. Lawful basis: our legitimate interest in replying to people who contact us, and steps you ask us to take before entering a contract.
To keep financial and tax records. Lawful basis: legal obligation.
To keep the website and our services secure, prevent fraud and handle disputes. Lawful basis: our legitimate interests in running a safe, lawful business.
Marketing: we don’t send marketing emails. If we ever offer a newsletter, we’ll only send it to people who have opted in. Lawful basis: consent, which you can withdraw at any time.

Where we rely on legitimate interests, we have considered your interests and rights and believe they are not overridden. We don’t sell your information, and we don’t use it for automated decisions that have legal or similarly significant effects on you.

4. Your uploaded photos

We use the photos you send for a custom pattern only to write your pattern and to answer questions about your order.
Your pattern is drafted automatically from your photos and order details using an AI service (Anthropic), then checked automatically for consistency. Your photos and details are sent to Anthropic only for this, and under its commercial terms it doesn’t use them to train its models.
We don’t publish them or use them in our marketing, and we don’t share them with anyone except the service providers that help us receive, store and work on your order (see section 6).
We delete your photos as soon as your pattern has been written (usually within minutes). If something goes wrong, they’re deleted within 7 days. You can ask us to delete them sooner at any time — just email us.
If you don’t buy the pattern, the preview, the pattern and your order details are deleted after 7 days. If you buy it, the PDF stays downloadable for 30 days and is then deleted from our server (the payment record is kept as described in section 8).
To stop misuse of free previews, we keep, for up to 2 days, a scrambled (hashed) form of your email address and internet (IP) address to count requests, and for 24 hours a fingerprint of each photo so the same photo can’t be resubmitted. These can’t be turned back into your photo or address.
Please don’t upload photos showing other people unless they’re happy for you to share them.

5. Your Loop & Purl account

An account is optional: you can buy everything without one. If you create one, here is what it involves.

What we keep: your name, email address, the date you confirmed it, and your password as a salted scrypt hash (we can’t read your password, and nobody at Loop & Purl will ever ask for it). For each signed-in device we keep the date it signed in and was last used, an expiry date, the browser name and the IP address, so you can log out everywhere and we can spot misuse. Emailed links (to confirm your address or reset your password) are stored only in scrambled form and stop working after 24 hours and one hour respectively.
Your library: we link your purchases (course, pattern PDFs and custom patterns, including previews you started) to your account and to your email address. Purchases made with your email address before you had an account appear once you’ve confirmed the address, so nobody can see your purchases just by typing in your email.
Sign in with Google (optional): if you choose “Continue with Google”, Google tells us only your name, email address, whether Google has verified that address, and a Google account ID (a number that identifies your Google account to us). We don’t receive your Google password, contacts or anything else, we never post anything, and we don’t keep any Google access token. You can disconnect Google in your account settings once you’ve set a password, and you can remove our access in your Google account at any time.
Why: to give you the account and library you asked for. Lawful basis: performing our contract with you. Security records (signed-in devices, failed login counts) are kept for our legitimate interest in keeping accounts safe.
Download or delete it yourself: in your account settings you can download your data as a file at any time, and delete your account. Deleting it removes your name, email address, password, Google connection and sign-ins straight away; we keep only an anonymised record of each payment (what was bought, when and for how much) because tax law requires it, and unpaid custom-pattern previews linked to you are removed from your library. Course links and PDFs you already have keep working.
How long: we keep an account while you have it. If you’d like us to delete it for you, just email us.

We use a small number of trusted service providers, who process personal information on our behalf and only on our instructions:

Payments: , which takes payments and manages course subscriptions. For some of its own legal duties (such as fraud prevention), it acts as a separate controller under its own privacy policy.
Email: Resend, which sends our emails (order confirmations, download links, course emails and the messages you send through our contact form), and Google (Gmail), which provides our email account.
Custom patterns: Anthropic, whose AI service drafts custom patterns from the photos and details you send (see section 4).
Sign-in with Google (only if you choose it): Google confirms who you are and shares the details listed in section 5.
Spam protection: Cloudflare Turnstile, which checks that the custom-pattern, sign-up and password-reset forms are sent by a person; it processes technical information about your browser and connection for that purpose only.
Website hosting: , which hosts this website and the server that handles orders, course access and forms.
Fonts: Google Fonts, which supplies the typefaces on this website (see section 11).
If we use another tool to deliver course materials or downloads, or to help us work on an order, its provider acts as our processor on the same basis.

We may also share information where the law requires it (for example with HMRC or a court), with our professional advisers, or with a buyer if our business is ever sold, in which case this notice would continue to protect your information.

7. International transfers

Some of our service providers store or process information outside the UK and the European Economic Area, for example in the United States. When that happens, we make sure the transfer is protected as data protection law requires — for example because the country is covered by UK or EU “adequacy” regulations (such as the UK–US data bridge or the EU–US Data Privacy Framework), or because the provider has signed standard contractual clauses approved for that purpose. You can ask us for details.

8. How long we keep it

Custom pattern photos: deleted as soon as your pattern is written, or within 7 days if something goes wrong, or sooner if you ask.
Custom pattern previews and order details you don’t buy: 7 days. Bought custom pattern PDFs: downloadable for 30 days, then deleted from our server.
Order, payment and refund records: as long as UK tax and company law requires — currently six years after the end of the financial year the transaction falls in.
Messages and support emails: up to two years after our last contact with you, so we can help with follow-up questions, unless you ask us to delete them sooner.
Your account: until you delete it (or ask us to). Signed-in devices are forgotten 30 days after they were last used, or when you log out; confirmation and reset links expire after 24 hours and one hour and are cleared within a week; failed-login counters within a day. Daily backups of the account database are kept for 7 days, so deleted details disappear from backups within a week.
Course enrolment details: while your subscription is active and for two years afterwards, so we can help you rejoin or answer questions; the payment records are kept as above.

9. Keeping it safe

We choose reputable providers, use secure (HTTPS) connections, protect our accounts, and limit access to your information to what is needed to serve you. No method of sending information over the internet is completely secure, but we take care to protect what you share with us and will tell you and the authorities if the law requires it after a breach.

10. Your rights

Under the UK GDPR and the EU GDPR you have the right to:

access the personal information we hold about you and get a copy;
have inaccurate information corrected (rectification);
have your information deleted (erasure), where we have no legal reason to keep it;
restrict how we use it in certain circumstances;
object to our use of it where we rely on legitimate interests;
receive information you gave us in a portable format and have it sent to another organisation (portability);
withdraw consent at any time, where we rely on consent.

To use any of these rights, email us. It’s free, and we’ll respond within one month. We may need to confirm your identity first.

If you’re unhappy with how we’ve handled your information, please tell us so we can put it right. You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113, or, if you live in the EU, to the data protection authority in your country.

11. Cookies and browser storage

We use only strictly necessary cookies, and no tracking cookies. We use no analytics, advertising or tracking tools, and no local storage. Because these cookies are essential for the site to work securely, they don’t need your consent:
- lp_csrf: a random security code that stops other websites from sending forms in your name (kept for up to a year);
- lp_sid: keeps you logged in if you have an account (set only when you log in; it lasts 30 days from your last visit and is removed when you log out);
- lp_oidc: only while you’re signing in with Google, for up to 10 minutes, to check the reply really belongs to your sign-in.
Google Fonts: to show our typefaces, your browser downloads them from Google’s servers, which means Google receives your IP address and basic browser information. Google says it doesn’t use Google Fonts requests to build profiles of visitors. See Google’s privacy policy.
Checkout pages: when you click a Buy, Pay or Enroll button you go to our payment provider’s checkout. That page is run by the provider and may use its own cookies, for example to prevent fraud; its own privacy and cookie policy applies there.
If we ever add cookies that aren’t strictly necessary, we’ll ask for your consent first and update this notice.

12. Children

Our products are intended for adults. If you’re under 18, please ask a parent or guardian to buy for you and to contact us on your behalf. We don’t knowingly collect personal information from children under 13; if you think we have, please tell us and we’ll delete it.

13. Changes to this notice

We may update this notice when our services or the law change. The date at the top shows when it was last updated. If we make a significant change that affects you, we’ll tell you by email.

14. Contact us

Email our email address with any question about this notice or your personal information. We aim to reply within 1–2 hours. Postal address: .