Privacy Policy

About This Policy

This Privacy Policy explains how Spacemance collects, uses, discloses, and protects your personal information when you visit spacemance.com or buy a Spacemance product.

It is written to comply with the European Union General Data Protection Regulation (GDPR), the United Kingdom GDPR, the Australian Privacy Act 1988 and Australian Privacy Principles, and the California Consumer Privacy Act as amended by the CPRA.

Where local privacy laws grant you additional rights, those rights apply in addition to this policy.

Who Is the Data Controller

Spacemance is operated by Integrate Your Marketing, PO Box 902, Paddington NSW 2021, Australia. Starbound Press is our publishing imprint.

For all privacy enquiries, including exercising the rights described below, contact us at hello@spacemance.com.

We have not appointed a Data Protection Officer because our processing does not meet the GDPR Art. 37 thresholds (we do not carry out large-scale systematic monitoring or large-scale processing of special category data).

Personal Information We Collect

We collect the following categories of personal information, only for the purposes described in the next section:

Category	What it includes	When we collect it
Order data	Name, email address, billing address, country, payment confirmation token, transaction reference	When you purchase a Spacemance product
Mailing list data	Email address, country (for tax and segmentation)	When you subscribe to our mailing list (if and when this is offered)
Customer support data	Name, email address, content of your message	When you contact us via hello@spacemance.com or the contact form
Server log data	IP address, browser type and version, referring URL, pages visited, request timestamp	Automatically, when you load any page on spacemance.com

We do not collect special-category data (Art. 9 GDPR / sensitive information under APP 3.3) and we do not knowingly collect personal information from anyone under 16 years of age. If you believe a child has provided personal information to us, contact hello@spacemance.com and we will delete it.

How We Use Your Personal Information

For each processing activity we identify the purpose and the lawful basis we rely on under GDPR Art. 6.

Processing activity	Purpose	Lawful basis (GDPR Art. 6)
Selling and delivering ebooks	Fulfil your order, send purchase confirmation, provide download access, respond to refund requests, comply with consumer law obligations	Performance of a contract (Art. 6(1)(b)); compliance with a legal obligation (Art. 6(1)(c)) for tax and consumer guarantees
Mailing list (when offered)	Send release announcements, bonus content, and behind the scenes updates about Spacemance titles	Your consent (Art. 6(1)(a)) — separate, granular, freely given
Replying to customer support	Answer your enquiry, resolve a complaint	Performance of a contract (Art. 6(1)(b)) for customers, or our legitimate interest in responding to enquiries (Art. 6(1)(f)) for non-customers
Operating the website	Deliver pages, prevent abuse and fraud, maintain security, monitor performance	Our legitimate interest in running a functional and secure website (Art. 6(1)(f))

Providing order data is required to enter into a purchase contract.

Subscribing to the mailing list is entirely optional and you can decline without affecting your ability to buy our products.

Withdrawing consent for marketing emails does not affect any processing carried out before you withdrew it.

We do not engage in profiling or automated decision-making within the meaning of GDPR Art. 22.

Cookies and Similar Storage

This website uses only strictly-necessary first-party storage. We do not load advertising cookies, social plugins, third-party analytics, or tracking pixels.

Specifically:

• The fonts used on this site are self-hosted from our origin server. They do not call out to Google Fonts or any other third-party CDN.
• The Lemon Squeezy checkout overlay script is not loaded on the marketing pages. It runs only on the Lemon Squeezy checkout page itself, after you click "Buy Ebook Direct" and Lemon Squeezy presents its own privacy notice.
• We do not currently load any analytics platform. If we add one in the future, it will be opt-in via a cookie consent banner.

Because we do not place non-essential cookies, no cookie consent banner is required under the ePrivacy Directive Art. 5(3).

Who Receives Your Personal Information

We share your personal information only with the following recipients, each of which is bound by a written data-processing agreement.

Recipient	Role	Country	What they receive	Why
Lemon Squeezy (Lemon Squeezy LLC)	Merchant of record and payment processor; data controller for the checkout transaction	United States	Order data	They process the purchase, charge the card, calculate and remit applicable taxes, send the receipt, and provide the download. Spacemance never receives your card number. See lemonsqueezy.com/privacy.
Vercel (Vercel Inc.)	Hosting and CDN provider; data processor	United States	Server log data	Delivers the website. See vercel.com/legal/privacy-policy.
[Email service provider — to be added when the mailing list goes live]	Marketing email delivery; data processor	TBC	Mailing list data	Sends release announcements you have subscribed to

We do not sell or rent personal information to anyone, and we do not share it with advertising networks or data brokers. CCPA "sale" and "sharing" status: we do not sell or share personal information.

International Data Transfers

Lemon Squeezy and Vercel are based in the United States. When you purchase a product or visit the site, the corresponding personal information is transferred from your country to the United States.

We rely on the following GDPR Art. 46 safeguards for these transfers:

• Lemon Squeezy — adequacy under the EU-US Data Privacy Framework (verify at the time of publication that Lemon Squeezy LLC is listed as an active participant at dataprivacyframework.gov).
• Vercel — adequacy under the EU-US Data Privacy Framework (Vercel Inc. is listed at dataprivacyframework.gov).

If either processor is not (or ceases to be) certified under the Data Privacy Framework, we will rely on the European Commission's Standard Contractual Clauses (Module 2 controller to processor, Decision 2021/914) together with a Transfer Impact Assessment.

UK transfers rely on the UK International Data Transfer Addendum to the SCCs.

Australian transfers rely on Australian Privacy Principle 8.1 and the contractual safeguards in our agreements with each recipient.

You may request a copy of the relevant SCCs or the equivalent transfer mechanism by emailing hello@spacemance.com.

How Long We Retain Personal Information

Data	Retention
Order data and transaction reference	7 years from the date of purchase, to satisfy taxation and consumer-law record-keeping obligations (Australian Tax Office record-keeping requirements; IRS retention guidance; ACL s51-59 consumer guarantees claim window)
Mailing list data	Until you unsubscribe, or 24 months of inactivity (no opens / clicks), whichever is sooner
Customer support data	24 months after the support thread is closed, then deleted unless still required for an active complaint
Server log data	30 days, then automatically purged by Vercel

Your Rights

Depending on where you live, you have some or all of the following rights in relation to your personal information.

Under GDPR (EU and UK residents) and APP (Australian residents):

• Access — ask us what personal information we hold about you and receive a copy.
• Rectification — ask us to correct inaccurate or incomplete information.
• Erasure / deletion — ask us to delete personal information that is no longer necessary, where you have withdrawn consent, or where you object and there is no overriding legitimate ground.
• Restriction — ask us to limit how we use your information while a dispute is resolved.
• Portability — receive your information in a structured, machine-readable format, or have it sent directly to another controller where technically feasible.
• Object — object to processing based on our legitimate interests, including any direct marketing.
• Withdraw consent — withdraw consent for processing that relies on consent (e.g. mailing list) at any time, without affecting prior lawful processing.
• Not be subject to automated decision-making — we do not carry out automated decision-making, but you have this right if we ever did.

Under CCPA / CPRA (California residents):

• Right to know what personal information is collected and how it is used.
• Right to delete personal information we have collected.
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of personal information (we do not sell or share, but you have this right anyway).
• Right to limit the use and disclosure of sensitive personal information.
• Right to non-discrimination for exercising any of the above rights.

To exercise any of these rights, email hello@spacemance.com from the address associated with your purchase or subscription so we can verify your identity. We will respond within 30 days (GDPR), 45 days (CCPA), or such other period as the applicable law allows.

Right to Lodge a Complaint

If you believe we have not handled your personal information in accordance with this policy or applicable law, you can complain to a supervisory authority.

• EU residents: the data protection authority in the member state where you live, work, or where the alleged infringement occurred. A list is maintained at edpb.europa.eu/about-edpb/about-edpb/members_en. Spacemance has no establishment in the European Union, so the GDPR one-stop-shop mechanism does not apply; each EU member state authority retains competence over complaints from its residents.
• UK residents: the Information Commissioner's Office at ico.org.uk.
• Australian residents: the Office of the Australian Information Commissioner at oaic.gov.au.
• California residents: the California Privacy Protection Agency at cppa.ca.gov, or the California Attorney General.

We would prefer to resolve any concern directly first, so please consider emailing hello@spacemance.com before lodging a formal complaint.

Security

We protect personal information using TLS encryption in transit, encryption at rest where supported by our processors, role based access control on internal systems, and regular review of access lists.

Lemon Squeezy is PCI DSS Level 1 certified for the payment data they handle.

Despite our efforts, no system is perfectly secure.

If we ever discover a personal data breach affecting your information, we will notify the relevant supervisory authority within 72 hours (GDPR Art. 33) and notify affected individuals where the breach is likely to result in a high risk to their rights and freedoms (Art. 34).

Children

We do not knowingly collect personal information from anyone under 16 years of age.

Spacemance titles are written for adult readers.

If we learn that a child under 16 has provided us with personal information, we will delete it as soon as we discover this.

To report such a case, email hello@spacemance.com.

Changes to This Policy

We may update this policy from time to time.

The current version is identified by the lastModified date at the top of the page.

Material changes that reduce your rights will be notified by email to active mailing list subscribers and by a notice on this page for at least 30 days before the change takes effect.

Contact

For privacy enquiries, including to exercise any of the rights described above, contact us at hello@spacemance.com.