Privacy policy

How we use personal information when you visit, contact us or learn with us.

Contact · Cookies · Analytics · Advertising · Videos · Providers · Retention · Your rights

1. Who is responsible

Tailor Academy is operated by Salzburger Maßarbeit GmbH, Dorf 96, 5205 Schleedorf, Austria. We are the controller responsible for the personal data described in this policy.

For privacy questions or to exercise your rights, email [email protected] or write to the address above. Personal data means information that identifies you or can be linked to you, including names, contact details, account information and online identifiers.

2. Website visits & server logs

When you visit our website, your browser sends information needed to retrieve and display the page. Our web server records technical information in log files. This can include:

The address (URL) of the page or file requested and the referring page.
Your IP address and host name, browser type and version, and operating system.
The date and time of access, request status and technical errors.

We use this information to deliver the website, diagnose faults, maintain availability and investigate misuse or attacks. Ordinary web-server logs are normally deleted after two weeks. Records relevant to a security incident may be retained longer while the incident or related claims are investigated.

The legal basis is our legitimate interest in operating a secure and reliable website (Article 6(1)(f) GDPR). Processing necessary to provide a service you request is based on Article 6(1)(b) GDPR. Hosting and security providers process relevant technical information for these purposes; authorities may receive it where disclosure is legally required.

3. Purchases, accounts & learning

When you register or buy a course, we use your name, contact and billing details, order information, payment status and account details to process your purchase, give you access and provide support. Course progress and submissions are used to deliver the learning features and any assessment you choose.

The legal basis is performing our contract with you or taking steps you request before a purchase (Article 6(1)(b) GDPR). We retain invoices and other legally required records under Article 6(1)(c) GDPR.

Details marked as required are necessary for the relevant service. Without them, we may be unable to create your account, complete your order or answer your request. Optional information is your choice.

In the community, other participants can see information you deliberately share there, such as posts or project photos. Private support messages and submissions are not made available to other participants. Please consider what you want others to see before posting and avoid sharing another person’s personal information without permission.

4. Messages, forms & sewing support

If you contact us by email or through a form, we use your contact details and message to answer your request. A form submission may also include its time and technical information, such as an IP address, for delivery and protection against spam. Photos, measurements and other details you send for sewing support are used to help with your question. Please share only what is relevant.

Private messages and submissions are accessible to team members who need them for their work, with technical processing by the service providers described in this policy. We do not publish them in the community.

For course support and enquiries about buying a course, the legal basis is Article 6(1)(b) GDPR. For other correspondence, it is our legitimate interest in responding to enquiries (Article 6(1)(f) GDPR). Messages are retained for the request and necessary follow-up, subject to the legal retention criteria below.

5. Newsletters & Brevo

If you subscribe, we use your email address and optional details you provide to send the news, sewing content and offers you have requested. The legal basis is your consent (Article 6(1)(a) GDPR). We use Brevo for email delivery and contact management.

Brevo processes contact details, subscription and communication preferences, records of consent and unsubscribe requests, and technical delivery information such as delivery failures. This helps us deliver messages and respect your choices. The platform processes our contact lists on our behalf; its own privacy notice also explains processing for service administration and security.

You can unsubscribe from marketing emails at any time with one click using the unsubscribe link, or by emailing us. Necessary messages about orders, payments and course access are separate and can continue while needed to provide your course, based on Article 6(1)(b) GDPR.

After you unsubscribe, we stop the relevant marketing. Limited consent and suppression records may be retained to document compliance and prevent further unwanted mail. Withdrawal does not affect processing that was lawful before you withdrew consent.

Further information: Brevo Privacy Policy and Brevo terms and data-processing provisions.

6. Cookies & your choices

Cookies are small pieces of information stored in your browser. They can remember a login, retain a selected setting or recognise a browser on a later visit. Similar technologies, including local storage and tracking pixels, can serve related purposes.

Session cookies generally last for a browsing session. Persistent cookies remain until their expiry or until you delete them. First-party cookies belong to the website you are visiting; third-party cookies belong to another domain. A cookie is not a program, but an identifier in it can still be personal data.

Necessary functions: login, security and a checkout or other service you expressly request.
Preferences: remembering choices such as playback settings.
Statistics: understanding visits, navigation and use of our content.
Advertising: measuring campaigns, recognising audiences and personalising advertising.

Storing or accessing information strictly necessary to provide a service you request does not require consent under §165(3) of the Austrian Telecommunications Act 2021. Related personal-data processing relies on Article 6(1)(b) GDPR for the requested service or Article 6(1)(f) for necessary security. Optional analytics and advertising require consent under §165(3) and Article 6(1)(a) GDPR.

You can refuse optional processing and withdraw consent for the future. Contact [email protected] to tell us your choice. Withdrawal does not make earlier lawful processing unlawful. The provider controls linked below offer additional ways to manage advertising and account activity.

Your browser also lets you view, block and delete cookies and website storage. Blocking necessary cookies can prevent login, purchases or course functions. Deleting cookies does not automatically delete information already held by a provider or withdraw every server-side permission; changing devices or browsers may require you to repeat your choices.

Browser instructions: Chrome · Safari · Firefox · Microsoft Edge.

Cookie examples below describe the relevant providers’ typical purposes and lifetimes. Which ones are used depends on consent, the feature loaded, your login status and browser restrictions. A cookie’s lifetime is separate from the retention period of information on a provider’s servers.

7. Google Fonts

We use Google Fonts to display readable, consistent typography. Where fonts are delivered by Google, your browser requests a style sheet or font file from domains such as fonts.googleapis.com and fonts.gstatic.com. Google receives the technical information necessary for that request, including your IP address, browser information and the referring website information sent by your browser.

The relevant Google provider for the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Processing can also involve Google LLC in the United States. External font delivery creates a connection to Google even if you do not have a Google account; the absence of a login or a tracking cookie does not mean that no personal data is transmitted.

External font delivery that requires consent is subject to Article 6(1)(a) GDPR. Font files cached by your browser can have a different lifetime from the personal data associated with a request. File-cache periods therefore do not describe how long Google retains personal information.

For Google’s processing, retention criteria and privacy controls, see the Google Privacy Policy and Google Fonts FAQ. You can also contact us about the use of external resources on our website.

8. Google Analytics 4

With your consent, we use Google Analytics 4 to understand how visitors find and use our website. Reports help us improve navigation and course information, identify technical problems and measure actions such as course enquiries or purchases. The provider is Google Ireland Limited, with processing also involving Google LLC and its service infrastructure.

Analytics can process page views, referring websites and campaigns, clicks and other interaction events, engagement time, device and browser details, approximate location and pseudonymous online identifiers. These identifiers can recognise a browser across visits. Reports may be aggregated, but the underlying identifiable or pseudonymous information is not simply anonymous.

Google states that Analytics does not log or store individual IP addresses from users in the EU, Switzerland or the UK: they are used to derive approximate location and then discarded. This does not remove the personal-data character of other identifiers and events.

Retention: our GA4 setting is 14 months for user-level and event-level data covered by that setting. Google deletes expired data in its regular monthly deletion cycle. Standard aggregated reports are not governed by the same setting. Google’s shorter limits for particular data types, such as age, gender and interests, continue to apply.

Typical cookies are _ga, used to distinguish users, and _ga_<identifier>, used to retain session state. Google’s default expiry for these cookies is two years; configured limits and browser restrictions can shorten this. Cookie expiry is separate from our 14-month Analytics retention setting.

The legal basis is your consent under Article 6(1)(a) GDPR and §165(3) TKG 2021. You may refuse or withdraw it as explained under Cookies & your choices. Google processes Analytics data under its data-processing terms.

Further information: GA4 data retention, Analytics cookies and Google’s regional data and IP-address safeguards.

9. Google Ads & customer matching

With your consent, we use Google Ads to measure advertising results and reach relevant audiences. Conversion measurement helps us understand whether an advert led to an action, such as a course purchase. Remarketing can enable ads to be shown to people who previously visited our website.

Google Ireland Limited and Google group companies may process advertising and browser identifiers, referring campaign information, pages visited, event times and conversion details. Depending on your Google settings, Google may associate activity with a Google account.

With your consent, contact details such as an email address may also be transmitted in hashed form for customer matching, audience selection or conversion measurement. Hashing changes the format of the information; it does not make it anonymous to a provider able to match it to an account.

The legal basis is Article 6(1)(a) GDPR and, for optional storage or access on your device, §165(3) TKG 2021. You can withdraw consent through us and manage Google’s personalised advertising in My Ad Center. Turning off personalised advertising does not necessarily stop every form of advertising measurement.

Details about identifiers, retention criteria and controls are available in Google’s advertising information, Google’s cookie information and the Google Privacy Policy.

10. Meta Pixel & advertising audiences

With your consent, we use the Meta Pixel and audience tools provided by Meta Platforms Ireland Limited, Ireland. These help us measure the results of Facebook and Instagram advertising, understand conversions and select audiences for relevant offers.

Meta can receive information such as pages visited, event times, browser and device details, IP addresses, online identifiers and actions such as checkout or purchase. Where customer matching is used with consent, hashed contact details may also be transmitted. Meta can match activity with a Facebook or Instagram account. Information that is pseudonymous or aggregated in our reports can therefore still identify you to Meta.

Examples of Meta advertising cookies are _fbp and fr, typically with a three-month lifetime. The cookies used depend on consent, your browser and your interaction with Meta services. Their expiry is not a promise that all associated server-side data is deleted at the same time.

The legal basis is your consent (Article 6(1)(a) GDPR and §165(3) TKG 2021). For the collection and transmission of event data covered by Meta’s Business Tools, joint-controller responsibilities are addressed in Meta’s Controller Addendum. Meta is responsible for its subsequent processing under its own privacy policy. You may exercise your rights through us or Meta.

You can refuse or withdraw consent for our advertising processing. Meta account holders can also use Meta ad preferences. See the Meta Privacy Policy and Meta Cookies Policy for processing, retention and account controls.

11. YouTube videos

We embed YouTube videos to explain our courses and share sewing content. YouTube is a Google service; Google Ireland Limited is the relevant provider for users in the European Economic Area, with processing also involving Google companies in the United States.

Loading an embedded player creates a connection to the provider. Google may receive your IP address, browser and device information, the page containing the video, identifiers and playback interactions. This can happen without a YouTube account. If you are signed in, Google may associate viewing activity with your account and use it under your account settings and its privacy policy.

YouTube uses cookies and similar technologies for player functions, security, preferences, analytics and advertising. Examples include YSC, a session cookie used for security, and VISITOR_INFO1_LIVE, which can support service functions and recommendations and normally expires after six months. Additional cookies depend on your account and choices.

Optional embedded content and related optional tracking are based on consent under Article 6(1)(a) GDPR and §165(3) TKG 2021. Necessary processing to deliver a course video you request under your course contract relies on Article 6(1)(b) GDPR; this does not extend to unrelated advertising.

You can manage viewing history and other saved activity through Google My Activity, and advertising through My Ad Center. Signing out reduces direct account association but does not prevent all processing. Browser controls can remove cookies; they do not erase account history.

Google retains different types of data for different purposes, according to account settings and legal or security needs. See the Google Privacy Policy and Google’s cookie information.

12. Vimeo videos

We use Vimeo.com, Inc., United States, to host and play videos, including course content. An embedded player lets you watch lessons directly on our website.

When the player loads, Vimeo receives technical information such as your IP address, browser, operating system, referring page and device information. Playback and interaction information helps deliver and improve the video service. Vimeo can process this information even if you have no Vimeo account; if you are signed in, activity may be associated with that account.

Vimeo’s player documentation lists cookies such as player for playback preferences, normally lasting one year, and vuid for analytics, normally lasting two years. Security and access cookies may also be used. Which cookies are set depends on the player configuration, consent, browser and interaction. These are provider examples, not a claim that every cookie is set on every visit.

Processing necessary to deliver your requested course videos is based on Article 6(1)(b) GDPR. Optional analytics or advertising require consent under Article 6(1)(a) GDPR and §165(3) TKG 2021. Necessary security processing relies on Article 6(1)(f) GDPR.

You can manage cookies through your browser and account information through Vimeo. Signing out reduces direct association with a Vimeo account but does not prevent technical requests to the player. Restricting necessary player functions may stop a lesson from playing.

Vimeo processes data internationally, including in the United States, and applies retention criteria according to the data and purpose. For details and rights requests, see the Vimeo Privacy Policy, Vimeo Cookie Policy and Vimeo player-cookie documentation.

13. Cloudflare & website security

We use Cloudflare, Inc., United States, to deliver website content efficiently and protect our website against harmful traffic. Requests can pass through Cloudflare’s international network. Cloudflare processes information such as IP addresses, requested URLs, browser and device details, request times and security events.

Security features may use cookies to distinguish legitimate visitors from automated traffic or to remember a completed security check. For example, Cloudflare describes __cf_bm as expiring after 30 minutes of inactivity. The lifetime of a clearance cookie depends on the relevant security configuration. These examples do not mean every Cloudflare feature is active on every page.

The legal basis is our legitimate interest in a secure and available service (Article 6(1)(f) GDPR), or Article 6(1)(b) where necessary to deliver a service you request. Strictly necessary security storage falls within the corresponding exception under §165(3) TKG 2021.

See the Cloudflare Privacy Policy and Cloudflare cookie information for its processing, retention and safeguards.

14. Payments with Stripe & PayPal

The payment provider you use receives information necessary to process your payment. This can include contact and billing details, payment-method information, the amount and currency, transaction references, payment status, and technical or device information used for security and fraud prevention. We use payment confirmations and transaction references to allocate payments, manage instalments and process refunds.

Stripe: services for European customers involve Stripe’s Irish entities, including Stripe Payments Europe Limited and Stripe Technology Europe Limited. Stripe may process data on our behalf and also as an independent controller for its own fraud-prevention, financial-services and legal obligations. See the Stripe Privacy Policy.

PayPal: the European provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. PayPal processes payments and carries out its own security and legally required checks. Its processing is described in the PayPal Privacy Statement.

Our payment processing is based on Article 6(1)(b) GDPR, with Article 6(1)(c) applying to legal accounting obligations and Article 6(1)(f) to proportionate fraud prevention. Providers have their own legal duties and retention periods. Deleting a course account or receiving a refund does not automatically erase legally required payment records.

15. Who receives information

Our team receives only the information needed for its work. We also use providers for hosting, technical maintenance, learning-platform functions, email delivery, support, security, payments, analytics, advertising and video playback, as described above.

Providers acting as processors handle data on our instructions under data-processing arrangements. Others also act as independent controllers for their own purposes, such as payment providers meeting financial regulations. The relevant provider notices explain these roles and their own processing.

We may disclose necessary information to professional advisers and public authorities to comply with the law or to establish, exercise or defend legal claims. The legal basis is Article 6(1)(c) or (f) GDPR, depending on the reason.

Private course submissions are not shared with other participants. Content you deliberately publish in the community can be seen by its participants, as explained under Purchases, accounts & learning.

16. International data transfers

Our service providers operate internationally. Personal data may therefore be processed outside the European Economic Area, including in the United States. This can also occur when a provider has a European contracting entity.

Transfer safeguards include an EU adequacy decision, such as the EU–US Data Privacy Framework for transfers covered by a recipient’s certification, or EU Standard Contractual Clauses with the applicable additional safeguards. The relevant mechanism depends on the recipient, service and transfer. A certification does not cover every transfer by every company in a group.

Google and Cloudflare describe Data Privacy Framework participation and contractual safeguards in their published transfer information. Vimeo describes its international safeguards in its privacy policy. Stripe publishes its Data Processing Agreement and Data Transfer Addendum. PayPal describes safeguards including Binding Corporate Rules for covered group transfers. Brevo’s and Meta’s notices explain their international processing and contractual safeguards.

Further information: Google transfer frameworks and the provider privacy notices linked above. Contact [email protected] for information about the safeguards applicable to your data and how to obtain a copy.

17. How long information is kept

Retention depends on the purpose of the processing and legal requirements:

Course accounts and purchases: for the duration of your agreed course access, including lifetime access, so we can recognise your purchase and keep your materials available. Accounting and legal duties can continue afterwards.
Invoices and accounting records: generally seven years from the end of the relevant calendar year under Austrian law; longer where needed for a pending proceeding.
Support messages and submissions: until the request and related follow-up are completed. Records relevant to a legal claim may be kept until the applicable limitation period or proceedings end.
Newsletter contacts: until you unsubscribe from the relevant marketing. Limited consent and opt-out records may be retained to demonstrate compliance and prevent unwanted mail.
Ordinary web-server logs: normally two weeks. Relevant security-incident records can be kept until the investigation and related claims are resolved.
Google Analytics 4: 14 months for user-level and event-level information covered by the retention setting, subject to Google’s deletion cycle and shorter limits for particular data types. Standard aggregated reports are separate.

We delete or anonymise information when its purpose and any legal retention requirements end. Deletion of an account does not require us to erase records that the law requires us to retain. Information held by providers as independent controllers follows their own stated retention criteria. Cookie expiry, account-history deletion and deletion of server records are separate processes.

18. Security & encrypted connections

Our website uses HTTPS with TLS encryption to protect information while it travels between your browser and the website. You can check the connection information in your browser and the “https” address. Encryption in transit does not make the receiving service anonymous or prevent processing described in this policy.

We use access controls and appropriate technical and organisational measures to protect personal data against unauthorised access, loss and misuse. No internet service can guarantee absolute security. Ordinary email is not necessarily encrypted from end to end, so please avoid sending unnecessary sensitive information and contact us if a secure way to share something is needed.

19. Your data-protection rights

Under the GDPR and Austrian data-protection law, and subject to the applicable conditions, you have the following rights:

Access (Article 15): ask whether we process your data, obtain information about that processing and receive a copy.
Correction (Article 16): have inaccurate information corrected and incomplete information completed.
Erasure (Article 17): request deletion when the legal conditions apply. Legal retention duties and the defence of claims can limit deletion.
Restriction (Article 18): ask us to limit processing, for example while accuracy or an objection is being examined.
Recipient notification (Article 19): when required, recipients must be informed of correction, erasure or restriction, unless this is impossible or disproportionate. You can ask us who those recipients are.
Portability (Article 20): receive data you provided in a structured, commonly used, machine-readable format and, where technically feasible, have it sent to another controller when the statutory conditions apply.
Objection (Article 21): object to processing based on legitimate interests for reasons relating to your situation. You can object to direct marketing, including related profiling, at any time.
Automated decisions (Article 22): the right not to be subject to a decision based solely on automated processing, including profiling, that has legal or similarly significant effects, subject to the statutory exceptions. Where an exception applies, the required safeguards may include human intervention and the opportunity to state your view and contest the decision.

You may withdraw consent at any time for the future. This does not affect processing that was lawful before withdrawal. Withdrawing optional marketing consent does not cancel your course contract.

To exercise your rights, contact [email protected]. We normally respond within one month of receiving your request. If a lawful extension is necessary because of its complexity or number, we will tell you within that month. We may request proportionate information to verify your identity before disclosing personal information or changing an account.

You may also complain to a supervisory authority, including in the country where you live or work or where the alleged infringement took place. Our Austrian authority is the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, Austria; [email protected].