Rottoways operates the storefront at rottoways.com and sells the Design System Pack as a one-time digital download. This page describes what information is collected when you visit the site or buy the pack, why it's collected, and how long it's kept.
What we collect
When you browse the site: our hosting provider Vercel records standard HTTP request metadata (IP address, user agent, page path, timestamp) for operational purposes.
We also use PostHog (EU-hosted, data stored in Frankfurt) to count anonymous pageviews and a handful of funnel events — e.g. "someone clicked the pricing CTA", "someone opened the checkout", "someone downloaded the pack". PostHog sets a first-party identifier in your browser so we can count unique visitors instead of raw hits. We do not use PostHog's session recording, autocapture, heatmap, or advertising features; the only data that leaves your browser is the event name, the page URL, and the referring domain. We rely on the legitimate-interest basis under GDPR Art. 6(1)(f) for this measurement and do not use PostHog data for advertising, profiling, or anything that affects you individually.
If you'd rather not be counted at all, visit rottoways.com/?ph_optout=1 — the choice is kept in your browser's local storage and no further events are sent from that browser until you clear site data. There is no cookie banner because PostHog's identifier is first-party and strictly measurement-only; no advertising or cross-site tracking cookies are set anywhere on the site.
When you buy the pack: checkout is processed by Polar, our payment provider. Polar collects the information required to process the payment and issue a tax-compliant receipt: your name, email address, billing country, and payment-method details. Polar shares your name and email with us so we can deliver the pack and send a receipt. Polar does not share your card number with us; the card details remain on Polar's payment infrastructure (Stripe).
If you email us: we keep the email thread in our regular inbox so we can reply and so we have a record of any support history.
What we do with it
- Deliver the pack zip to your email after purchase.
- Issue and resend receipts.
- Process refunds when requested.
- Reply to support emails.
- Operate the site (caching, security, debugging) using the request metadata Vercel collects automatically.
We do not sell your data. We do not share it with advertisers. We do not use it to train any model.
Where it's stored
- Order, customer, and download records: stored by Polar (Polar privacy policy).
- Site logs: stored by Vercel (Vercel privacy policy).
- Anonymous pageview and funnel events: stored by PostHog in the EU region, Frankfurt (PostHog privacy policy).
- Email correspondence: stored in our regular email provider.
How long we keep it
- Order records: kept for as long as legally required by tax law (up to 10 years depending on your jurisdiction).
- Email correspondence: kept indefinitely unless you ask us to delete it.
- Vercel access logs: retained per Vercel's standard retention.
- PostHog events: retained per PostHog's standard retention (up to 7 years for raw events on their current plan). Events are not linked to a real-world identity unless you've completed a purchase, in which case the Polar-shared email is attached so the pre-purchase and post-purchase sessions merge into one anonymous funnel record.
Your rights
You can ask us to:
- See what data we have on you.
- Correct anything that's wrong.
- Delete your record (subject to tax-law retention obligations on completed sales).
- Export your data.
To make any of these requests, email support. We'll respond within 30 days.
Contact
Questions about this policy? Email support.