Legal
Privacy Policy
Last updated: 17 August 2026
Nothing is collected unless you choose to give it. There are no accounts, no logins, no profiling, and nothing is sold. Everything below is an elaboration of that one sentence.
Who we are
This site is operated by IndiSpice Atelier, a sole trader based in Australia. We are the data controller for the personal data described on this page — that is, we decide what is collected and why.
Our registered address and principal place of business is:
IndiSpice Atelier
8 Claymore Loop, Dalyellup WA 6230, Australia
For any privacy question, including a request to see or delete your data, email hello@indispice-atelier.com. A person reads it. Email reaches us faster than post.
What we collect, and why
| What | When | Why | Legal basis |
|---|---|---|---|
| First name, email, country | You request the free Compendium | To issue your download and know who asked for it | Performance of a contract — you asked us for something |
| First name, email, country, postcode (optional) | You start a checkout | To pass to Paddle so you do not retype it, and so we can help if a purchase goes wrong | Performance of a contract, and our legitimate interest in recovering a checkout that failed |
| A yes/no marketing consent, and the time you gave it | Only if you tick the box | To email you occasional spice guides | Consent — freely given, and withdrawable at any time |
| A one-way hash of your IP address | You submit a form | To limit how many submissions come from one connection, which is what keeps the list free of automated junk | Legitimate interest in preventing abuse |
| Purchase record | You buy an ebook | To deliver your files and honour support requests | Performance of a contract |
We ask for country, not an address. Country is what determines the tax on a purchase and lets us prefill checkout so you type less. A street address would tell us more than we need, so we do not ask for one.
We store a hash of your IP address, salted with a secret kept off the public server, rather than the address itself. It lets us recognise repeat submissions from one connection without holding an identifier that points back at you.
Two things we want to be straight about
We do not yet verify email addresses. There is no confirmation email, because nothing on this site sends email yet. That means someone could enter your address without your knowledge. If you receive anything from us you did not ask for, email us and we will delete the record immediately.
The Compendium is delivered as a direct download, not by email.You get a private link on the page as soon as you submit the form. It works for a few days, so download the file and keep it.
Who your data is shared with
We do not sell data, and we do not share it for anyone else's marketing.
- Paddle — our Merchant of Record. When you buy, Paddle processes your payment and holds the transaction as anindependent controller, not merely our processor. Their handling of your payment data is governed byPaddle's privacy policy. We never see your card details.
- Hostinger — our web host. The site and its database run on their servers.
- Google — for advertising, described below.
- Amazon — only in the sense that clicking an affiliate link takes you to Amazon, described below.
- Professional advisers, or an authority, where the law requires it.
Cookies
This site sets no cookies of its own. It is a static site with no accounts and no session to keep. The only cookies that can appear come from the third parties below, and only if you interact with them.
- Essential — none. Nothing here needs a cookie to work.
- Analytics — none. We do not run Google Analytics or any equivalent.
- Advertising — see below. Not currently active.
- Affiliate — Amazon sets its own cookie when you click through to them, so that a purchase can be attributed to us.
You can block or delete cookies in your browser settings at any time. Nothing on this site will stop working if you do.
Advertising
Advertising is not currently served on this site. The containers exist but are switched off. This section describes what will happen when they are switched on, so it does not have to be written after the fact.
We use Google AdSense on spice guides, recipes and volume pages only — never on ebook sales pages, the checkout, or any page where you give us your details. Google's advertising script loads site-wide, because Google requires that to verify the site, but it is only permitted to display an advertisement in the reserved places named above.
- Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this and other websites.
- Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites.
- You can opt out of personalised advertising atGoogle Ads Settings, or opt out of some third-party vendors' cookies ataboutads.info.
- We do not control which specific ads appear, and we receive no personal data about you from Google.
- In the EU, EEA and UK, Google is required to collect consent for personalised advertising before serving it, and will present that choice.
Amazon affiliate links
As an Amazon Associate, IndiSpice Atelier earns from qualifying purchases. When you click an Amazon link on this site, Amazon sets a cookie so that any resulting purchase is attributed to us. We are told only that a purchase happened — never who made it, and never what else was in the basket. We receive no personal data from Amazon at all.
International transfers
We are in Australia, our host and our processors operate globally, and our readers are mostly in the United States. Your data will therefore be processed outside the UK and the EEA.
Where that happens for UK or EEA residents, transfers rely on the standard contractual clauses or equivalent safeguards that our processors have in place. Paddle and Google both publish their own transfer arrangements.
How long we keep it
- If you asked for the Compendium — until you ask us to delete it, or after three years with no contact from you, whichever comes first.
- Download links — expire after a few days. The record is removed with the rest of your data.
- Purchase records — seven years, because tax law requires it. Paddle holds the authoritative copy.
- Hashed IPs — no longer used for rate limiting after an hour, and deleted with the record they belong to.
Your rights
Wherever you live, you can ask us to show you what we hold, correct it, or delete it — and we will. If you are in the UK or the EEA, you have the following rights under the UK GDPR and GDPR:
- Access — a copy of what we hold about you
- Rectification — correct anything wrong
- Erasure — have it deleted
- Restriction — have us stop using it while a dispute is resolved
- Portability — receive it in a machine-readable form
- Objection — object to processing based on legitimate interests
- Withdraw consent — at any time, without affecting anything done before you withdrew it
To stop the emails, use the unsubscribe link at the bottom of any email we send you. It takes one click and needs no account and no reply from us. Unsubscribing stops the emails only — anything you have bought stays yours, and your download links keep working.
Email hello@indispice-atelier.com. We respond within one month, and will tell you if we need longer, as the law allows.
If you are unhappy with our answer you can complain to your data protection authority — the Information Commissioner's Office in the UK, your national authority in the EEA, or the Office of the Australian Information Commissioner in Australia.
Security
The site is served over HTTPS. The database that holds form submissions sitsabove the web root, so it has no URL and cannot be requested over the internet. Download links are unguessable, expire, and are stored hashed, so the database never contains a working link. Access to the server is restricted, and credentials are never stored in our source code.
No system is perfectly secure. If you believe there is a vulnerability here, please email us — we would genuinely rather hear it from you.
Children
This site is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has given us data, email us and we will delete it.
Changes
We may update this policy. Changes take effect when posted, and the date at the top will reflect the latest version. If a change materially affects how we use data you have already given us, we will say so prominently.
Contact
hello@indispice-atelier.com, or via ourcontact page.