Privacy Policy

This policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and the rights you have over it. It applies to freyjalabs.com and loomandlesson.com, and to the emails we send you.

The data controller is Freyja Laboratory LLC ("Freyja Labs," "we," "us"), which also operates the Loom & Lesson studio. For any privacy question or request, email hello@freyjalabs.com.

The short version

• We collect the minimum we need to send you lessons, run your account, and take payment.
• We never sell your personal data, and we don't show third-party ads.
• Every marketing email has a one-click link that deletes your record on the spot.
• You can ask us to show, correct, export, or erase your data at any time.
• Our lessons are for educators and don't ask for or collect any student data.

What we collect

We only collect data you give us or that's needed to run the service:

• Free monthly drop. Your email address and the grade band you teach, plus an optional name and subject area, the date you signed up, and a referral code if you arrived through one.
• Paid membership. Your name, email, plan tier and billing cadence, subscription status, and renewal date. Payments are processed by Stripe — we never see or store your full card number.
• Your bookshelf. Lessons you save, your two ratings (the lesson "as written" and "in my class"), any informal feedback you write, and the interest topics you pick, so we can tailor what we send.
• Contact form. The name, email, organization, role, and message you submit (handled by Formspree).
• Technical data. A first-party sign-in cookie when you log in, and privacy-friendly, cookieless analytics (Umami) that count page views without tracking you across sites or building a profile.

We do not knowingly collect personal data about students. Our lessons run unplugged — on paper, cards, and conversation — and never require student accounts or student information.

Why we use it, and our legal basis

Under the GDPR (and UK GDPR), we rely on these legal bases:

• Consent — to send you the free monthly lesson and other marketing email. You can withdraw it at any time (see your rights, below).
• Contract — to provide a paid membership you've signed up for: granting library access, processing payment, and managing renewals.
• Legitimate interests — to keep the service secure, prevent abuse, and improve our lessons using your ratings and feedback, in ways you'd reasonably expect.
• Legal obligation — to keep the payment and tax records the law requires.

Who we share it with

We never sell your data. We share it only with the service providers ("processors") we rely on to operate, each bound by their own terms and data-processing agreements and used only for the purpose listed:

• Cloudflare — website hosting and delivery.
• Airtable — our subscriber and member records.
• Stripe — payment processing and billing.
• Resend — sending our emails.
• HubSpot — managing email lists and the monthly send.
• Formspree — delivering contact-form messages.
• Umami — cookieless, aggregate website analytics.

We may also disclose data if required by law, or to protect our rights, safety, or property.

International transfers

We're based in the United States, and our processors are largely US-based, so your data may be processed in the US. Where data is transferred out of the EEA or UK, we rely on appropriate safeguards such as the Standard Contractual Clauses offered by those providers.

How long we keep it

• Free-drop records are kept until you unsubscribe or ask us to delete them.
• Member records are kept for as long as your account is active, and afterward only as long as needed for legal, tax, and accounting purposes.
• Contact-form messages are kept only as long as needed to handle your inquiry.
• When you exercise the deletion options below, we remove your record promptly.

Your rights

You can ask us to do any of the following with your personal data: access a copy, correct it, delete it, restrict or object to how we use it, port it to another service, or withdraw consent you've given. You also have the right to lodge a complaint with your local data-protection authority.

There are three easy ways to act on these rights:

• One-click in any email. Every monthly email has an "Unsubscribe & delete my data" link (and a native one-click unsubscribe in Gmail and similar). Use it and we delete your free-drop record right away.
• From your account. If you're a member, you can cancel your plan or delete your account and data from your account page. Cancelling a paid plan stops billing while leaving your access in place until your period ends; deleting your account also cancels billing and erases your record.
• Email us. Write to hello@freyjalabs.com for any request, including access or a copy of your data. We aim to respond within 30 days.

A note for paying members — cancellation, refunds, and transfers: opting out of email never silently cancels what you've paid for. We don't offer partial-month or partial-term refunds, but you're never locked in. From any opt-out link, your account page, or hello@freyjalabs.com, you can (a) switch down to the free monthly drop and keep free access, (b) cancel and keep full access until your paid period ends, or (c) delete your account and data outright. You can also transfer your membership to a colleague instead of ending it — they pick it up where you left off. Whatever you choose, your access and saved work stay put until the period you've paid for ends or you ask us to remove them.

Cookies

We keep cookies to a minimum. When you sign in, we set one first-party session cookie so you stay logged in. Our analytics are cookieless and don't track you across sites. We don't use advertising or cross-site tracking cookies.

Security

We protect your data with encryption in transit, scoped access to our systems, and payment handling delegated to Stripe so card details never touch our servers. No method of transmission or storage is perfectly secure, but we work to safeguard your information and limit what we collect in the first place.

Children

Our services are intended for educators and other adults, not for children. We don't knowingly collect personal data from anyone under 16. If you believe a child has provided us personal data, email us and we'll delete it.

Changes to this policy

We may update this policy as our service evolves. We'll change the effective date above and, for material changes, give notice by email or on the site.

Contact

Freyja Laboratory LLC · hello@freyjalabs.com
For privacy requests, please use that address and tell us what you'd like us to do.