Privacy
The short version: we ask for your email address because that is how we send you the file. We count visits with analytics software running on our own server. We do not sell anything to anybody, and there is no advertising tracking on this site at all.
The longer version is below, and it is the whole of it.
Who is responsible for your data
Magic Story Club Limited (company number 14801841), trading as Hours Like These, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. We are the data controller. Email hello@hourslikethese.com about anything on this page.
When you buy a pack
What we collect: your email address, what you bought, what you paid, the date, an order reference, and the identifiers Stripe gives us for the payment. We also record that you agreed at checkout to the download starting immediately, and when you agreed it.
Why: to take the payment, send you the file, answer you if something goes wrong, and keep the business records that tax rules require. Legally, that is performance of our contract with you, plus a legal obligation for the accounting records.
We never see your card details. Payment happens on Stripe's own pages. Stripe tells us the payment succeeded and gives us your email address; the card number never touches our server.
Your email address is printed in the pack. The PDF we build for you carries a line at the foot of the pages saying who it was prepared for, with your email address and your order reference in small grey type. It is there so a copy can be traced back to the order it came from, which is a mild deterrent against the file being passed around. Two consequences worth being straight about: the copy you download is personal to you, and if you do send it to someone else, your email address goes with it. If that is a problem for you (you are buying it as a gift, say), email us before you download and we will sort it out.
When you download
Each download link is a long random string tied to your order. We record how many times it has been used and when it was last used, so that the 30-day and five-download limits work. Our web server keeps ordinary access logs, which include IP addresses, for a short period. We use them to stop links being scraped and to work out why something broke.
When you ask to be told about a pack that is not made yet
What we collect: your email address, which pack you asked about, and the date.
Why: to send you one email when that pack is ready. That is the entire purpose. The legal basis is your consent, and you can withdraw it at any time by replying to any email from us or writing to hello@hourslikethese.com.
We will not add you to a newsletter, we will not sell or share the list, and we will not use it to advertise anything else at you. If a pack you asked about never gets made, we delete your address rather than keeping it in case it is useful one day.
Analytics, and why ours is unusual
We count visits with Matomo, which runs on our own server at t.fo.ls. The data goes nowhere else. Nobody else has access to it.
That is worth stating plainly because it is not what most shops do:
- No Google Analytics. None.
- No Facebook or Meta pixel, no TikTok pixel, no ad-network tags of any kind.
- Nothing about your visit is shared with an advertising company, because there is no
advertising company involved.
- We do not build a profile of you, and there is no automated decision-making here of
any sort.
What we actually look at is which pages people open, whether they came from a phone or a laptop, roughly where in the country they were, and where in the buying process people stop. That last one is the reason it exists: if visitors leave at the same point, something on that page is wrong and we would like to fix it.
Matomo is set to shorten IP addresses before storing them, so we cannot tell who you are from it. It respects your browser's Do Not Track setting. The legal basis is our legitimate interest in knowing whether the shop works; the interest is real and the intrusion is about as small as measurement gets.
See the Cookies page for what is and is not stored on your device.
Who else touches your data
Three companies, each doing one job for us, none of them allowed to use your data for their own purposes:
| Who | What they do |
|---|---|
| Stripe | Takes the payment. Sees your email address and your card details; we see the first and not the second. Stripe is also responsible in its own right for fraud checks it runs, and has its own privacy policy. |
| our email provider | Delivers our emails to your inbox. Sees your email address and the contents of the email. |
| Our hosting | The servers this site and its database run on. |
Stripe processes some data outside the UK, including in the United States, under the data-transfer safeguards the law requires. Everything else stays on servers in the UK or the EU.
That is the complete list. There is no fourth party.
How long we keep it
| What | How long |
|---|---|
| Order records (email, amount, reference) | Six years. Tax rules require it, so this is the one thing we cannot delete on request. |
| Download links and their counters | They expire after 30 days and we clear them out afterwards. |
| "Tell me when it is ready" addresses | Until we send you that email, or until you ask us to stop, or until we decide the pack is never happening, whichever comes first. |
| Support emails | Two years, so we can remember what we told you. |
| Web server logs | 30 days. |
| Matomo analytics | Individual visit records for six months, then only the anonymous totals. |
What you can ask us to do
You can ask to see the data we hold about you, to correct it, to delete it, to have a copy of it in a portable form, to restrict what we do with it, or to object to it. You can withdraw consent for the "tell me when it is ready" list whenever you like.
Email hello@hourslikethese.com. We will reply within a month and normally within a couple of days, because there is not very much to look up.
One honest limit: if you have bought something, we have to keep the order record for six years whatever you ask. We can delete everything around it, and we will.
If you think we have got this wrong, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you told us first, but it is your call.
Children
Our customers are parents. We do not knowingly collect any information about a child, and nothing in a pack asks a child to give us anything. The email address we hold is the grown-up's.
Security
The pack files sit outside the public web server and can only be reached through a link tied to a paid order. Download links are long random strings, not guessable sequences. Everything travels over an encrypted connection. Access to the database is limited to the people running the business, which today is a very short list.
Changes
If we change how any of this works, we will change this page and update the date at the top.