Privacy policy

Last updated: 25 October 2026. This policy explains what personal data we process when you visit oakandtally.com, join our email list or buy a template, and what rights you have under the EU General Data Protection Regulation (GDPR).

1. Who is responsible

The controller is Fizza Adeel Edhi, trading as Oak & Tally, Gsteinig 17, 73098 Rechberghausen, Germany. Email: [email protected]. We have not appointed a data protection officer because we are not required to.

2. Visiting the website (hosting)

This site is a static website hosted on Cloudflare Pages by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. When you open a page, your browser sends technical data that the host processes to deliver the page and protect it from attacks: IP address, date and time, page requested, referrer, browser and operating system. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure, working website). Cloudflare is certified under the EU-U.S. Data Privacy Framework, and we have a data processing agreement with Cloudflare that includes the EU Standard Contractual Clauses. Cloudflare keeps these logs only for a short time.

We do not set cookies. Our fonts are stored on our own site, so no data goes to Google Fonts or other font services.

3. Website analytics

We use Cloudflare Web Analytics to count visits and see which pages are useful. It works without cookies, does not use your IP address to identify you, does not build profiles across sites and does not follow you around the web. It measures page views, referrers, country, device type and page load times in aggregate. Legal basis: Art. 6(1)(f) GDPR (our interest in understanding, in aggregate, how the site is used) and § 25(2) no. 2 TDDDG, because no information is stored on your device.

4. Email list and the free calculator

If you sign up for the free Etsy Fee & Profit Calculator, we process your email address, the date and time of your sign-up and confirmation, the IP address used, and which page you signed up on. We send you the calculator, a series of 7 short emails with tips on fees, pricing and profit (including information about our paid templates), and after that occasional updates and offers.

Double opt-in: you only join the list after you click the link in our confirmation email. We log the sign-up and confirmation to prove your consent.

Opens and clicks: our emails measure whether they were opened and which links were clicked. We use this, together with which of our product pages you visit from our emails, to give your address an engagement score and tags (for example "interested in the Profit Tracker"), so we can send you fewer, more relevant emails and stop emailing people who are not reading. We do not make any decisions with legal or similarly significant effect on you.

Legal basis: your consent, Art. 6(1)(a) GDPR. You can withdraw it at any time with the unsubscribe link in every email or by writing to us. Withdrawal doesn't affect processing that happened before. We keep your data until you unsubscribe; afterwards we keep your email address on a block list for up to three years only to prove consent and to make sure we don't email you again (Art. 6(1)(f) and (c) GDPR).

Email service: we use Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France) to collect sign-ups and send emails. Brevo processes your data on our behalf under a data processing agreement (Art. 28 GDPR) and stores it in the EU. Brevo's privacy policy: brevo.com/legal/privacypolicy.

5. Buying a template (Gumroad)

Our templates are sold through Gumroad, Inc., 548 Market St, San Francisco, CA 94104, USA. Gumroad is the merchant of record: it sells the product to you, takes payment, charges sales tax or VAT and delivers the files. When you click a "Buy" button you go to Gumroad's checkout, and Gumroad processes your name, email, payment and location data as its own controller under its own privacy policy (gumroad.com/privacy). Gumroad passes us the details we need to support you and keep business records: your name, email address, what you bought, the price, the date, and your country. Legal basis: Art. 6(1)(b) GDPR (performing the license and support), Art. 6(1)(c) GDPR (tax and accounting record-keeping; German law requires us to keep business records for up to 10 years) and Art. 6(1)(f) GDPR (fraud prevention and handling support requests). Data sent to Gumroad goes to the USA; Gumroad relies on its own transfer mechanisms, described in its privacy policy.

If you are on our email list and buy, we tag your address as a customer so we stop sending you offers for what you already own.

6. Emailing us

If you write to us, we process your message and email address to answer you (Art. 6(1)(b) or (f) GDPR) and delete it when it is no longer needed, unless we must keep it for legal reasons.

7. Your rights

You have the right to access (Art. 15), correction (Art. 16), deletion (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). You can withdraw consent at any time (Art. 7(3)). To use any of these rights, email us. You also have the right to complain to a data protection supervisory authority, for example the one in your country or the one responsible for us.

8. Changes

We update this policy when our tools or the law change. The date at the top shows the current version.