CG Templates1. Who is responsible
Carraway & Gatsby Corporation, a Delaware C Corporation, is the operator responsible for CG Templates. Privacy questions and requests can be sent to contact@cgcorp.io or our correspondence mailing address: 1111B S Governors Ave #54809, Dover, DE 19904, United States.
[TBD: any legally required additional business, privacy-officer or representative details for the final sales regions. This mailing address does not identify all locations where information may be processed.]
2. Information involved
Planned account registration requests only an email address and password, with no additional profile fields. [TBD: verify authentication, credential handling and recovery on the launch service; define deletion. Social sign-in remains under consideration.]
Purchase records include buyer email, order and payment references, product, amount, currency, payment/refund status and relevant dates. Stripe-hosted checkout is the intended place for payment entry. Any billing or tax information required by the final checkout is separate from registration fields. [TBD: verify the final checkout fields, data returned to us and processor arrangements.]
File-access history records the order, file identifier, account or legacy access channel, and server time when an authorized access link is prepared. It does not record file contents, signed URLs, IP addresses or device fingerprints, and does not prove receipt or use. Administrators use it to investigate delivery and manually review refund requests. Older or unrecorded activity may be unknown.
Support and refund correspondence includes the information you send and our replies. Please avoid including passwords, full card numbers or unrelated sensitive information.
Service operation can involve IP addresses, browser/device and request information, security/rate-limit records, authentication/session records and error diagnostics. The website currently references externally hosted Google Fonts. [TBD: audit actual hosting, SDK, font and diagnostic data flows and their retention.]
3. Purposes and legal grounds
The planned purposes are to administer accounts and purchases, authenticate access, provide downloads, answer support and refund requests, protect the service, maintain financial records and comply with applicable obligations. Planned analytics and any later advertising are described separately below.
[TBD: confirm the applicable legal regimes and a purpose-by-purpose legal basis, including contract performance, legal obligations, any assessed legitimate interests and consent where appropriate. Complete any required balancing, notices and records before launch.]
4. Google Analytics and optional advertising
Google Analytics is planned for visitor statistics, traffic sources and site-use analysis. It is not integrated by this draft. [TBD: product/version and configuration, identifiers and events, recipient entities, retention, data-sharing settings and whether advertising features will be enabled.]
Personalized advertising and remarketing are possibilities, not confirmed integrations. [TBD: actual use, partners, activation date, profiling details and any applicable sale, sharing or targeted-advertising classification. No unconditional no-sale/no-sharing statement has been approved.]
Proposed launch approach: optional analytics and advertising remain off until the relevant controls, disclosures and required permissions are implemented and verified. The consent design and final choice mechanisms are [TBD]. See the Cookie Policy draft for current storage and planned controls.
Marketing emails are [TBD]. Account registration or a purchase will not be described in the final policy as automatic consent to optional marketing. Transactional purchase messages are a separate purpose.
How Google uses information from sites or apps that use its services
5. Service providers and other disclosures
The current code uses Supabase for authentication, database and private storage; Lovable infrastructure for hosting-related services, diagnostics and the configured email integration; and Stripe for payment integration. Google Fonts is referenced for typography. Google Analytics is planned. Their precise roles and what each receives must be verified against the launch configuration.
[TBD: final provider legal entities, processor/controller roles, contracts, recipients and categories of information disclosed. Assess any legally required disclosures to authorities, professional advisers or in a business transaction; this draft does not claim unrestricted sharing for these purposes.]
6. International processing
Hosting, suppliers and remote operational access may involve processing information in countries other than the customer's country. A US mailing address does not mean all processing takes place in the United States.
[TBD: identify all actual storage, provider and operational-access countries, the recipient entities, applicable transfer rules, safeguards and how to obtain information about those safeguards. Any legally required location disclosure must be included before this notice is finalized.]
7. Retention and deletion
[TBD: retention periods or concrete criteria for account data, orders and tax records, support/refund correspondence, security logs, diagnostics, analytics, consent records and backups. No general retention period has been chosen.]
The current email-link purchase-access implementation uses links expiring after 30 minutes and a buyer-session cookie lasting up to 24 hours. Expiration of a link or cookie is not a promise that its database records are deleted at that time. The future account authentication and storage lifetimes remain [TBD].
Deletion requests can be sent to contact@cgcorp.io. [TBD: identity checks, the deletion workflow, lawful record-retention exceptions and how deletion affects purchase history, account recovery and unlimited redownload access.]
8. Your choices and rights
Depending on the laws that apply, you may have rights to access, correct, delete, obtain a copy of or restrict use of information, object to processing, withdraw consent, or complain to an appropriate regulator. Contact contact@cgcorp.io to make a request. We may need proportionate information to verify that the request concerns your data.
[TBD: region-specific notices, request deadlines and verification/appeal processes, authorized-agent requests where applicable, advertising opt-outs and support for legally applicable browser preference signals such as Global Privacy Control. These controls are not represented as implemented.]
9. Age eligibility and security
[TBD: minimum age and any necessary child-data safeguards. A children-related compliance assessment has not been completed.]
Access control and private delivery are part of the current system design. [TBD: verify the new account flow, access lifecycle, incident procedures and provider safeguards before launch. No service can promise absolute security.]
10. Changes and effective date
[TBD: effective date, final regional assessment, approval and the process for notifying material changes. This notice remains a review draft and is not a certification of compliance.]