Privacy Notice

Last updated: 8/29/2026

Who we are

Graphite & Grain is operated by Diamond Johnson ("we", "us", "our"). We are the data controller for the personal data we collect about you.

Personal data we collect

• Account data — email, name, password hash, avatar
• Order data — products purchased, order history, download activity
• Support messages — anything you send us in writing
• Technical data — IP address, browser, device info, cookies

Payment data (card numbers, billing address, tax info) is collected by our payment provider, Paddle, and we do not see or store it.

How we use your data

• To create and manage your account (contract performance)
• To deliver your purchases and provide ongoing access (contract performance)
• To respond to support requests (legitimate interest)
• To improve our products and prevent fraud (legitimate interest)
• To send marketing emails — only if you opt in (consent)
• To comply with our legal and tax obligations (legal obligation)

Who we share data with

• Paddle — our Merchant of Record, who handles payments, subscription management, tax compliance, invoicing, and refunds.
• Service providers we rely on (hosting, email delivery, analytics) acting as subprocessors under written contracts.
• Professional advisers (accounting, legal) where needed.
• Authorities where required by law.

Data retention

We keep your account and order data for as long as your account is open and for a reasonable period afterwards to meet legal, tax, and accounting requirements. After that period, we delete or anonymise it.

Your rights

Depending on your country, you may have the right to access, correct, delete, or restrict processing of your personal data, to data portability, to object to processing, and to withdraw consent. To exercise any of these rights, contact us at the email address shown on the site footer. You may also lodge a complaint with your local data-protection authority.

Security

We use appropriate technical and organisational measures to protect your data — including encryption in transit, access controls, and secure managed hosting.

Cookies

We use essential cookies to keep you signed in and remember your cart, and limited analytics cookies to understand how the site is used. You can manage cookies through your browser settings.

International transfers

Some of our service providers are located outside your country. Where data is transferred, we rely on appropriate safeguards (such as Standard Contractual Clauses) as required by law.