Privacy Policy

Last updated: 19 July 2026. This is placeholder content pending legal review.

Who we are

SLEEPWALK Press (“we”, “us”) is a publishing, curation, and merchandise project based in Prague, Czech Republic. We are the data controller for the personal data described here. To exercise any of your rights or ask a question, contact [email protected]. [Add registered postal address and company/VAT number before launch.]

What we collect and why

• Newsletter signups. Your email address and a record of your consent (including a timestamp). Lawful basis: your consent. We use a double opt-in, so you confirm your subscription by email before receiving anything.
• Orders & payments. If you buy something, we process the details needed to fulfil your order (items, shipping/contact details) and payment is handled by our payment processor. Lawful basis: performance of a contract.
• Technical logs. Standard server and CDN logs (e.g. IP address, request metadata), generated by our host in the course of serving the site and retained briefly for security. Lawful basis: legitimate interest in keeping the service secure.

Cookies and analytics

We use only strictly necessary cookies — for signing in to the admin area, keeping a shopping cart, and completing payments. These are required for the site to function and do not require consent.

We do not use advertising or cross-site tracking cookies. We currently run no third-party analytics. If we add analytics in future, we intend to use a privacy-focused, cookieless solution that does not track you across sites, and we will update this policy accordingly.

Who we share data with (processors)

We self-host the systems that hold your data — our newsletter system (Listmonk) and our content and subscription backend (Payload) both run on our own infrastructure in the European Union. Your subscriber data is not handed to a third-party email marketing service. We rely on three external processors:

• Cloudflare — hosts and delivers this website via Cloudflare Pages. In doing so Cloudflare processes technical request data, including your IP address, to serve the site and protect it from abuse.
• Brevo — relays our outgoing newsletter and confirmation emails. Brevo processes your email address in order to deliver those messages. It stores no subscriber list on our behalf; our list stays on our own servers in the EU.
• Stripe — processes card payments at checkout. Stripe receives the payment information necessary to complete and secure your transaction. See Stripe’s own privacy policy for details.

We do not currently ship physical orders, so we use no fulfilment or shipping processor. If that changes we will update this list before taking any orders.

How long we keep it

Specifically:

• Newsletter subscriptions — until you unsubscribe or ask us to delete your data. After you unsubscribe we keep a minimal record of your consent and its withdrawal for 3 years, so we can demonstrate that we handled it correctly.
• Order and payment records — 10 years, as required by Czech accounting and VAT law.
• Technical logs — no longer than 30 days.

[Confirm these periods with legal review before launch — in particular whether 5 or 10 years applies to the order records we actually end up holding.]

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased (“right to be forgotten”);
• receive your data in a portable format;
• object to or restrict certain processing;
• withdraw consent at any time (e.g. by unsubscribing) without affecting prior processing.

To exercise any of these, email [email protected]. You also have the right to lodge a complaint with your local supervisory authority (in the Czech Republic, the Office for Personal Data Protection / ÚÓOÚ).

Changes to this policy

We may update this policy from time to time. The “Last updated” date above reflects the latest version.