Privacy Policy
This page explains what personal information we collect when you use All Things Cross Stitch, why we need it, who helps us handle it and what choices you have. We keep it to what the website needs to work. Last updated: October 14, 2026.
The short version
- We collect only what we need to run your account, deliver your patterns and run the Stitch Club.
- We never sell your personal information, and we do not use it for advertising.
- We do not use analytics cookies, advertising cookies or tracking pixels.
- Your card details go straight to Stripe, our payment provider. They never reach our server, and we never see your full card number.
- Photos you upload to Photo to Cross Stitch are deleted from our server within 30 days.
- You can ask to see, correct or delete your information at any time by emailing help@allthingscrossstitch.com.
1. Who we are
All Things Cross Stitch is run by NEXFOUR SOLUTION LTD, a company registered in England and Wales. We are the “controller” of your personal information, which means we decide how and why it is used. Because we are a UK company, we follow UK data protection law: the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. You can reach us about anything on this page at help@allthingscrossstitch.com.
- Trading name
- All Things Cross Stitch
- Company
- NEXFOUR SOLUTION LTD
- Company number
- 17460452 (registered in England and Wales)
- Registered office
- 60 Tottenham Court Road, Fitzrovia, London, W1T 2EW, United Kingdom
- help@allthingscrossstitch.com
2. What we collect
When you create an account
Your email address, your name if you give it, and your password. We store passwords only in scrambled (hashed) form, so nobody here can read them.
When you place an order
Your name, email address and country, what you ordered, the price, the date and the box you ticked at checkout to get your download right away. This applies to free patterns too. You type your card details into Stripe’s secure payment form, and they go straight to Stripe. We never see or store your full card number.
If you join the Stitch Club
Whether your membership is active, the date you joined, the date your paid time ends, a short history of changes (such as renewals and cancellations) and the customer reference Stripe gives us. Stripe keeps your card and billing details.
Your progress in the School and the Stitch Tracker
The challenges you finish, the badges you earn and the stitches you mark as done in the Stitch Tracker. Certificates show the first and last name on your account; only you can open your certificate, and you decide whether to share it. Stitch Tracker progress is also saved in your own browser (in its local storage), so you can keep stitching without an internet connection.
Patterns you add to the Stitch Tracker
If you add your own pattern files, we store them privately in your account. Only you can open them. They stay until you delete them or close your account.
Photos for Photo to Cross Stitch
The photo you upload, the size and title you choose, and the pattern our tool makes from it. Our pattern tool runs on our own server. Here is what happens to your photo:
- It is used only to make your pattern and the free preview.
- To suggest a name for the pattern and to read any words in the picture, the tool sends the picture once to OpenRouter, an AI service. Your name and email address are not sent with it. This is the only outside service the tool uses.
- Your original photo is deleted from our server within 30 days, whether you buy the pattern or not.
- Patterns you do not buy leave your account after 30 days.
- Patterns you buy (the PDF files, the chart file and the stitched preview picture) stay in your account so you can download them again.
Our email list
If you sign up for free patterns and news, or tick “email me” at checkout, we keep your email address, where you signed up and when you agreed.
Reviews
If you write a review, your rating, your words and the name shown with your review appear on the website once we have approved it. In our “What stitchers say” boxes we show only your first name.
Messages
Anything you send us by email, and our replies.
Technical information
Like every website, our server records your IP address, browser type, the pages you request and the time. We use these logs only to keep the website secure and working, for example to spot and block attacks.
3. Why we use it, and our legal reasons
UK law asks us to name a “lawful basis” for each use of your information. Here they are:
| What we do | Lawful basis |
|---|---|
| Create your account, deliver your downloads, run your Stitch Club membership, save your School and Stitch Tracker progress, make your Photo to Cross Stitch pattern | Contract (to give you what you asked for) |
| Take payments and prevent fraud | Contract, and our legitimate interest in not being defrauded |
| Send the picture to OpenRouter to suggest a pattern name | Contract, and our legitimate interest in giving your pattern a fitting name |
| Keep order and invoice records | Legal obligation (UK tax law requires us to keep them for 6 years) |
| Send you free patterns, new lessons and news by email | Consent (you can withdraw it at any time) |
| Show your review after we approve it | Consent (you choose to post it, and you can ask us to remove it) |
| Keep the website secure and working, and improve it | Legitimate interests |
| Answer your messages | Legitimate interests, or contract if it is about an order |
4. Who helps us, and what they see
We never sell your personal information. We share it only with the companies that help us run the website, and only as much as each one needs:
| Company | What they do for us | What they receive |
|---|---|---|
| DataWagon | Hosts our website and the Photo to Cross Stitch tool on a server in the United States | Everything stored on the website, held on our server |
| Stripe | Takes card payments and runs Stitch Club billing | Your name, email, card and billing details, and what you are paying for |
| Namecheap (Private Email) | Runs our email mailbox at our own domain and sends order emails | Your email address, your name and the emails between us |
| OpenRouter | AI service that suggests a name for your Photo to Cross Stitch pattern | The picture only, once, without your name or email |
| YouTube (Google) | Shows the lesson videos from other creators | See “Lesson videos” below |
Stripe also uses some information for its own fraud checks and legal duties. You can read how in Stripe’s privacy policy. We may also share information with our professional advisers (such as our accountant), and with the police, courts or other authorities when the law requires it. If we ever add a new service that receives your personal information, we will name it here first.
Lesson videos
Some lessons include videos from other creators’ YouTube channels. Before you press play, the page shows only the video’s preview picture, which your browser loads from YouTube’s image server (so that server sees your IP address, as any website you visit does). The video itself loads only when you press play, and it comes from YouTube’s privacy-enhanced mode (youtube-nocookie.com). Once you press play, YouTube’s own privacy policy applies to that video.
5. Where your information is stored
Our website runs on a server in the United States, and Stripe, OpenRouter and Namecheap may also handle information outside the UK. When personal information leaves the UK, UK law requires safeguards, such as the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Addendum, and we rely on those safeguards.
6. How we keep it safe
- The whole website uses a secure, encrypted connection (https).
- Your downloads, your photo patterns and your own Stitch Tracker patterns cannot be opened by a direct link. Only your logged-in account can open them.
- Our server has a firewall and protection against repeated break-in attempts, and it is backed up every day.
- If a data breach ever put your information at high risk, we would tell you, and we would report it to the Information Commissioner’s Office where the law requires.
7. How long we keep it
| Information | How long |
|---|---|
| Your account, progress and Stitch Tracker patterns | As long as you have an account. Ask us to close it and we will delete them. |
| Orders and invoices | 6 years after the end of the financial year they belong to, as UK tax law requires |
| Photos uploaded to Photo to Cross Stitch | Deleted within 30 days |
| Photo patterns you did not buy | Removed from your account after 30 days |
| Photo patterns you bought | As long as you have an account, so you can download them again |
| Email list | Until you unsubscribe |
| Messages | Up to 2 years after our last contact |
| Server logs | A short time, for security |
| Backups | 14 days, then overwritten. Something you delete can stay in a backup until then. |
8. Your rights
You have the right to:
- see the personal information we hold about you and get a copy;
- have it corrected if it is wrong;
- have it deleted, unless the law requires us to keep it (such as order records for tax);
- limit or object to how we use it;
- receive it in a common file format to take elsewhere;
- withdraw your consent at any time, for example by using the unsubscribe link in any of our emails.
To use any of these rights, email help@allthingscrossstitch.com from the email address on your account. Using your rights is free. We reply within one month, and we may ask you to confirm who you are first.
If you are unhappy with how we handle your information, please tell us first so we can put it right. You also have the right to complain to the UK regulator, the Information Commissioner’s Office (ICO), at ico.org.uk or by phone on +44 303 123 1113.
9. For customers in the United States
Most of our customers live in the United States, so here is the same information in the terms US privacy laws use:
- We do not sell your personal information, and we do not share it with anyone for advertising, including targeted or “cross-context behavioral” advertising.
- The kinds of information we collect, why, and who receives it are listed in sections 2 to 4 above.
- You can ask us to tell you what we hold about you, to correct it or to delete it. Email help@allthingscrossstitch.com and we will reply within one month. You may also ask someone you trust to contact us for you, with your written permission.
- We will never charge you more or treat you differently for asking.
- Because we do not sell or share personal information for advertising, there is nothing to opt out of, and that includes signals such as Global Privacy Control.
Many state privacy laws apply only to businesses above a certain size. Whether or not a particular law applies to us, we give these choices to every customer.
10. Cookies and similar storage
We use only strictly necessary cookies. They keep you logged in, remember what is in your cart through checkout, and keep your account secure. The website cannot work without them, so UK law does not require us to ask first.
The Stitch Tracker also saves your stitching progress in your browser’s local storage, on your own device, so your marks are not lost if your connection drops. Nothing in it is sent anywhere unless you are logged in, and then only to your own account with us. Clearing your browser data removes it.
We do not use analytics cookies, advertising cookies or tracking pixels. If we ever want to add any, we will update this page and ask for your consent first. YouTube may set its own cookies only after you press play on a lesson video.
11. Children
Our website is meant for adults. It is not directed at children under 13, and we do not knowingly collect their personal information. Young stitchers are welcome to learn with a parent or guardian, who should create and manage the account. If you think a child has given us personal information, email us and we will delete it.
12. Changes to this policy
We update this page when the way we use personal information changes, and we show the new date at the top. If a change affects you in an important way, we will also tell you by email.
Questions about your privacy? Email help@allthingscrossstitch.com.