Your data, treated
like a letter.
Private, handled with care, and never passed around. Here is exactly what we collect, why, and how to take it back — in plain language, the way the GDPR intends.
Only what the post needs
An address to send a card, an email to write back. Nothing else.
Never sold, never rented
Your data is not a product. We don’t sell it or trade it. Full stop.
Yours to take back
Access, export or delete everything, any time, in a single email.
Who is responsible
Silvia Mogas is the data controller for Longhand. That means the buck stops here — one person, accountable for every address and email you trust us with.
Questions, or want to exercise a right? Write to silviamogas@gmail.com. A real person reads it.
What we collect, and why
We ask for as little as the post allows. Each row below is a legal basis under Article 6 of the GDPR — nothing is collected “just in case.”
| Data | Purpose | Legal basis | Kept |
|---|---|---|---|
| Email address (newsletter) | Send the occasional dispatch you asked for. | Consent | Until you unsubscribe. |
| Name, email & shipping address (postcard orders) | Address the card, deliver it and keep you posted. | Performance of a contract | For the life of your membership, then archived per tax law. |
| Payment details | Take payment securely for a postcard or membership. | Performance of a contract | Held by Stripe — never stored on our servers. |
| Messages you write back | Continue the correspondence you started. | Consent | Until you ask us to delete them. |
Who helps us deliver
A few trusted services process data on our behalf, each under a data processing agreement. We don’t sell or rent your data to anyone, and we never will.
- SupabaseDatabase & membership recordsEU
- StripePayment processingEU / US (SCCs)
- BeehiivNewsletter deliveryUS (SCCs)
- VercelWebsite hostingEU / US (SCCs)
Where data reaches a country outside the EU, the transfer is covered by the European Commission’s Standard Contractual Clauses (SCCs).
Your rights
Under the GDPR these are yours, always. To use any of them, email silviamogas@gmail.com — we respond within 30 days.
Access
Ask for a copy of the data we hold about you.
Rectification
Have anything inaccurate corrected.
Erasure
Ask us to delete your data (“right to be forgotten”).
Portability
Receive your data in a portable format.
Restriction
Limit how we use your data.
Objection
Object to processing, including any marketing.
Withdraw consent
Change your mind at any time, with no penalty.
If you believe we’ve mishandled your data, you can complain to the Agencia Española de Protección de Datos (AEPD). We’d rather you told us first, though — we’ll make it right.
Keeping it safe
Data travels over encrypted connections and is stored with reputable providers. Payment details are handled entirely by Stripe and never touch our own servers. Access is limited to what’s needed to send you a postcard.
Changes to this policy
If this policy changes in a way that matters, we’ll update the date at the top and, where the change is significant, tell you by email. This version is dated 16 July 2026.
One inbox for all of it