Privacy Policy

Last updated: October 9, 2026

This Privacy Policy explains how Tinker Table Lab collects and uses personal information when you visit our website or buy our digital products. Tinker Table Lab is a brand of Hydra Constellation SRL.

1. Who we are

The data controller is Hydra Constellation SRL, Via Riace 76, 00118 Roma, Italy. You can reach us about privacy at productadvice.info@gmail.com.

2. Who this site is for

Our website and products are for adults buying for their family. The projects are designed for children aged 5 to 12 to build with an adult, but the website, the checkout and our emails are directed to parents and caregivers, not to children. Our website is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, email us and we will delete it.

3. What we collect

• Contact and order details: your email address, the products you bought, the amount paid, the date and time of the order and your order history.
• Payment details: payments are processed by Stripe. Stripe collects your card or wallet details directly. We do not receive or store full card numbers. We receive limited payment information from Stripe, such as the payment status, the card brand, the last four digits and the billing country.
• Device and usage data: your IP address, browser and device type, pages viewed, the page that referred you, and actions on our site such as viewing a page, starting checkout and completing a purchase. Some of this is collected through cookies and similar technologies, including the Meta Pixel.
• Support messages: anything you send us by email.

4. Cookies, the Meta Pixel and the Conversions API

We use the Meta Pixel, a small piece of code from Meta Platforms, on our website. It uses cookies to measure visits and purchases and to help us show our ads to people who may be interested. We also use the Meta Conversions API, which sends purchase events from our server to Meta. When we send your email address through the Conversions API, it is hashed (converted into a coded string) before it leaves our server. Meta may use this information as described in its own data policy.

• Visitors in the European Economic Area, the United Kingdom and Switzerland see a consent banner. We load the Meta Pixel and send Conversions API events only after you accept. You can change your choice at any time with the Your Privacy Choices link at the bottom of every page.
• Visitors elsewhere, including the United States: the Meta Pixel and Conversions API are on by default. You can turn them off with the Your Privacy Choices link at the bottom of every page. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out of sharing for advertising, and we do not load the Meta Pixel or send Conversions API events for that browser.

We also use strictly necessary cookies and local storage so the site, the checkout and your privacy choice work properly.

5. Why we use your information and our legal bases

Because Hydra Constellation SRL is established in the European Union, we follow the EU General Data Protection Regulation (GDPR). We use your information:

• To process your order and deliver your files (performance of a contract): taking payment, sending your download links, sending fresh links when you ask at /access.
• To provide customer support and handle refunds (performance of a contract and legitimate interest).
• To keep records required by law (legal obligation): accounting and tax records of sales.
• To protect our site and prevent fraud (legitimate interest).
• To measure and improve our advertising with the Meta Pixel and Conversions API (consent in the EEA, UK and Switzerland; legitimate interest elsewhere, with the right to opt out at any time).
• To send marketing emails (consent): only if you opt in. Every marketing email has an unsubscribe link.

6. Who we share information with

We do not sell your personal information for money. We share it only with service providers who help us run the store:

• Stripe: payment processing and fraud prevention.
• Resend: sending transactional emails such as your download links.
• Klaviyo: marketing emails, only if you gave consent.
• Meta Platforms: advertising measurement through the Meta Pixel and the Conversions API, as described above.
• Lovable and Supabase: website hosting, database and file storage.

We may also disclose information if the law requires it, to protect our rights, or as part of a sale or restructuring of our business.

7. International transfers

Some of our service providers are located in, or process data in, the United States and other countries outside the European Economic Area. Where required, these transfers rely on safeguards recognized under the GDPR, such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework where the provider participates in it.

8. How long we keep information

• Order and payment records: for as long as tax and accounting law requires.
• Download links: each link expires after 7 days. Your order record stays so you can request fresh links at /access.
• Marketing data: until you unsubscribe or withdraw consent.
• Support emails: as long as needed to resolve your request and handle any follow-up.
• Advertising data held by Meta: according to Meta's own retention policies.

9. Your rights under the GDPR

If the GDPR applies to you, you have the right to access your personal data, correct it, delete it, restrict or object to its use, receive a copy in a portable format, and withdraw consent at any time without affecting earlier processing. You also have the right to complain to a data protection authority. In Italy, this is the Garante per la protezione dei dati personali. To use your rights, email productadvice.info@gmail.com.

10. Your rights as a US resident

Depending on the state where you live, such as California, you may have the right to:

• Know what personal information we collect, use and disclose, and to get a copy of it.
• Delete personal information we hold about you, subject to legal exceptions such as tax records.
• Correct inaccurate personal information.
• Opt out of sharing your personal information for targeted (cross-context behavioral) advertising.

We do not sell personal information for money. Our use of the Meta Pixel and Conversions API for advertising may count as "sharing" or "targeted advertising" under some state laws. To opt out of sharing for advertising, use the Your Privacy Choices link at the bottom of every page, turn on Global Privacy Control in your browser, or email us with the subject line "Do not share my information."

To make any other request, email productadvice.info@gmail.com. We may need to confirm your identity by checking the email address on your order. You may use an authorized agent. If we deny your request, you can appeal by replying to our answer. We will not treat you differently for using your privacy rights.

11. Security

We use reputable providers and reasonable technical and organizational measures to protect your information. No method of transmission or storage is completely secure.

12. Changes to this policy

We may update this policy. We will post the new version on this page with a new "Last updated" date.

13. Contact

Hydra Constellation SRL, Via Riace 76, 00118 Roma, Italy. Email: productadvice.info@gmail.com