Privacy Policy
Last updated: November 10, 2026
This Privacy Policy explains how personal data is collected and used when you visit luigi-tuscany.pagesandplans.com (the "Website") or buy our digital cookbooks. Because we sell to customers in the European Union, we apply the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") to all customers, together with applicable US privacy laws.
1. Who is responsible for your data
The data controller is Steady Path LLC, a limited liability company registered in Wyoming, USA, with its address at 30 N Gould St #60629, Sheridan, WY 82801, USA (EIN 32-0841465) ("we", "us").
Contact: steadypathllc@gmail.com. We have not appointed a Data Protection Officer (DPO), as it is not required for our activity. Please send any privacy request to this email address.
2. What we sell
Through the Website we sell the digital cookbook "The Taste of Tuscany" and optional digital add-ons and regional cookbooks (for example "Host Like a Tuscan" and the Umbria regional cookbooks). All products are PDF downloads, delivered by an email link right after payment. Prices are in US dollars.
3. Data we collect
- Identity and contact data: your name and email address.
- Billing data: billing country and address, as far as the checkout requires.
- Order data: the products you bought, order date and payment status.
- Technical and usage data: IP address, device and browser data, cookie and visitor identifiers, the pages you visit and the links or buttons you click, and the advertising campaign that brought you to the Website.
- Anonymous interaction data: where you click on a page and how far you scroll, recorded without your name, email, IP address or any visitor identifier, so we can see which parts of our pages are useful (a "heatmap").
- Communications: messages you send us, for example for customer support.
We never see or store your full card details. Payments are handled by Stripe and PayPal.
4. Why we use your data and on what legal basis
- To process your order, deliver the files and provide support – performance of the contract (Art. 6(1)(b) GDPR).
- To keep invoices and accounting records – compliance with legal obligations (Art. 6(1)(c) GDPR).
- To measure and improve the Website, including the anonymous heatmap, and to prevent fraud and abuse – our legitimate interest in running a secure and useful shop (Art. 6(1)(f) GDPR).
- To measure and personalise advertising with the Meta Pixel and Conversions API – your consent where the law requires it (Art. 6(1)(a) GDPR).
- To send you marketing emails – your consent, or, for existing customers where the law allows, our legitimate interest in offering similar products. Every email has an unsubscribe link.
Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing done before.
5. Who receives your data
We share data only with service providers that help us run the shop, acting as processors or independent controllers:
- Pages and Plans: the platform that hosts the Website, checkout, order management and our contact database. It runs on Vercel (hosting) and Supabase (database and storage).
- Brevo (Sendinblue SAS, France): delivery of order and marketing emails.
- Stripe and PayPal: payment processing. They act under their own privacy policies, and we only receive confirmation of payment and limited order details.
- Meta Platforms: Meta Pixel and Conversions API for advertising measurement and retargeting.
- Google Fonts: the Website may load fonts from Google, which can involve your IP address being sent to Google.
- Our accountants and advisers, public authorities or courts, where the law requires it.
We do not sell your personal data for money.
6. International transfers
We are based in the United States, and some of our providers (such as Meta, Stripe, PayPal, Google, Vercel and Supabase) may process data in the United States or other countries outside the European Economic Area. Where GDPR applies, we rely on an adequacy decision, such as the EU-US Data Privacy Framework for certified companies, or on the European Commission's Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for more information at steadypathllc@gmail.com.
7. How long we keep your data
- Order and invoicing data: for as long as tax and accounting laws require (generally up to 10 years).
- Marketing data: until you unsubscribe or withdraw consent.
- Anonymous heatmap data: up to 12 months.
- Support messages: as long as needed to handle your request and for a reasonable time afterwards.
- Cookies: for the periods listed in our Cookie Policy.
8. Your rights
Under the GDPR you have the right to:
- access your personal data and receive a copy;
- have inaccurate data corrected (rectification);
- have your data erased, where the law allows ("right to be forgotten");
- restrict the processing of your data;
- receive your data in a portable format (portability);
- object to processing based on legitimate interest, and to direct marketing at any time;
- withdraw your consent at any time.
To use these rights, email steadypathllc@gmail.com. We reply within one month. We may ask you to confirm your identity. Some data, such as invoices, must be kept by law, so we may not be able to erase it before the retention period ends.
If you live in the European Union, you also have the right to lodge a complaint with the data protection authority of your country of residence. We would appreciate the chance to help you first.
9. Buyers outside the European Union
United States (including California): we do not sell personal data for money. Sharing data with Meta through the Meta Pixel for advertising may count as "sharing" under some US state laws. You can ask us to stop it, to tell you what data we hold about you, and to delete or correct it, and we will not treat you differently for doing so.
Canada, Australia, New Zealand and the United Kingdom: you can ask for access to and correction of your personal information, and you can complain to your local privacy regulator (for example the Office of the Privacy Commissioner of Canada, the Office of the Australian Information Commissioner, the New Zealand Privacy Commissioner or the UK Information Commissioner's Office). We apply the GDPR standards described in this policy to all customers.
10. Security
We use reputable providers and reasonable technical and organisational measures to protect your data, including encrypted connections (HTTPS). No online service is completely secure, but we work to keep your data safe.
11. Children
The Website is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.
12. Changes to this policy
We may update this policy from time to time. The date at the top shows the latest version. If we make important changes, we will tell you on the Website or by email where appropriate.
13. Contact
Questions about privacy? Write to steadypathllc@gmail.com or by post to Steady Path LLC, 30 N Gould St #60629, Sheridan, WY 82801, USA.
Steady Path LLC · 30 N Gould St #60629, Sheridan, WY 82801, USA · EIN 32-0841465 · steadypathllc@gmail.com