The person behind the paper house
Hushwick Paper House is operated by Marek Kouřimský, a sole trader in the Czech Republic, business registration 09427767. SourceRow is the project name; it is not a separate seller.
The registered business address has not yet been supplied. Direct sales remain closed until the required seller information is complete.
A customer contact telephone remains to be supplied before direct sales.
The applicable business register entry remains to be verified before direct sales.
Contact for orders, privacy, complaints and accessibility: marekkourimsky@gmail.com.
A small shop, a clear boundary
This notice describes information handled by this Hushwick website. If you follow a link to itch.io or another marketplace, that service has its own checkout, account and privacy rules. We do not receive your payment-card number through this shop.
We do not sell personal data, install advertising pixels or create advertising profiles. Books are intended for use by families, but purchases and support should be handled by an adult. We do not ask for a child’s name, birthday, photograph or school.
What we use, and why
- Orders and delivery · performance of a contract
- When checkout is available: email, ordered titles and editions, country, payment status, order reference, delivery access and your immediate-digital-delivery choice. A physical order would also require delivery details. Missing required information prevents that order being fulfilled.
- Support · contract or legitimate interest
- Your reply address, message, order reference and information needed to resolve the question. Our legitimate interest is answering enquiries and keeping a proportionate record of resolved issues. Do not include passwords, card numbers or private details about children.
- Records required by law · legal obligation
- Relevant transaction and tax records, consumer complaints and legally required responses. The applicable record category determines what must be retained; a deletion request does not override a legal retention duty.
- Security · legitimate interest
- Selected rejected requests, time, route category, status, technical reference and the address reported by the hosting proxy. This supports abuse prevention and incident investigation. Addresses are masked by default, are not verified visitor identities, and are not a basis for automatic IP bans. Request bodies, passwords, cookies and access tokens are not included in our security notebook.
- Optional audience measurement · consent
- Only after your choice: page and book interactions, coarse source/device categories, approximate sessions and active seconds while the page is visible and focused. We store daily totals, not a named visitor profile or browsing history. No raw referring URL, query, IP, email or session identifier is sent with these events. You can refuse or withdraw without losing access to books or samples.
- Delivery reliability · contract and legitimate interest
- The server records aggregate file-response starts and bytes offered to identify delivery problems. These do not prove a completed download or a person reading a file. Paid-order and refund totals come from verified order records, not from browser analytics.
Letters and the proposed Paper Club
Newsletter and club-launch requests are separate, optional permissions. We record the adult subscriber’s email, chosen interface and book language, digital or print interest, the consent wording and version, confirmation times and delivery/suppression status. A confirmation email requires an explicit second action; merely opening the link does not subscribe you. We do not request children’s names or details.
You can unsubscribe from each mailing purpose through its email link. Messages use no opening pixel or click-tracking redirect. A minimal opt-out record is retained to prevent unwanted re-subscription and demonstrate the choice; request erasure or a copy through our contact page. A bounce or complaint can suppress both mailing purposes.
A reader’s library uses the signed-in account email to find their own completed, non-refunded purchases and explicit complimentary issue access. Issue, expiry and access records support fulfilment and security. A complimentary key or a waiting-list request never creates a paid subscription.
Confirmation links expire after 48 hours. Never-confirmed requests inactive for seven days are removed in bounded cleanup during signup or administration activity. Confirmed permissions remain until withdrawal or an erasure request, subject to necessary evidence and suppression records. No idle background deletion is promised.
How long information stays
Our selected security events expire after the configured 14 days. Optional measurement and delivery aggregates currently have a 90-day window. Records are bounded and cleanup runs when the relevant service is used; this is not a promise of an idle background deletion job. Hosting providers may retain separate infrastructure records under their own rules.
Order and correspondence retention depends on fulfilment, a still-open complaint or dispute and applicable statutory record-keeping periods. Before direct sales begin, the seller must confirm the accounting category and retention schedule. A genuinely unresolved legal claim may require longer restricted retention. Routine enquiries are reviewed for deletion when no longer needed; this website does not automatically delete your email from the support mailbox.
Aggregates that contain no link to an identifiable person cannot be searched as a personal visit history. We do not collect extra identification just to make anonymous aggregate data identifiable.
Services that help run the shop
The site uses OpenAI Sites for hosting orchestration and owner sign-in, with Cloudflare Workers, D1 and R2 for application processing and file storage. Cloudflare Turnstile checks short-lived browser signals when a protected form is opened; the verification token is not retained in our order data.
Resend delivers transactional, confirmation and explicitly requested newsletter or club-launch email from the approved vorio.tech sending domain; replies go to the support Gmail address. Google processes correspondence delivered to that mailbox. Payment processing will be described here before the deferred Stripe connection is opened for customer use. No marketing subscription is created by downloading a sample or placing an order.
Provider infrastructure can involve processing outside the European Economic Area. Provider notices describe their international processing. The seller must document the applicable processing agreements, roles and transfer safeguards before public commercial launch; this page does not claim that those contractual checks have already been completed. You can ask the contact below for the applicable safeguards.
Your choices and rights
You may request access, correction, erasure, restriction or, where applicable, portability of your personal data. You may object to processing based on legitimate interests. Consent can be withdrawn at any time, without changing the lawfulness of processing before withdrawal. Optional analytics can be switched off through Cookie choices.
Write to marekkourimsky@gmail.com and describe your request. Use the order email or reference if relevant, but do not send an identity document by default. If reasonable doubts remain, we may ask for proportionate evidence to avoid disclosing data to someone else. A response is due without undue delay and normally within one month; a permitted extension must be explained within that first month.
You may complain to the Czech Office for Personal Data Protection (ÚOOÚ), or the supervisory authority where you habitually live, work or believe an infringement occurred. No decision with legal or similarly significant effects is made about you solely through automated profiling in this shop.