Legal

Privacy Policy

Short version: this site has no advertising, no analytics and no tracking scripts. What you write in a review is published; everything else stays on the server and is kept only as long as it is useful.

Last updated 14 November 2026.

Who is responsible

Diamond Painting Reviews (diamondpaintingreviews.com) publishes independent reviews of diamond painting manufacturers, wholesale suppliers and shops. For anything in this policy, including any request about your data, write to [email protected] or use the contact form.

What we collect, and why

Reviews you submit

A review stores the star rating, headline, review text, the display name and the location you type, and the date. All of it except the date is published on a public page. Use a first name and a city, or an invented display name - the name field is yours to fill however you like, and nothing checks it against your identity. Do not put your email address, order number or anything else private in the review body; it will be visible to everyone permanently.

Contact messages

The contact form stores your name, your email address, the topic and your message. Your email address is used to reply to you and is never published, never added to a mailing list (we do not run one) and never sold.

Technical data kept for spam prevention

To stop the review and contact forms being flooded, we record a one-way hash of your IP address together with a timestamp. The hash is made with a secret held on the server, so it cannot be turned back into an IP address by anyone reading the database, and it is never shown on the site. Rate-limit counters are deleted after 24 hours. When a review is stored, the same hash is kept with it so a single person flooding a profile can be spotted; contact us and we will delete it.

Server logs

Our hosting provider records standard request logs - IP address, page, time, browser string - as every web host does, and rotates them on their own schedule. We read them only when diagnosing a fault or investigating abuse.

What we do not collect

No analytics platform, no advertising network, no social pixels, no session recording, no cross-site tracking, no browser fingerprinting, no newsletter. There is no user account, no login and no profile of individual readers.

Cookies

Reading this site sets no cookies at all. The only cookie anywhere on the domain belongs to the password-protected moderation page, which stores a session cookie for the person approving reviews; ordinary visitors never receive one. Because there are no cookies and no trackers, there is nothing to consent to and no cookie banner.

Who else sees your data

Our hosting provider - stores the site files and the SQLite database that holds reviews and messages.
Cloudflare - the CDN and bot-protection layer in front of the site. Like any reverse proxy it sees the IP address and request headers of every visitor, and it filters automated traffic before it reaches the server. If the review and contact forms are running the Cloudflare Turnstile check, the browser also loads a widget from Cloudflare and receives a verification token; that interaction is covered by Cloudflare's privacy policy. When Turnstile is not configured, the form uses a question this server generates and validates itself, and no third party is involved in the check.
Nobody else. We do not sell, rent or share personal data, and we have no advertising or analytics partners to share it with.

Both providers may process data outside your country. Where that happens it is covered by their own standard contractual clauses.

Why we are allowed to do this

Where the GDPR or a similar law applies: publishing a review is done on the basis of your consent, given by submitting it; keeping the technical data described above is our legitimate interest in keeping the forms usable; and answering a message is necessary to respond to your request.

How long we keep it

Published reviews - until you ask us to remove them. There is no expiry.
Rate-limit and abuse counters - deleted automatically after 24 hours.
Contact messages - up to 12 months after the conversation ends, then deleted.
Held reviews that were never approved - deleted within 30 days.

Your rights

You can ask us to show you what we hold about you, correct it, delete it, or stop using it. For anything you posted, deletion is immediate and unconditional once we can identify the review - email the profile link and the display name you used. Everything else is handled within 30 days. If you think we have got it wrong you can also complain to your national data protection authority; we would rather you told us first.

California residents: we do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not knowingly collect information from anyone under 16. The rights above apply to you as well.

Children

The site is written for adults buying craft supplies and is not directed at children. We do not knowingly keep reviews or messages from anyone under 16; tell us and we will remove them.

Security

The site is served over HTTPS end to end. Review and contact forms are checked on the server - by Cloudflare Turnstile when it is configured, otherwise by a question only this server can validate - and rate-limited, the moderation queue is password-protected, and configuration and database files are blocked from web access. No system is perfect, and no site can promise absolute security.

Links to other sites

Profiles link out to the businesses they describe. Once you follow one of those links you are on someone else's site under their privacy policy, not ours. We have no visibility into what they collect.

Changes

If this policy changes, the date at the top changes with it. Substantial changes - a new category of data, or a new third party - will be noted on the about page for at least 30 days.