Rail and Pocket

Privacy Policy

Last updated: October 16, 2026

Who we are. This website and the Rail and Pocket brand are operated by Rail and Pocket ("we", "us"). We are the data controller for the personal information described here. Contact: productadvice.info@gmail.com.

What we collect.

  • Order information: your email address, the products you bought, the amount paid, and the date and time of the order.
  • Payment information: payments are handled by Stripe. We do not see or store your full card number. Stripe shares with us limited details such as the card brand, the last four digits and the payment status.
  • Device and usage information: IP address, browser and device type, pages viewed and actions such as adding to cart or purchasing. This is collected through cookies and the Meta Pixel in your browser, and through the Meta Conversions API from our server, which sends event data including a hashed (scrambled) version of your email address.
  • Messages: what you send us when you email support.

Cookies. We use cookies that are necessary for the site and checkout to work, and, where allowed, advertising and measurement cookies such as the Meta Pixel. Visitors in the European Economic Area, the United Kingdom and Switzerland see a consent banner, and advertising cookies stay off until they agree. You can change your choice at any time through the Your Privacy Choices link at the bottom of every page.

Why we use your information and our legal bases (GDPR). Because we are established in the European Union, we follow the EU General Data Protection Regulation.

  • To process your order, deliver your files and send download and access emails: performance of a contract.
  • To handle refunds, support requests and fraud prevention: performance of a contract and our legitimate interests.
  • To keep accounting and tax records: legal obligation.
  • To measure and improve our ads and website with the Meta Pixel and Conversions API: your consent where required (EEA, UK and Switzerland), otherwise our legitimate interests, subject to your right to opt out.
  • To send marketing emails through Klaviyo: only with your consent, which you can withdraw at any time with the unsubscribe link.

Your rights. You can ask to access, correct, delete or export your data, to restrict or object to processing, and to withdraw consent at any time. You can also complain to your local data protection authority.

For US residents. Depending on your state, including California, you may have the right to know what personal information we collect and how we use and disclose it, to delete it, to correct it, and to opt out of the sharing of personal information for targeted advertising. We do not sell personal information for money. We do share limited device and event data with Meta for advertising, which some state laws treat as "sharing". To opt out of sharing for advertising, use the Your Privacy Choices link at the bottom of every page, turn on Global Privacy Control in your browser, or email us with the subject line "Do not share my information." We will not discriminate against you for using these rights. You can use an authorized agent, and we may need to verify your request using your order email.

Who processes your data for us.

  • Stripe: payments
  • Resend: transactional email (order and access links)
  • Klaviyo: marketing email, only with your consent
  • Meta Platforms: advertising measurement (Meta Pixel and Conversions API)
  • Lovable and Supabase: website hosting and database

How long we keep it. Order and accounting records are kept for as long as applicable tax and accounting law requires (generally 10 years). Support emails are kept for up to 2 years. Marketing data is kept until you unsubscribe or ask us to delete it. Advertising cookie data is kept according to the cookie settings described in the consent banner.

International transfers. Some of our processors are based in, or store data in, the United States and other countries outside the EU. Where required, these transfers are protected by the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

Children's privacy. This website is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us information, email us and we will delete it.

Changes. We may update this policy. The date at the top shows the latest version.

Contact. productadvice.info@gmail.com.