Last updated: 14 October 2026
Who we are
The controller responsible for your personal information is Shaun Lamonte, trading as Pale Blue Studios, Louisiana, United States. You can contact us at team@ivansinfiniteimagination.com.
We are in the process of forming a company and will update these details when it is registered.
Newsletter updates
When you choose to subscribe, we collect your email address and, if you provide it, your first name. We record when and how you opted in so we can manage your subscription. Our lawful basis is your consent.
Buying merchandise does not subscribe you to marketing. The newsletter checkbox at checkout is optional and unticked by default. You can unsubscribe using an email’s unsubscribe link or by contacting team@ivansinfiniteimagination.com. We keep newsletter contact information until you unsubscribe, then remove it from our mailing list and newsletter contact database. Transactional order records are kept separately.
Orders and delivery
Stripe checkout collects your name, email address, phone number, shipping address and billing details, as well as the information needed to process payment. We keep order references, purchased items and variants, amounts, payment status and delivery details. Stripe handles full card numbers and security codes; we never see or store them.
We use this information to take payment, make and deliver your order, send order updates and deal with returns. Our lawful basis is performing our contract with you. Tax and accounting records are kept to meet legal obligations.
Our fulfilment partner is Pressed and Prettied, based in Louisiana. They receive your customer name, shipping address and order details only to make and deliver your order. Postal and delivery services handle the details needed to deliver parcels.
We keep order records for seven years for tax and accounting purposes.
Enquiries and business contacts
Our contact form asks for your name, email address, enquiry type and message. We use these to reply and resolve your enquiry. The form sends a message to our team mailbox rather than creating a separate contact-form database record.
Our lawful basis is legitimate interests in answering enquiries, or steps towards a contract if you ask about an order, licensing or a partnership. We keep general correspondence only for as long as needed to resolve it and meet any related legal obligations.
For relevant business correspondence about our show, we may use publicly listed business contact details or details you give us directly. Our lawful basis is legitimate interests in relevant business communication, subject to applicable marketing rules. You can ask where we found your details or ask us to stop by replying or emailing team@ivansinfiniteimagination.com. Business outreach contacts are deleted on request, otherwise 24 months after the last contact.
Website analytics
Our website analytics record aggregate daily counts by page and broad device category: mobile, tablet or desktop. They do not store visitor identifiers, IP addresses, referring sites or individual browsing histories, and do not recognise you across visits. We use these counts to understand which pages are useful.
Our hosting and security providers necessarily process technical information, such as network addresses, to deliver and protect the website. Their operational logs are separate from our aggregate website analytics. Our lawful basis for necessary security processing is legitimate interests in keeping the service safe.
Admin portal and YouTube reporting
Founder accounts use names, usernames, password hashes, secure session records, sign-in controls and an audit trail of key actions. Two-factor authentication uses encrypted authenticator secrets and hashed recovery codes. Our lawful basis is legitimate interests in secure administration. Access and security records are retained only for as long as needed to manage access, investigate incidents and meet legal obligations.
An authorized founder can connect the show’s YouTube channel for read-only channel and video statistics and available aggregate audience reports. We store the verified channel name and ID, granted permissions, connection status and encrypted authorization credentials. These credentials are used only for the connected reporting feature and are retained while needed for that connection.
We do not use Google authorization data for advertising, sell it or use these reporting permissions to post content. Our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.
Service providers and international processing
Replit hosts the website, application, database and stored media, including operational security services. Resend sends newsletter, welcome, enquiry and order emails, processing the recipient details and message content needed to deliver them. Stripe handles checkout, payments, tax calculations and payment-related records.
Pressed and Prettied receives only customer name, shipping address and order details to make and deliver merchandise. Google provides the optional YouTube player and the connected channel-reporting service.
Providers and their infrastructure may process information in the United States or other countries. Where GDPR or UK GDPR requires safeguards for an international transfer, we use appropriate arrangements, such as applicable adequacy decisions or standard contractual clauses. Contact us for information about the arrangements relevant to your data.
Book retailers and social platforms linked from this site have their own privacy policies. Their services are separate from this website.
Cookies and browser storage
We use browser local storage to remember cart items, variants and quantities until you clear them or your browser removes the data. A tab-local navigation value remembers a homepage section to scroll to and is removed after use. These features are functional, not visitor tracking.
The admin portal uses an essential HttpOnly session cookie, ivan_admin_session, with a maximum life of 12 hours and a 30-minute server-side idle timeout. The public page-count tracker does not use this cookie.
No YouTube iframe loads until you choose to load that player. It uses youtube-nocookie.com, but loading or playing still sends network, device and player information to Google, which may use its own storage. The loading choice stays in memory for that player, not in a persistent consent cookie.
Stripe checkout and hosting infrastructure may use necessary payment, session or security cookies. We do not run advertising cookies or a third-party visitor-analytics integration in the application.
Children
The show is for children, but website forms, newsletter subscriptions and purchases are for adults. We do not knowingly collect personal information from children under 13. This approach reflects the protections addressed by the Children’s Online Privacy Protection Act (COPPA). Please do not include a child’s personal details in messages.
If we learn that we have received a child’s personal information, we will delete it and seek deletion from relevant providers where necessary. A parent or guardian can contact team@ivansinfiniteimagination.com to raise a concern or request deletion.
GDPR and UK GDPR rights
Where GDPR or UK GDPR applies, you may have rights to access your information, correct it, request deletion, restrict processing, object to processing based on legitimate interests and receive eligible data in a portable form. You can withdraw consent without affecting processing that was lawful before withdrawal.
Email team@ivansinfiniteimagination.com to exercise your rights. We may ask for enough information to verify your identity safely. Some records may need to be kept to meet legal obligations. You can also complain to the data protection authority where you live or work, or where you believe an infringement occurred.
For US visitors
We do not sell personal information. We do not share it for cross-context behavioural advertising. Depending on the laws that apply to you, you may have additional rights to know about, access, correct or delete your information. Contact us to make a request; exercising an applicable privacy right will not result in unlawful discrimination.
Deletion and provider copies
When information is due for deletion, we remove it from the relevant active records and seek appropriate deletion from providers. Information may remain temporarily in protected backups or where a legal obligation requires retention. We restrict those copies and do not use them to continue marketing.
For any privacy question, contact team@ivansinfiniteimagination.com.