Privacy Policy - VeryCosy.com

Last updated: August 17, 2026

This policy describes what VeryCosy.com collects, why, who else can see it, and what you can do about it. It is written against the software this site actually runs rather than a generic template, so where a service is named you can go and check it.

VeryCosy.com is a product review site. It does not sell goods, take payments or ship anything. Purchases happen on Amazon after you leave here, and Amazon becomes the data controller from the moment you land on its site.

The software that runs this site

WordPress. The publishing platform. It writes server access records and sets session cookies for signed in administrators. Ordinary readers are not signed in to anything.
WooCommerce. Installed because it supplies the product catalog and category structure. It can set a temporary browser session so catalog pages behave consistently. No checkout, no payment processing and no card data on this site.
A first party analytics tracker. Traffic is measured by our own analytics component, which posts events to an analytics service we operate rather than to an advertising network. It records the page address, the referring page, rough device and browser type, and timing. Your IP address is hashed before it is stored, so it is not held in readable form.
Cloudflare. Cloudflare sits in front of the origin server as a delivery and security layer. Every request therefore passes through Cloudflare, which processes connection data including your IP address to serve pages, filter attacks and separate automated traffic from human traffic. Cloudflare acts under its own privacy terms as well as ours.
Rank Math. A search engine optimization plugin. It manages page titles, meta descriptions, structured data and sitemaps. It works on the content of pages, not on visitors, and does not build a profile of you.
Contact form. Messages sent through the form on our contact page are saved as records in this site database so they can be read and answered. That is covered in detail below.
Caching and hosting. A page cache and the hosting provider keep standard server logs of requests, which include IP addresses, timestamps and requested addresses, for operational and security reasons.

What we collect

Information you give us

Only what you type into the contact form. That normally means a name, an email address and the text of your message, plus anything else you choose to put in the body. The submission is stored in the site database and is also delivered by email so it can be answered. Please do not send financial details, government identification numbers or health information through it. Nothing on this site needs them.

Information collected automatically

Requests to the site generate technical data: IP address, browser and operating system identifiers, referring address, the pages requested, and the time of each request. Cloudflare and the hosting layer see this because they have to in order to deliver a page. Our analytics component stores a hashed form of the IP address rather than the address itself.

Affiliate link click throughs

When you click a product link, that click is recorded on our side as an event so we can see which recommendations readers use. The record is about the link and the page, not about you personally. You are then passed to Amazon, which sets its own cookies on its own domain to attribute the referral and to run its own analytics and advertising. We cannot read those cookies and we do not receive your Amazon account details, your basket, or what you eventually bought. Amazon explains its own handling in its privacy notice. How the commercial side works is on our affiliate disclosure page, and the storage involved is listed in our cookie policy.

Why we process it, and on what legal basis

To deliver and secure the site. Serving pages, blocking abuse, keeping the site up. Legal basis: legitimate interests.
To answer you. Reading and replying to a message you sent. Legal basis: your consent in sending it, and our legitimate interest in running the site.
To understand what is read. Aggregate traffic measurement so we know which reviews are useful and which pages are broken. Legal basis: legitimate interests, and consent where local law requires it for analytics storage.
To earn affiliate revenue. Recording link clicks and receiving commission reports from Amazon. Legal basis: legitimate interests.
To meet legal obligations. Responding to lawful requests and keeping records we are required to keep. Legal basis: legal obligation.

Who else sees your data

We do not sell personal information, we do not rent it, and we do not trade it. It reaches other parties only in these ways: the hosting provider that stores the site; Cloudflare, which handles every request before it reaches the origin; the email provider that carries a reply to you; the analytics service we operate ourselves; Amazon, once you follow a product link and are on Amazon rather than here; and a court, regulator or law enforcement body where we are legally required to hand something over. If the site were ever sold or merged, the site data would move with it, and this page would be updated to name the new operator.

Where data is processed

The site is served through a global delivery network, so a request may be handled at whichever location is nearest to you, and the origin server and analytics store may sit in a different country from the one you are reading in. If you are in the United Kingdom or the European Economic Area, that can mean your data is processed outside your own region under the safeguards our providers publish.

How long it is kept

An honest answer rather than a schedule we would not keep to. Contact form submissions stay in the site database until they are deleted, either because we clear them out or because you ask us to. Server and security logs are kept for as long as the hosting and Cloudflare layers keep them, which is set by those providers and is normally a short rolling window. Analytics events are kept in aggregate for long term traffic comparison; they contain a hashed IP rather than your address. Nothing here is deleted on a fixed timetable, and we are not going to claim otherwise. If you want your data gone sooner, ask and it will be removed.

Your rights in the UK and the EEA

Under the General Data Protection Regulation and equivalent UK law you can ask us to do the following, free of charge in normal circumstances.

Access. Get a copy of the personal data we hold about you.
Rectification. Have inaccurate data corrected or incomplete data completed.
Erasure. Have your data deleted where there is no overriding reason to keep it.
Restriction and objection. Have processing paused, or object to processing we base on legitimate interests, including analytics.
Portability. Receive data you gave us in a machine readable form.
Withdraw consent. Where processing rests on consent, withdraw it at any time, without affecting what was lawful before.
Complain. Take a complaint to your national supervisory authority. In the United Kingdom that is the Information Commissioner's Office.

Your rights in California

Under the California Consumer Privacy Act as amended by the CPRA, California residents may request the categories and specific pieces of personal information collected, the sources it came from, the business purpose, and the categories of third parties it was disclosed to. You may request deletion, request correction, and you may not be treated worse for exercising any of it. In CCPA terms the categories that can be collected here are identifiers, internet or network activity, and geolocation inferred from an IP address at a coarse level.

We do not sell personal information and we do not share it for cross context behavioral advertising as those terms are defined by the CCPA. There is no advertising network tag on this site. Because there is no sale and no sharing, there is no opt out link to offer. Note that once you follow a link to Amazon, Amazon collects data under its own notice and its own choices apply there, not ours.

Cookies and tracking

Every cookie and storage item that runs on this site is named and explained in our cookie policy, along with how to refuse or delete each one from your browser and what stops working if you do. Browsers also send a Do Not Track or Global Privacy Control signal; since we neither sell nor share personal information there is nothing for such a signal to switch off here.

Security

The site is served over an encrypted connection, sits behind a network security layer, and administrative access is restricted. That is a reasonable standard of care, not a promise of invulnerability. No website can guarantee that data sent over the internet is completely safe, and anyone who tells you otherwise is overselling.

Children

VeryCosy.com is written for adults buying furniture, mounting hardware and pet supplies. It is not directed at children under 13, and we do not knowingly collect personal information from them. If you are a parent or guardian and believe a child has sent us information through the contact form, tell us and the record will be deleted.

Changes to this policy

When the software behind the site changes, this page changes with it and the date at the top moves. Material changes will be summarized at the top of the page. Continuing to use the site after an update means the current version applies to you.

How to reach us

Requests about your data, including access, correction and deletion, go through the form on our contact page. Say plainly what you want done. We may need to ask a question to confirm the request is genuinely yours before acting on it, and we will not use anything you send for that purpose for anything else.