Privacy policy

Last updated: 4 October 2026

This policy explains how we process personal data when you visit merrylittledecember.com (the “Site”) and buy Merry Little December products. It covers the data we use, why we use it, our legal bases, retention periods, recipients and your rights under the General Data Protection Regulation (“GDPR”) and the Data Protection Act 2018.

If you live in the United Kingdom, the United Kingdom General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”) also apply. References in this policy to the GDPR include the UK GDPR where it applies. The paragraphs headed “UK residents” explain what differs for you.

1. Data controller

Oblivion Capital LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA, registration Company registered in the State of Wyoming (USA) – EIN 98-1882590.
For questions about your data, contact [email protected].

2. Data we process

Browsing data: IP address, browser and device type, pages viewed, date and time. Our hosting provider processes this information to display and protect the Site, including security and abuse prevention. It also derives the country of your connection from your IP address so that we can show prices in your currency (pounds sterling in the United Kingdom, euros elsewhere); we do not store this country.
Order data: email address, name and country entered at checkout, products purchased, amount, date, order reference, evidence of your consent to immediate supply and acknowledgement of losing your right of withdrawal, and campaign parameters (UTM) from your visit. Payment details are entered directly with Stripe. We never receive your full card number.
Messages to us: your email address and the contents of your messages.
Tips and offers email data: email address, first name if supplied at checkout, products purchased, order reference and date, language, currency of your orders, and consent or objection status with its date. (see below).

3. Purposes and legal bases

Purpose	Legal basis under Article 6 GDPR
Display and protect the Site	Our legitimate interest in providing a reliable, secure website
Process orders, deliver files by email, provide customer service, and manage guarantees and refunds	Performance of the contract
Provide a one-click additional purchase on the confirmation page after a card payment	Performance of the additional contract if you choose to accept the offer
Keep accounting records and supporting documents	Legal obligation
Prevent payment fraud	Legitimate interest
Measure where sales come from using UTM parameters associated with an order	Our legitimate interest in understanding campaign performance, without placing a tracker on your device
Email customers tips and offers about our own products similar to those purchased	Legitimate interest, subject to the customer soft opt-in conditions in Regulation 13 of S.I. No. 336 of 2011. You can object when your address is collected and in every email. The first marketing email is sent within 12 months of purchase.

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.

UK residents. The same legal bases apply under Article 6 of the UK GDPR. Cookies and similar technologies that are not strictly necessary, such as the Meta Pixel where we use it, are set only with your consent under regulation 6 of PECR. We send emails about our own similar products only to customers, under the soft opt-in in regulation 22(3) of PECR: you are told at checkout, you can refuse there free of charge, and every email lets you unsubscribe in one click. We do not send reminder or marketing emails to people who have not bought from us, including people who started but did not complete an order.

If you have purchased: in the days after your order, we may send a few emails with ideas for using your files and offers for our own similar products, such as a complementary kit you do not already have. We explain this at checkout and on the order confirmation page. At checkout, choose “No thanks, I don't want to receive them” in the “Tips, offers and reminder by email” field to refuse. The first marketing email is sent within 12 months of your purchase.
If you have not purchased: we do not send you tips and offers emails. Our customer soft opt-in does not apply to an incomplete purchase.
Unsubscribe: at any time, free of charge, use the one-click unsubscribe link in any marketing email, your email service’s “Unsubscribe” button, reply “STOP”, or write to [email protected]. We will still send order emails, including download links and refund confirmations.
No open or click tracking: Resend (Plus Five Five, Inc., United States) sends these emails for us with open and click tracking switched off: no tracking pixel (invisible image), no redirected links. Links go straight to our Site.

4. Recipients and service providers

Your data is used by Oblivion Capital LLC and by these providers only as needed for their work:

Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA): hosting and delivering the Site, running the order service and storing downloadable files, as a processor.
Stripe (Stripe Payments Europe, Limited, Ireland): online payments and fraud prevention. For some operations, including fraud prevention and regulatory obligations, Stripe acts as a separate controller. Its privacy policy is available at stripe.com/ie/privacy.
Resend (Plus Five Five, Inc., United States): sending order confirmations, delivery emails and refund confirmations, without tracking pixels or click tracking (processor).
Brevo (Sendinblue SAS, France): managing contact lists and unsubscribes for the emails described above, without open or click tracking. It acts as a processor established in the European Union. These emails are sent through Resend (Plus Five Five, Inc., United States), as a processor.
Our professional advisers, including accountants and lawyers, and authorities where legally required.

We do not sell your data.

5. Transfers outside the European Economic Area

Oblivion Capital LLC is established in the United States. Some providers, including Cloudflare, Inc., Resend (Plus Five Five, Inc., United States), and Stripe for some operations, may also process data in the United States or other countries outside the European Economic Area.

For Resend (Plus Five Five, Inc., United States), transfers rely on its operator’s certification under the EU–US Data Privacy Framework (and its UK Extension) and on the standard contractual clauses (Module 2, controller to processor, with the UK Addendum) in its data processing agreement. Where GDPR international transfer rules apply, transfers require an applicable safeguard. These may include the European Commission’s EU–US Data Privacy Framework adequacy decision for certified organisations whose certification covers the transfer, or the Commission’s standard contractual clauses with supplementary measures where needed. You can write to us for details and a copy of the safeguards applicable to your data.

UK residents. Where the UK GDPR applies, transfers outside the United Kingdom rely on UK adequacy regulations, including the UK Extension to the EU–US Data Privacy Framework for certified organisations whose certification covers the transfer, or on the International Data Transfer Agreement or the International Data Transfer Addendum to the EU standard contractual clauses issued under the UK GDPR, with supplementary measures where needed. You can write to us for details and a copy of these safeguards.

6. Retention periods

Order data and accounting records: 6 years from the end of the relevant accounting period for tax and accounting requirements, or longer where a specific legal obligation requires it.
Customer data used to manage our relationship and send offers: 3 years from your last purchase or last contact with us. This retention period does not itself authorise marketing emails.
If you unsubscribe, we retain only your email address on a suppression list for as long as needed to respect your objection.
Customer service messages: 3 years from the last exchange.
Hosting security logs: a limited period set by the hosting provider for Site security.

7. Your rights

Subject to the GDPR conditions, you have rights of access, rectification, erasure, restriction and data portability. You can object to processing based on legitimate interest. You can object to direct marketing at any time, without giving a reason. Where processing relies on consent, you can withdraw it at any time. This does not affect the lawfulness of earlier processing.

To exercise your rights, write to [email protected]. We respond within one month. For complex or numerous requests, we may extend this by two months and will explain the extension within the first month. If we have reasonable doubts about your identity, we may ask for information to verify it.

You may complain to the Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland, www.dataprotection.ie, or to the supervisory authority in your EU country of residence. You do not have to contact us first.

UK residents. You have the same rights under the UK GDPR. You also have the right to complain to the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom, telephone 0303 123 1113, ico.org.uk. We would appreciate the chance to deal with your concern first, so please consider writing to [email protected] before contacting the ICO.

8. Required information

You can browse the Site without submitting information to us, although technical browsing data is processed as described above. Your email address and the payment information requested at checkout are needed to complete your purchase and deliver your files. Without them, the order cannot be completed.

9. Security

The Site uses HTTPS throughout. Download links are signed and expire after a limited time. Access to data is restricted to people who need it.

10. Changes

We may update this policy when our services or legal requirements change. The last updated date appears at the top of this page.

Back to the main page