Privacy Policy
Last updated: 9 August 2026
Heavy Duty Manual sells PDF manuals. This page says exactly what we collect, why, how long we keep it, and how to make us delete it. We do not sell personal data, we do not run advertising trackers, and we do not share anything with third parties except the two processors named below.
What we collect
| Your email address | Given at checkout and at sign-in. It is your account: it is how we send your download link and how you get back to your orders. Kept for as long as we keep the order (see below). |
|---|---|
| Your orders | What you bought, when, the price, and the reference the payment processor gave it. |
| Download records | Each time a file is fetched we record the time, the IP address, the browser's user-agent string, and a checksum of the file served. |
| Your agreement to the terms | When you ticked the box, from which IP address, and the exact version and checksum of the documents shown to you at that moment. |
| Sign-in activity | Sign-in attempts, with time and IP address, and whether they succeeded. |
We do not collect your name, address or phone number, and we never see your card details — those go directly to our payment processor and never touch our servers.
Why we keep it, and on what legal basis
Under UK/EU GDPR terms:
- Performance of a contract — your email and order records exist so that we can deliver the file you paid for and re-issue the link when it expires.
- Legitimate interests — download records, consent records and sign-in activity exist to prove delivery in a payment dispute, and to stop someone brute-forcing their way into your account. We consider this proportionate because the alternative is being unable to answer a chargeback, and because the data is minimal and never used to profile anyone.
- Legal obligation — sales records are retained for tax purposes.
We do not rely on consent for any of the above, and we send no marketing email at all — every message from us is about an order you placed or a sign-in you requested.
How long we keep it
Seven years for orders, consent records and download records. That is not an arbitrary choice: card-scheme arbitration windows, a four-year contract limitation period in Texas and six years in the UK all sit inside it. Sign-in activity is deleted after 90 days, and expired sign-in links and dead sessions are deleted automatically.
Who else sees it
- Lemon Squeezy (Link, LLC) is the merchant of record and processes the payment. They receive your email address and see your card details; we never do. Their privacy policy governs what they hold.
- Resend delivers our email. They handle the address the message is sent to and its contents.
- Cloudflare sits in front of this site and processes connection data including your IP address.
That is the complete list. No analytics, no advertising networks, no data brokers.
Cookies
One cookie, set only if you sign in: a session identifier that keeps you signed in
for 30 days. It is HttpOnly, SameSite=Lax and, over https,
Secure. It carries no information about you — it is a random value that
points at a row in our database. There are no analytics or advertising cookies, which
is why this site shows you no cookie banner. Your cart is kept in your own browser's
local storage and never reaches us until you check out.
Your rights
You can exercise the first two yourself, immediately, from your account page:
- Access and portability — download everything we hold about you as a JSON file.
- Erasure — delete your account. Your email address is removed from your order records and replaced with an anonymous marker; the order rows themselves remain, because we must keep the sales record, and once anonymised they no longer identify you. Your sign-in history, sign-in links and all your sessions are deleted outright.
Two things are deliberately not erased, and we would rather say so than imply otherwise: the record of your agreement to the terms, and the log of files actually downloaded. Both are held in tamper-proof, append-only form precisely so they can answer a payment dispute — evidence that can be rewritten on request is not evidence. We rely on Article 17(3)(e) (defence of legal claims) to keep them, and they are deleted with everything else at the end of the seven-year window. If you object to this, email us and we will consider your specific circumstances.
Deleting your account also destroys your download links. If you want your files, download them first — we cannot restore access afterwards.
For rectification, restriction, objection, or any question about the above, email [email protected]. We answer within 30 days. If you are in the UK or EU and are unhappy with our answer, you may complain to your national data protection authority.
California
We do not sell or share personal information as those terms are defined by the CCPA, and we have not done so in the preceding twelve months. The access and deletion rights above are available to California residents on the same terms, and we will not discriminate against you for using them.
Where the data lives
Our database is held on our own hardware. Our processors operate internationally; transfers out of the UK/EEA rely on those providers' standard contractual clauses.
Changes
If we change this policy we update the date at the top. Material changes that affect what we collect or why will be emailed to account holders.
Contact
Heavy Duty Manual — [email protected]. We are the data controller for everything described here.