Privacy Policy

1. Scope of this Policy

This Privacy Policy applies to Thimble ("the Site", "We", "Us" or "Our"), an independent editorial publication about women's luxury high heels, operated at thimble.info. It explains how We collect, use, share and protect information about You when You read our articles, subscribe to our newsletter or contact our editorial desk.

By using the Site, You agree to the collection and use of information as described in this Policy. If You do not agree, please discontinue use of the Site and, where applicable, decline non-essential cookies or unsubscribe from our newsletter.

2. Information We Collect

Information You give Us directly.

• Newsletter: your email address, subscription date and — if you open our mail — anonymised open and click events.
• Enquiries: your name, email address and the content of your message when you contact us at privacy@thimble.info or editor@thimble.info.
• Contributions: any material you voluntarily submit for publication, plus the attribution you ask us to use.

Information collected automatically.

• Usage data: pages visited, reading time, referrer, entry and exit pages, and approximate region derived from your IP address (city or country level).
• Device data: browser type and version, operating system, screen size, language and user agent string.
• Cookie identifiers: see section 5.

What we do not collect. We do not operate a shop on this Site, so we do not process payment card details. We do not ask for, and ask you not to send, special category data such as health information, biometric data, or details about your racial or ethnic origin, religion, political opinions or sexual orientation.

3. Legal Basis & Purpose of Processing

Under the EU and UK General Data Protection Regulation (Regulation (EU) 2016/679 — "GDPR") and Brazil's General Data Protection Law (Lei nº 13.709/2018 — "LGPD"), we must have a lawful basis for each processing activity. The table below sets out ours.

Where we rely on consent, you may withdraw it at any time (see section 10). Withdrawal does not affect the lawfulness of processing carried out before it.

4. How We Use Your Information

• To deliver, maintain and improve the Site and its editorial content.
• To understand which stories our readers value, so we commission better ones.
• To send The Sunday Edit newsletter to people who have asked for it.
• To reply to enquiries, corrections and partnership requests.
• To keep the Site secure, prevent fraud, abuse and unauthorised scraping.
• To comply with legal, accounting and regulatory obligations.

We never use your data to make automated decisions that produce legal effects concerning you, and we do not carry out solely automated profiling of the kind regulated by Article 22 GDPR.

5. Cookies & Similar Technologies

We use cookies, local storage and similar technologies to make the Site work, to remember your choices, to measure readership and — where advertising is shown — to select and measure ads. You can accept or decline non-essential cookies, and you can change your choice at any time in your browser settings.

Blocking strictly necessary cookies may prevent parts of the Site from loading. Declining analytics or advertising cookies will not reduce the editorial you can read.

6. Personalised Advertising & Your Opt-Out Choices

Thimble is reader-funded editorially and may display advertising provided by third parties, including Google. These partners may use cookies or similar technologies to serve ads based on your visits to this and other websites — known as interest-based or personalised advertising.

You can opt out of personalised advertising at any time:

California residents: we do not sell your personal information, and we do not share it for cross-context behavioural advertising without giving you the ability to opt out, as those terms are defined by the CCPA as amended by the CPRA.

7. How We Share Information

• Service providers (processors): hosting and content delivery, analytics, newsletter delivery and security providers, who act only on our instructions and under contract.
• Advertising partners: where advertising is displayed, for the purposes described in section 6.
• Legal and safety: where required by law, court order or competent authority, or to establish, exercise or defend legal claims.
• Business transfers: in connection with a merger, acquisition or transfer of assets, in which case we will notify you before your data becomes subject to a different privacy policy.
• With your consent: for any other purpose you specifically agree to.

We do not sell your personal data, and we do not disclose the identity of individual readers to the brands we write about.

8. International Data Transfers

Our infrastructure and processors may store or process data outside your country of residence, including in the United States. Where we transfer personal data out of the EEA, the UK or Brazil, we rely on adequacy decisions where available, or on Standard Contractual Clauses (GDPR Art. 46) and equivalent contractual safeguards, together with supplementary technical measures such as encryption in transit.

9. How Long We Keep Data

We keep personal data only as long as necessary for the purposes set out above, then delete it or irreversibly anonymise it. Typical periods are given in the table in section 3. Anonymised statistics that can no longer be linked to you may be retained indefinitely, because they are no longer personal data.

10. Your Rights

If you are in the EEA, the UK or Switzerland (GDPR):

• Right of access — obtain a copy of the personal data we hold about you.
• Right to rectification — have inaccurate or incomplete data corrected.
• Right to erasure ("right to be forgotten") — have your data deleted where the grounds apply.
• Right to restriction — ask us to pause processing while a dispute is resolved.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests, including profiling.
• Right to withdraw consent at any time, including for cookies and the newsletter.
• Right to lodge a complaint with your national supervisory authority.

If you are in Brazil (LGPD, Art. 18):

• Confirmation that we process your data, and access to that data.
• Correction of incomplete, inaccurate or out-of-date data.
• Anonymisation, blocking or deletion of unnecessary or excessive data, or data processed unlawfully.
• Portability of your data to another provider, in line with ANPD regulations.
• Information about the public and private entities with which we have shared your data.
• Information about the consequences of refusing consent.
• Withdrawal of consent at any time, free of charge.
• The right to object to processing carried out on a basis other than consent, where you believe it is non-compliant.
• The right to request review of decisions made solely by automated processing where these affect your interests.

If you are in California (CCPA/CPRA):

• Right to know the categories and specific pieces of personal information collected, the sources, purposes and categories of recipients.
• Right to delete personal information we collected from you, subject to exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing of personal information — we do not sell it.
• Right to limit use and disclosure of sensitive personal information — we do not collect it.
• Right to non-discrimination for exercising any of these rights.

How to exercise your rights. Email privacy@thimble.info with the right you wish to exercise. We will acknowledge GDPR requests within 30 days and LGPD requests within 15 days. We may ask for enough information to verify your identity before acting, and we will never charge you for making a request.

11. Children's Privacy

Thimble is an editorial site for adults and is not directed to children. We do not knowingly collect personal data from children under 13 (or under 16 in the EEA and Brazil, where the age of consent for information society services may be higher). If you believe a child has provided us with personal data, contact privacy@thimble.info and we will delete it promptly.

12. Data Security

We use HTTPS encryption in transit, restricted administrative access, least-privilege accounts and regular updates to protect your information. No method of transmission or storage over the internet is completely secure, so while we take reasonable and proportionate measures, we cannot guarantee absolute security. If a breach affecting your rights occurs, we will notify you and the relevant authority where the law requires it.

13. Third-Party Links & Embedded Content

Our articles may link to brand boutiques, retailers and news sources, and may embed publicly available imagery. Those sites and services operate under their own privacy policies, which we encourage you to read; we are not responsible for their practices once you leave thimble.info.

14. Do Not Track & Global Privacy Control

We honour Global Privacy Control (GPC) signals as a valid opt-out of personalised advertising where technically feasible. Browser "Do Not Track" headers have no agreed standard; we therefore rely on the cookie and opt-out controls described in sections 5 and 6.

15. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, our technology or the law. We will post the revised version on this page, update the "Last Updated" date above, and — for material changes — provide a clearer notice on the Site. Your continued use of the Site after changes take effect means you accept the revised Policy.

16. Contact Us

For any question about this Privacy Policy, or to exercise your rights, contact us:

Effective date: May 2, 2026 · Version 2.0