Privacy Notice

Last updated: 4 November 2026

This notice explains what personal information we collect when you use this website or buy from us, why we need it, who sees it, and the rights you have over it.

Who we are

We're responsible for your personal information (the "controller" in data protection law). Contact us about anything in this notice:

What we collect

• Your order: your name, email address, delivery address, what you ordered and in which sizes, any discount code used, and the amount paid.
• Payment information: you enter your payment details on Stripe's page, and we never see or store your full card number. Stripe tells us whether the payment worked and gives us a payment reference.
• Messages: anything you send us, such as questions or return requests.
• Technical information: your IP address and details of the pages requested. Our hosting provider records these, and our website uses IP addresses briefly to limit repeated attempts and misuse.

We don't need any special category information, such as health details, so please don't send it to us. Our shop isn't aimed at children.

Why we use it, and our legal basis

• To take payment, deliver your order, and handle returns or questions about it. Basis: necessary to carry out our contract with you. We can't fulfil your order without this information.
• To keep tax and accounting records. Basis: necessary to meet our legal obligations.
• To keep the website secure and prevent fraud and misuse. Basis: our legitimate interests in protecting our customers and our business.

We don't send marketing emails, and we don't sell your information. If we ever want to send marketing, we'll ask you first.

Cookies and browser storage

We don't use analytics or advertising cookies, so there's no cookie banner. We only store what the shop needs to work, on your own device:

• Your basket stays in your browser until you complete an order or clear your browser's site data.
• Your checkout details and discount code are kept for that browser tab, so you don't have to retype them if you come back from the payment page. They're cleared when the order completes or the tab closes.
• Staff login: a single cookie keeps our staff logged in to the admin area. Customers don't get it.

Stripe's payment page uses its own cookies to process payments and prevent fraud. These are covered by Stripe's privacy policy.

Who we share it with

• Stripe processes payments. It receives your email address, what you ordered, the amount, and the payment details you enter on its page. It also acts independently for some purposes, such as preventing fraud, and this may include automated checks. Stripe's privacy policy.
• Railway hosts this website and stores order information for us. Railway's privacy policy.
• Google Fonts supplies the fonts on this website, so your browser sends your IP address to Google when pages load. Google's privacy policy.
• Resend sends our order confirmation emails. It receives your email address and the contents of the email, including your order and delivery address. Resend's privacy policy.
• Delivery companies and print or fulfilment suppliers we use receive the details needed to make and deliver your order. Ask us if you'd like to know who they are.
• Google provides our Gmail email account, so it handles messages between us.
• Others, where needed: our accountant or professional advisers, and authorities such as HMRC where the law requires it.

Transfers outside the UK

Your order information is stored in Railway's European region, but Railway is a US company. Railway's contract with us protects UK data using the UK-US data bridge where it applies, and otherwise standard contractual clauses with the UK Addendum. Stripe, Resend and Google may also handle information outside the UK, under the safeguards described in their privacy policies. Contact us for more details or a copy of these safeguards.

How long we keep it

• Completed orders: six years, for tax and accounting records.
• Checkouts you don't finish: deleted automatically, normally within about 30 minutes of your payment session ending. A payment method that takes days to clear stays until it succeeds or fails.
• Messages: up to 2 years, or longer if they're part of a claim.
• Technical logs: kept by our hosting provider for a limited period under its own retention settings. Addresses held by our website to limit misuse are cleared automatically and don't survive a restart.

Your rights

You can ask us, free of charge, to:

• give you a copy of your information
• correct anything that's wrong or incomplete
• delete your information, where we don't need to keep it by law
• restrict how we use it in certain situations
• give you the information you provided in a format you can move elsewhere, where this applies

Your right to object: you can object at any time to us using your information based on our legitimate interests. We'll stop unless we have compelling reasons to continue or need it for a legal claim.

To use any of these rights, email us. We'll normally reply within one month.

Complaints

If you're unhappy with how we've used your information, please tell us first so we can try to put it right. You can also complain at any time to the UK regulator, the Information Commissioner's Office (ICO):

Changes to this notice

If we change how we use your information, we'll update this page and the date at the top.